Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
fjL0EcgV6Y.exe

Overview

General Information

Sample name:fjL0EcgV6Y.exe
renamed because original name is a hash value
Original sample name:6bcab686349807f131a92c8fe7a4d736.exe
Analysis ID:1437711
MD5:6bcab686349807f131a92c8fe7a4d736
SHA1:487846c6d51f8df894bb174542a81fd0eb25e1ae
SHA256:ccabd5bc8499c485e7abab1825f67a753a8ccfc822037f2368e3c6fa5f570926
Tags:exeRiseProStealer
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, RisePro Stealer, Stealc
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Sigma detected: Drops script at startup location
Yara detected Amadeys Clipper DLL
Yara detected Amadeys stealer DLL
Yara detected AntiVM3
Yara detected LummaC Stealer
Yara detected Mars stealer
Yara detected RedLine Stealer
Yara detected RisePro Stealer
Yara detected Stealc
Yara detected UAC Bypass using CMSTP
Yara detected Vidar stealer
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates HTML files with .exe extension (expired dropper behavior)
Creates multiple autostart registry keys
Disables UAC (registry)
Drops script or batch files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Injects a PE file into a foreign processes
Installs new ROOT certificates
Loading BitLocker PowerShell Module
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Script Execution From Temp Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes many files with high entropy
Writes to foreign memory regions
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops certificate files (DER)
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • fjL0EcgV6Y.exe (PID: 1424 cmdline: "C:\Users\user\Desktop\fjL0EcgV6Y.exe" MD5: 6BCAB686349807F131A92C8FE7A4D736)
    • explorta.exe (PID: 4092 cmdline: "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe" MD5: 6BCAB686349807F131A92C8FE7A4D736)
      • explorta.exe (PID: 7132 cmdline: "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe" MD5: 6BCAB686349807F131A92C8FE7A4D736)
      • amert.exe (PID: 5784 cmdline: "C:\Users\user\AppData\Local\Temp\1000019001\amert.exe" MD5: F94CAD2EA8087F7452D99C57BF5C935E)
        • explorha.exe (PID: 3564 cmdline: "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe" MD5: F94CAD2EA8087F7452D99C57BF5C935E)
      • aea7caadbf.exe (PID: 5424 cmdline: "C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe" MD5: 9B38B95FC36FD9B330018EC18E7DEB9D)
        • schtasks.exe (PID: 5048 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
          • conhost.exe (PID: 500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • schtasks.exe (PID: 6684 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
          • conhost.exe (PID: 5012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • 2c9ff67496.exe (PID: 712 cmdline: "C:\Users\user\1000021002\2c9ff67496.exe" MD5: A45EC26929E9563254198D2B394D4D17)
        • chrome.exe (PID: 2444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
          • chrome.exe (PID: 6540 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 --field-trial-handle=2032,i,3277131894660533735,10710382389248485071,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
          • chrome.exe (PID: 7852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 --field-trial-handle=2032,i,3277131894660533735,10710382389248485071,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • explorta.exe (PID: 1292 cmdline: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe MD5: 6BCAB686349807F131A92C8FE7A4D736)
  • explorha.exe (PID: 4896 cmdline: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe MD5: F94CAD2EA8087F7452D99C57BF5C935E)
    • rundll32.exe (PID: 7672 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)
      • rundll32.exe (PID: 7696 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main MD5: EF3179D498793BF4234F708D3BE28633)
        • netsh.exe (PID: 7844 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)
          • conhost.exe (PID: 7852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 8120 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)
          • conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • swiiiii.exe (PID: 7680 cmdline: "C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe" MD5: 1C7D0F34BB1D85B5D2C01367CC8F62EF)
      • conhost.exe (PID: 7704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • RegAsm.exe (PID: 7772 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
      • WerFault.exe (PID: 7928 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7680 -s 872 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • rundll32.exe (PID: 7972 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)
    • jok.exe (PID: 8040 cmdline: "C:\Users\user\AppData\Local\Temp\1000071001\jok.exe" MD5: 8510BCF5BC264C70180ABE78298E4D5B)
    • swiy.exe (PID: 7728 cmdline: "C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe" MD5: 317465164F61FE462864A65B732CCC13)
      • conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • RegAsm.exe (PID: 5584 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
      • RegAsm.exe (PID: 3544 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
    • file300un.exe (PID: 3940 cmdline: "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" MD5: C1D583657C7FE7973F820983FD1ABB81)
      • powershell.exe (PID: 7616 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • CasPol.exe (PID: 7556 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)
      • InstallUtil.exe (PID: 8048 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)
      • InstallUtil.exe (PID: 8116 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)
    • gold.exe (PID: 7160 cmdline: "C:\Users\user\AppData\Local\Temp\1000079001\gold.exe" MD5: F15A9CFA3726845017A7F91ABE0A14F7)
      • RegAsm.exe (PID: 6540 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
  • MPGPH131.exe (PID: 5096 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 9B38B95FC36FD9B330018EC18E7DEB9D)
  • MPGPH131.exe (PID: 7288 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 9B38B95FC36FD9B330018EC18E7DEB9D)
  • aea7caadbf.exe (PID: 8100 cmdline: "C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe" MD5: 9B38B95FC36FD9B330018EC18E7DEB9D)
  • explorta.exe (PID: 3580 cmdline: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe MD5: 6BCAB686349807F131A92C8FE7A4D736)
  • RageMP131.exe (PID: 7608 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 9B38B95FC36FD9B330018EC18E7DEB9D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Lumma Stealer, LummaC2 StealerLumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
NameDescriptionAttributionBlogpost URLsLink
AmadeyAmadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
NameDescriptionAttributionBlogpost URLsLink
StealcStealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline. Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://49.13.229.86/c73eed764cc59dcb.php"}

Threatname: LummaC

{"C2 url": ["pillowbrocccolipe.shop", "communicationgenerwo.shop", "communicationgenerwo.shop", "diskretainvigorousiw.shop", "affordcharmcropwo.shop", "dismissalcylinderhostw.shop", "enthusiasimtitleow.shop", "worryfillvolcawoi.shop", "cleartotalfisherwo.shop"], "Build id": "LGNDR1--ketamine"}

Threatname: Amadey

{"C2 url": ["193.233.132.56/Pneh2sXQk0/index.php"]}

Threatname: RedLine

{"C2 url": ["185.215.113.67:26260"], "Bot Id": "Test1234", "Authorization Header": "bed37b7c341f364ee692c5adfa824881"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\FBI40obsDIWEYEPEV328oLc.zipJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
    C:\Users\user\AppData\Local\Temp\1000071001\jok.exeJoeSecurity_RedLineYara detected RedLine StealerJoe Security
      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\clip64[1].dllJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\clip64[1].dllJoeSecurity_Amadey_3Yara detected Amadey\'s Clipper DLLJoe Security
          C:\Users\user\AppData\Local\Temp\CaDLjLgaJOb2EJDbtX6Wfco.zipJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
            Click to see the 10 entries

            Memory Dumps

            SourceRuleDescriptionAuthorStrings
            0000002C.00000002.2426954025.0000000000FD1000.00000020.00000001.01000000.00000007.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
              00000000.00000002.2083851627.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                00000007.00000002.3093234156.000000000103E000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
                  0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                    00000007.00000002.3093234156.00000000010C3000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                      Click to see the 55 entries

                      Unpacked PEs

                      SourceRuleDescriptionAuthorStrings
                      51.2.InstallUtil.exe.400000.0.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
                        38.2.swiy.exe.3f65570.0.unpackJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                          38.2.swiy.exe.3f65570.0.unpackJoeSecurity_MarsStealerYara detected Mars stealerJoe Security
                            41.2.RegAsm.exe.400000.0.raw.unpackJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                              41.2.RegAsm.exe.400000.0.raw.unpackJoeSecurity_MarsStealerYara detected Mars stealerJoe Security
                                Click to see the 17 entries

                                Sigma Signatures

                                System Summary

                                barindex
                                Sigma detected: New RUN Key Pointing to Suspicious Folder
                                Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe, ProcessId: 4092, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aea7caadbf.exe
                                Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe, ParentProcessId: 3940, ParentProcessName: file300un.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force, ProcessId: 7616, ProcessName: powershell.exe
                                Sigma detected: Suspicious Script Execution From Temp Folder
                                Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7696, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 8120, ProcessName: powershell.exe
                                Sigma detected: CurrentVersion Autorun Keys Modification
                                Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe, ProcessId: 4092, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aea7caadbf.exe
                                Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet
                                Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems), frack113: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7696, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 8120, ProcessName: powershell.exe
                                Sigma detected: Powershell Defender Exclusion
                                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe, ParentProcessId: 3940, ParentProcessName: file300un.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force, ProcessId: 7616, ProcessName: powershell.exe
                                Sigma detected: Suspicious Add Scheduled Task Parent
                                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST, CommandLine: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe, ParentProcessId: 5424, ParentProcessName: aea7caadbf.exe, ProcessCommandLine: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST, ProcessId: 5048, ProcessName: schtasks.exe
                                Sigma detected: Non Interactive PowerShell Process Spawned
                                Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7696, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 8120, ProcessName: powershell.exe

                                Data Obfuscation

                                barindex
                                Sigma detected: Drops script at startup location
                                Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, ProcessId: 8048, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STCrhsi84NOAwKBL55hj4E9M.bat

                                Stealing of Sensitive Information

                                barindex
                                Sigma detected: Capture Wi-Fi password
                                Source: Process startedAuthor: Joe Security: Data: Command: netsh wlan show profiles, CommandLine: netsh wlan show profiles, CommandLine|base64offset|contains: l, Image: C:\Windows\System32\netsh.exe, NewProcessName: C:\Windows\System32\netsh.exe, OriginalFileName: C:\Windows\System32\netsh.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7696, ParentProcessName: rundll32.exe, ProcessCommandLine: netsh wlan show profiles, ProcessId: 7844, ProcessName: netsh.exe

                                Snort Signatures

                                ⊘No Snort rule has matched

                                Joe Sandbox Signatures

                                Click to jump to signature section

                                Show All Signature Results

                                AV Detection

                                barindex
                                Antivirus / Scanner detection for submitted sample
                                Source: fjL0EcgV6Y.exeAvira: detected
                                Antivirus detection for dropped file
                                Source: C:\Users\user\1000021002\2c9ff67496.exeAvira: detection malicious, Label: TR/AutoIt.mzmcv
                                Found malware configuration
                                Source: 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: StealC {"C2 url": "http://49.13.229.86/c73eed764cc59dcb.php"}
                                Source: 32.0.jok.exe.490000.0.unpackMalware Configuration Extractor: RedLine {"C2 url": ["185.215.113.67:26260"], "Bot Id": "Test1234", "Authorization Header": "bed37b7c341f364ee692c5adfa824881"}
                                Source: 31.2.rundll32.exe.6be60000.0.unpackMalware Configuration Extractor: Amadey {"C2 url": ["193.233.132.56/Pneh2sXQk0/index.php"]}
                                Source: RegAsm.exe.7772.25.memstrminMalware Configuration Extractor: LummaC {"C2 url": ["pillowbrocccolipe.shop", "communicationgenerwo.shop", "communicationgenerwo.shop", "diskretainvigorousiw.shop", "affordcharmcropwo.shop", "dismissalcylinderhostw.shop", "enthusiasimtitleow.shop", "worryfillvolcawoi.shop", "cleartotalfisherwo.shop"], "Build id": "LGNDR1--ketamine"}
                                Multi AV Scanner detection for dropped file
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeReversingLabs: Detection: 47%
                                Source: C:\Users\user\AppData\Local\1ZiD49yFoSPKKQmrglTINzlo.exeReversingLabs: Detection: 79%
                                Source: C:\Users\user\AppData\Local\1llpE1der8s65YfF1DaRwzoA.exeReversingLabs: Detection: 50%
                                Source: C:\Users\user\AppData\Local\29IA9rCjPmrMnnZQZ7YKNcOZ.exeReversingLabs: Detection: 50%
                                Source: C:\Users\user\AppData\Local\2MTLbmRYdCbpYlRWWULShPZa.exeReversingLabs: Detection: 50%
                                Source: C:\Users\user\AppData\Local\4PmoraVG5R1jZgxSXUXnrPno.exeReversingLabs: Detection: 47%
                                Source: C:\Users\user\AppData\Local\4WIaPCqUVwVYRafs2f1atHjf.exeReversingLabs: Detection: 50%
                                Source: C:\Users\user\AppData\Local\4ptz7FM4kP7qMGFoFqE5j0zm.exeReversingLabs: Detection: 25%
                                Source: C:\Users\user\AppData\Local\5N2KVotsup59l0rdMarxmZjH.exeReversingLabs: Detection: 50%
                                Source: C:\Users\user\AppData\Local\6xNdov8AZo7X4GIGr08JaGXe.exeReversingLabs: Detection: 25%
                                Source: C:\Users\user\AppData\Local\87yah1hG3sRWG8d7DMFA6UPI.exeReversingLabs: Detection: 47%
                                Source: C:\Users\user\AppData\Local\8gEIcaaLXjtHWMkCknRgnRyn.exeReversingLabs: Detection: 50%
                                Source: C:\Users\user\AppData\Local\91UaPJ59dXTYhY2K658YFFeC.exeReversingLabs: Detection: 50%
                                Source: C:\Users\user\AppData\Local\CS3gyNCBkgUy4GD82bQforlP.exeReversingLabs: Detection: 50%
                                Source: C:\Users\user\AppData\Local\CZ8BPZs8awoPJiACUS73pAe6.exeReversingLabs: Detection: 50%
                                Source: C:\Users\user\AppData\Local\D6PuoAsNvye4jtgG7lWCsXEx.exeReversingLabs: Detection: 79%
                                Source: C:\Users\user\AppData\Local\EmEyDLXTX7wKV3Hm4GA8AbdZ.exeReversingLabs: Detection: 25%
                                Source: C:\Users\user\AppData\Local\EqMO5smfp2bzSmy94pnHeeak.exeReversingLabs: Detection: 47%
                                Source: C:\Users\user\AppData\Local\FsKEmkdvDCAc7VY3lRIiRKAL.exeReversingLabs: Detection: 47%
                                Source: C:\Users\user\AppData\Local\GXqvrU2YdMIpdqoqkBIkuQ4a.exeReversingLabs: Detection: 50%
                                Source: C:\Users\user\AppData\Local\HUsiXwAPudopBX0gkG8zqZ9K.exeReversingLabs: Detection: 79%
                                Source: C:\Users\user\AppData\Local\IGVPHrAShfg5S77hqubJkQGT.exeReversingLabs: Detection: 79%
                                Source: C:\Users\user\AppData\Local\IwVIt8hVIPrEsgJdmcJDc0cp.exeReversingLabs: Detection: 79%
                                Source: C:\Users\user\AppData\Local\J60VIKU1uGOij5ybpvmDPTRI.exeReversingLabs: Detection: 25%
                                Source: C:\Users\user\AppData\Local\JfX04QeZvezkOn3eIpEjUqc5.exeReversingLabs: Detection: 79%
                                Source: C:\Users\user\AppData\Local\KEohnm8N5FXDryvXGbq4vqXq.exeReversingLabs: Detection: 79%
                                Source: C:\Users\user\AppData\Local\KITnOquJmIbAAhc0DU20ke2n.exeReversingLabs: Detection: 47%
                                Source: C:\Users\user\AppData\Local\KfIHlc6gAJQcL38Vr6ssqJ5m.exeReversingLabs: Detection: 47%
                                Source: C:\Users\user\AppData\Local\KjpvJ8EHnBGQBp0fiOyr1f1m.exeReversingLabs: Detection: 47%
                                Source: C:\Users\user\AppData\Local\LdBVJ0t5gC67YMsVTHQfk739.exeReversingLabs: Detection: 25%
                                Source: C:\Users\user\AppData\Local\LmG3qDHSUq8w4Wsw1PGm8pPm.exeReversingLabs: Detection: 25%
                                Source: C:\Users\user\AppData\Local\LzRxHxBk5eAHgaCKyeZTvsuN.exeReversingLabs: Detection: 47%
                                Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\alexxxxxxxx[1].exeReversingLabs: Detection: 100%
                                Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\file300un[1].exeReversingLabs: Detection: 45%
                                Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\NewB[1].exeReversingLabs: Detection: 91%
                                Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\clip64[1].dllReversingLabs: Detection: 81%
                                Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\jok[1].exeReversingLabs: Detection: 91%
                                Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\sarra[1].exeReversingLabs: Detection: 52%
                                Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\gold[1].exeReversingLabs: Detection: 87%
                                Multi AV Scanner detection for submitted file
                                Source: fjL0EcgV6Y.exeReversingLabs: Detection: 55%
                                Machine Learning detection for dropped file
                                Source: C:\Users\user\1000021002\2c9ff67496.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\29IA9rCjPmrMnnZQZ7YKNcOZ.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\8gEIcaaLXjtHWMkCknRgnRyn.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\4PmoraVG5R1jZgxSXUXnrPno.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\1llpE1der8s65YfF1DaRwzoA.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\3YZhMRbhtqchUxr6HrEmYWxb.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\4zlsKqSOTzijQzm8qevqChAD.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\AdqitUVCSO3pnZ13PPMmTugt.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\4WIaPCqUVwVYRafs2f1atHjf.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\2MTLbmRYdCbpYlRWWULShPZa.exeJoe Sandbox ML: detected
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\1ZiD49yFoSPKKQmrglTINzlo.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\8sZNm50KnZ73Ir2IAGAzjiCM.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\87yah1hG3sRWG8d7DMFA6UPI.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\5N2KVotsup59l0rdMarxmZjH.exeJoe Sandbox ML: detected
                                Source: C:\Users\user\AppData\Local\91UaPJ59dXTYhY2K658YFFeC.exeJoe Sandbox ML: detected
                                Machine Learning detection for sample
                                Source: fjL0EcgV6Y.exeJoe Sandbox ML: detected
                                Sample uses string decryption to hide its real strings
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: CtIvEWInDoW
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: AgEBOxw
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: @@@@@@@@
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: ijklmnopqrs
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: /#%33@@@
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: ">>""&&VWXY
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: .226622>>22lmnopq((\]^_`abcdefghijklmnopqrs
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: V/yVs
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: Vs\*.
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: 1_to7ens]
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: ,ass+ordjAss}ord
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: 6=@@J@@@
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: KLM0OPQ-'!#!/!#{|}
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: }r4BO
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: !rie
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: tGR>lk`5
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: ReleaseDC
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: Fgph@
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: HeapFree
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: GetLocaleInfoA
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: E7Q)y
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: ntProcessId
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: wininet.dll
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: shlwapi.dll
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: shell32.dll
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: .dll
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: column_text
                                Source: 41.2.RegAsm.exe.400000.0.raw.unpackString decryptor: login:
                                Source: 31.2.rundll32.exe.6be60000.0.unpackString decryptor: 193.233.132.56
                                Source: 31.2.rundll32.exe.6be60000.0.unpackString decryptor: /Pneh2sXQk0/index.php
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00226A80 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,7_2_00226A80

                                Exploits

                                barindex
                                Yara detected UAC Bypass using CMSTP
                                Source: Yara matchFile source: 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: file300un.exe PID: 3940, type: MEMORYSTR
                                Source: fjL0EcgV6Y.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                                Source: Binary string: mozglue.pdbP source: RegAsm.exe, 00000029.00000002.3564561340.000000006864D000.00000002.00000001.01000000.0000001D.sdmp
                                Source: Binary string: nss3.pdb@ source: RegAsm.exe, 00000029.00000002.3608349585.000000006880F000.00000002.00000001.01000000.0000001C.sdmp
                                Source: Binary string: c:\tx2yxmt09kx\obj\Release\Croco.pdbt source: swiiiii.exe, 00000016.00000002.2448650373.0000000003043000.00000004.00000800.00020000.00000000.sdmp
                                Source: Binary string: c:\tx2yxmt09kx\obj\Release\Croco.pdb source: swiiiii.exe, 00000016.00000002.2448650373.0000000003043000.00000004.00000800.00020000.00000000.sdmp
                                Source: Binary string: D:\Mktmp\StealerDLL\x64\Release\STEALERDLL.pdb source: rundll32.exe, 00000017.00000002.4581588871.00007FFD84FAD000.00000002.00000001.01000000.00000011.sdmp
                                Source: Binary string: System.ServiceModel.pdb source: jok.exe, 00000020.00000002.4972745129.0000000006284000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: nss3.pdb source: RegAsm.exe, 00000029.00000002.3608349585.000000006880F000.00000002.00000001.01000000.0000001C.sdmp
                                Source: Binary string: mozglue.pdb source: RegAsm.exe, 00000029.00000002.3564561340.000000006864D000.00000002.00000001.01000000.0000001D.sdmp
                                Source: Binary string: kx\obj\Release\Croco.pdb source: swiiiii.exe, 00000016.00000002.2430582865.0000000001537000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: c:\j6qffzq3zw24\obj\Release\NETCrypt.pdb source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\1000066001\Croco.pdb&[ source: swiiiii.exe, 00000016.00000002.2430582865.0000000001504000.00000004.00000020.00020000.00000000.sdmp
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_002466F0 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,7_2_002466F0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0023FE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,7_2_0023FE80
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001F3EC0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,7_2_001F3EC0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00191F9C FindClose,FindFirstFileExW,GetLastError,7_2_00191F9C
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00225F80 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,7_2_00225F80
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00192022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,7_2_00192022
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001F3850 FindFirstFileA,FindNextFileA,GetLastError,FindClose,7_2_001F3850
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: C:\Users\user\AppDataJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: C:\Users\userJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: C:\Users\user\Documents\desktop.iniJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior

                                Networking

                                barindex
                                C2 URLs / IPs found in malware configuration
                                Source: Malware configuration extractorURLs: http://49.13.229.86/c73eed764cc59dcb.php
                                Source: Malware configuration extractorURLs: pillowbrocccolipe.shop
                                Source: Malware configuration extractorURLs: communicationgenerwo.shop
                                Source: Malware configuration extractorURLs: communicationgenerwo.shop
                                Source: Malware configuration extractorURLs: diskretainvigorousiw.shop
                                Source: Malware configuration extractorURLs: affordcharmcropwo.shop
                                Source: Malware configuration extractorURLs: dismissalcylinderhostw.shop
                                Source: Malware configuration extractorURLs: enthusiasimtitleow.shop
                                Source: Malware configuration extractorURLs: worryfillvolcawoi.shop
                                Source: Malware configuration extractorURLs: cleartotalfisherwo.shop
                                Source: Malware configuration extractorIPs: 193.233.132.56
                                Source: Malware configuration extractorURLs: 185.215.113.67:26260
                                Creates HTML files with .exe extension (expired dropper behavior)
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: la4RG5LhUShae5ag2mFmRdea.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: UyBcuun7lvdsc1U8v04bEvjS.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: I4LhcLo5s9gVJdPowLL5oSzp.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C719B9p0FfrJspWW8NACmoaE.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: MCN1KYKWa3qY8Q8lKV2maDTO.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: bfSaxNj6PaRbQoH1x6AgorQM.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: XmniUOpJt9KGe1pM4XamnqZH.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: J8btV6htPGHeL2Yg1SgCaGFn.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: 3bpaooYORdL1zGgZZfaU6raM.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: M7rZI00dvqcykJFiBeuGFS7T.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: zhcyBjWDtf9NR8VTfZLAmUWa.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: GJ9O0qofKCDUPenZCkorX2YL.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: iftEMaYodvzM2QCJfFMzhqiG.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: lIBiF8F27nqVHoA6YIdbqFcI.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: yqUOk3nzvlJdWid9vqJoE5bL.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: TPSAPLN3OIImBCuzU9uj0qm5.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: NE6WkYn9fBQoC9a4gd2yFZXX.exe.51.dr
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: x6geX33yrj2DQ3LHzZRqUqDy.exe.51.dr
                                Yara detected Generic Downloader
                                Source: Yara matchFile source: 51.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 43.2.file300un.exe.246c2698740.1.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 43.2.file300un.exe.246c2695d00.0.raw.unpack, type: UNPACKEDPE
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_00FDB670 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,2_2_00FDB670
                                Source: 2c9ff67496.exe, 0000000B.00000003.3873025945.00000000038D3000.00000004.00000020.00020000.00000000.sdmp, 2c9ff67496.exe, 0000000B.00000003.3969608174.00000000038D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
                                Source: aea7caadbf.exe, 00000007.00000003.2770426270.00000000058C7000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2822300087.00000000058AF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2787280837.0000000006026000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: K https://www.youtube.com/account equals www.youtube.com (Youtube)
                                Source: RageMP131.exe, 00000030.00000003.2780783642.0000000005A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQyCImb_9cRDrKcUUsrjjBJhwC0Hyy9a0pW5vmMGs8rXmt9Y8EEn3tZ63u-DOF1VvxYXGAK-aw equals www.youtube.com (Youtube)
                                Source: aea7caadbf.exe, 00000021.00000003.2765338419.0000000005C4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&h equals www.youtube.com (Youtube)
                                Source: RageMP131.exe, 00000030.00000003.2780783642.0000000005A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
                                Source: RageMP131.exe, 00000030.00000003.2780783642.0000000005A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=AaSxoQxq7WLN6IjqvXj3bSYD7y0Ga0eg2SR6TZWYx2Ejint8ILvQao0P-v2i4jfUB13lX2_DKtde7g&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-485649803%3A1715106767804271&theme=mn&ddm=0 equals www.youtube.com (Youtube)
                                Source: 2c9ff67496.exe, 0000000B.00000003.2527725830.0000000003853000.00000004.00000020.00020000.00000000.sdmp, 2c9ff67496.exe, 0000000B.00000002.4120102195.0000000003904000.00000004.00000020.00020000.00000000.sdmp, 2c9ff67496.exe, 0000000B.00000003.3873951464.0000000003904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
                                Source: 2c9ff67496.exe, 0000000B.00000002.4120102195.0000000003904000.00000004.00000020.00020000.00000000.sdmp, 2c9ff67496.exe, 0000000B.00000003.3873951464.0000000003904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/accountR equals www.youtube.com (Youtube)
                                Source: 2c9ff67496.exe, 0000000B.00000002.4120102195.0000000003904000.00000004.00000020.00020000.00000000.sdmp, 2c9ff67496.exe, 0000000B.00000003.3873951464.0000000003904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/account| equals www.youtube.com (Youtube)
                                Source: RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
                                Source: MPGPH131.exe, 00000013.00000002.2953499946.0000000001420000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe68.0
                                Source: MPGPH131.exe, 00000013.00000002.2958708136.0000000006208000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeata
                                Source: MPGPH131.exe, 00000014.00000002.3127044186.0000000005C18000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeta
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp, explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.172.128.19/NewB.exe
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.172.128.19/NewB.exe~b
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://185.172.128.59
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DA2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F87000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://185.172.128.59/ISetup5.exe
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://185.172.128.59/ISetup5.exe4k
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002F12000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://185.172.18
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002EBF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002E30000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002E5D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F12000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002E8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233.132
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/00021002
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/405117-2476756634-1003
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/B4-6C85480369C7
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/e01b58d87e8e6fbbace30804042ba5ce902415450#
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/sev56rkm/index.php
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/sev56rkm/index.php6.exe:Zone.Identifier
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/sev56rkm/index.phpRp8UCqAMTqfIMjU07d3NR=a5c
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/sev56rkm/index.phpUsers
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/sev56rkm/index.phpcoded
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/sev56rkm/index.phpded
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/sev56rkm/index.phpded:
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/sev56rkm/index.phpe
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/sev56rkm/index.phpeE
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/sev56rkm/index.phpt
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/sev56rkm/index.phpu
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.139/ws
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.175
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DA2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F87000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.175/server/ww12/AppGate2103v01.exe
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.175/server/ww12/AppGate2103v01.exe4k
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.234
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.234/files/file300un.exe
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.234/files/file300un.exetw2
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DA2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F87000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.234/files/loader-2841.exe
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.234/files/loader-2841.exe4k
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F87000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.234/files/setup.exe
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.234/files/setup.exe4k
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/33.132.56/
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/33.132.56/5=
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/33.132.56/OneDrive
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/33.132.56/ta
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Data
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/Plugins/clip64.dll
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000C70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/Plugins/cred64.dll
                                Source: rundll32.exe, 0000001F.00000002.4576475219.0000000002CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000C70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php#
                                Source: rundll32.exe, 00000017.00000002.4575050800.000002161D6AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php$
                                Source: rundll32.exe, 0000001F.00000002.4576475219.0000000002CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php0
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php00088001
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php088001
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php4p
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php8001
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php8w
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpUsers
                                Source: rundll32.exe, 0000001F.00000002.4576475219.0000000002CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpd
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpded
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpdedE
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpe
                                Source: rundll32.exe, 0000001F.00000002.4576475219.0000000002CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phph
                                Source: rundll32.exe, 00000017.00000002.4575050800.000002161D690000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpm
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phppData
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phps
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpyu8
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000002.2953499946.0000000001420000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3124637144.000000000147B000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000002.3118907177.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000002.3117284660.0000000001104000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2791013895.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2788181386.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2792650227.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3134911819.0000000005AF0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/cost/go.exe
                                Source: MPGPH131.exe, 00000014.00000002.3124637144.000000000147B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/cost/go.exe0.1
                                Source: aea7caadbf.exe, 00000021.00000002.3118907177.0000000005D30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/cost/go.exe963
                                Source: RageMP131.exe, 00000030.00000002.3134911819.0000000005AF0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/cost/go.exeeam
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000002.2953499946.0000000001420000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000002.2958708136.0000000006208000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3124637144.000000000147B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3127044186.0000000005C18000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000002.3118907177.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000002.3117284660.0000000001104000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2791013895.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2788181386.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2792650227.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3134911819.0000000005AF0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/cost/lenin.exe
                                Source: MPGPH131.exe, 00000013.00000002.2958708136.0000000006208000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3127044186.0000000005C18000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/cost/lenin.exeUser
                                Source: RageMP131.exe, 00000030.00000002.3134911819.0000000005AF0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/cost/lenin.exea.exeoin
                                Source: RageMP131.exe, 00000030.00000003.2791013895.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2788181386.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2792650227.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/cost/lenin.exeater
                                Source: MPGPH131.exe, 00000013.00000002.2953499946.0000000001420000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/cost/lenin.exeka.ex
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/cost/random.exe
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/cost/sarra.exe
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/cost/sarra.exe/z=
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/lend/alexxxxxxxx.exe
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/lend/alexxxxxxxx.exep
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000C70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/lend/gold.exe
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000C70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/lend/gold.exe~r
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/lend/jok.exe
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000C69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/lend/swiiiii.exeIHZ
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000C69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/lend/swiiiii.exe~HQ
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000C70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/lend/swiy.exe
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000C70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/lend/swiy.exejr
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/mine/amert.exe
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/mine/random.exe
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.233.132.56/wB.exe
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/3.229.86/c73eed764cc59dcb.php
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/73eed764cc59dcb.phpI
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/freebl3.dll
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/freebl3.dllUG
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/mozglue.dll
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/mozglue.dll.
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/msvcp140.dll
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/msvcp140.dllcD
                                Source: RegAsm.exe, 00000029.00000002.3096645849.0000000001689000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/nss3.dll
                                Source: RegAsm.exe, 00000029.00000002.3096645849.0000000001689000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/nss3.dllN
                                Source: RegAsm.exe, 00000029.00000002.3096645849.0000000001689000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/nss3.dll_
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/nss3.dlll
                                Source: RegAsm.exe, 00000029.00000002.3096645849.0000000001689000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/nss3.dllv
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/softokn3.dll
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/sqlite3.dll
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/sqlite3.dll=D
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/vcruntime140.dll
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/84bad7132df89fd7/vcruntime140.dllXN
                                Source: RegAsm.exe, 00000029.00000002.3096645849.0000000001689000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3259535350.0000000021965000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/c73eed764cc59dcb.php
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/c73eed764cc59dcb.php.
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/c73eed764cc59dcb.php4b
                                Source: RegAsm.exe, 00000029.00000002.3096645849.0000000001689000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/c73eed764cc59dcb.phpData
                                Source: RegAsm.exe, 00000029.00000002.3009103992.000000000044B000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/c73eed764cc59dcb.phpbe85b06b74ee94f19768b5dcb524670
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/c73eed764cc59dcb.phplKK
                                Source: RegAsm.exe, 00000029.00000002.3096645849.0000000001689000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/c73eed764cc59dcb.phponCash
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://49.13.229.86/c73eed764cc59dcb.phps
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://77.221.151.47/install.exe
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000D22000.00000004.00000020.00020000.00000000.sdmp, file300un.exe, 0000002B.00000002.3172832815.00000246D2601000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000D22000.00000004.00000020.00020000.00000000.sdmp, file300un.exe, 0000002B.00000002.3172832815.00000246D2601000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002EBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://firstfirecar.com
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000003119000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D72000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://jonathantwo.com
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nic-it.nl
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DA2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F87000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nic-it.nl/games/index.php
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B7B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nic-it.nl/games/index.php0
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002CB3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nic-it.nl/games/index.php4k
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nic-it.nl/games/index.phpt-
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D72000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000D22000.00000004.00000020.00020000.00000000.sdmp, file300un.exe, 0000002B.00000002.3172832815.00000246D2601000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002E5D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://onlycitylink.com
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000003119000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pastebin.com
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002EBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://realdeepai.org
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9K
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/D
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id1
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id10
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id10Response
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id11
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id11Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id12
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id12Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id13
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id13Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id14
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id14Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id15
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id15Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id16
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id16Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id17
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id17Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id18
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id18Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id19
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id19Response
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id1Response
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id2
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id20
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id20Response
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id21
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id21Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id22
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id22Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id23
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id23Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id24
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id24Response
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id2Response
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id3
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id3Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id4
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id4Response
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id5
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id5Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id6
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id6Response
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id7
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id7Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id8
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id8Response
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id9
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Entity/Id9Response
                                Source: RegAsm.exe, 00000029.00000002.3564561340.000000006864D000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: http://www.mozilla.com/en-US/blocklist/
                                Source: RegAsm.exe, 00000029.00000002.3525660003.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3209060575.000000001B8FA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sqlite.org/copyright.html.
                                Source: aea7caadbf.exe, 00000007.00000003.2201507167.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmp, MPGPH131.exe, 00000013.00000002.2948125671.000000000073E000.00000040.00000001.01000000.0000000D.sdmp, MPGPH131.exe, 00000013.00000003.2273090811.0000000001310000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3121223500.000000000073E000.00000040.00000001.01000000.0000000D.sdmp, MPGPH131.exe, 00000014.00000003.2273399495.0000000001360000.00000004.00001000.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000002.3116197583.00000000002BE000.00000040.00000001.01000000.0000000A.sdmp, aea7caadbf.exe, 00000021.00000003.2327976824.0000000000FF0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3129483194.000000000075E000.00000040.00000001.01000000.0000001B.sdmp, RageMP131.exe, 00000030.00000003.2428078929.0000000002C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000003119000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://yip.su
                                Source: aea7caadbf.exe, 00000007.00000003.2765136933.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2824393145.00000000059FF000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2777346909.00000000058D8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2785902773.0000000006038000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2789092396.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2780916684.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2775126903.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2758813887.0000000005C5E000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2772626604.0000000005C89000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2798692847.0000000005E34000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2776044480.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2785721259.0000000005A0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                                Source: aea7caadbf.exe, 00000007.00000003.2770426270.00000000058C7000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2822300087.00000000058AF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2787280837.0000000006026000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2779050766.0000000005C25000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2765338419.0000000005C4D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2780783642.0000000005A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_s
                                Source: aea7caadbf.exe, 00000007.00000003.2770426270.00000000058C7000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2822300087.00000000058AF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2787280837.0000000006026000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2779050766.0000000005C25000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2765338419.0000000005C4D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2780783642.0000000005A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2
                                Source: aea7caadbf.exe, 00000007.00000003.2770426270.00000000058C7000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2822300087.00000000058AF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2787280837.0000000006026000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2779050766.0000000005C25000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2765338419.0000000005C4D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2780783642.0000000005A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Fa
                                Source: RegAsm.exe, 00000019.00000002.2402948638.00000000013EF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.2402948638.000000000141B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://affordcharmcropwo.shop/
                                Source: RegAsm.exe, 00000019.00000002.2402948638.000000000140F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.2403342364.000000000147D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://affordcharmcropwo.shop/api
                                Source: RegAsm.exe, 00000019.00000002.2403342364.000000000147D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://affordcharmcropwo.shop/api4
                                Source: RegAsm.exe, 00000019.00000002.2403342364.000000000147D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://affordcharmcropwo.shop/apiP
                                Source: RegAsm.exe, 00000019.00000002.2402948638.00000000013EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://affordcharmcropwo.shop/h
                                Source: RegAsm.exe, 00000019.00000002.2402948638.00000000013EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://affordcharmcropwo.shop/v
                                Source: RegAsm.exe, 00000019.00000002.2403342364.000000000147D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://affordcharmcropwo.shop:443/api
                                Source: jok.exe, 00000020.00000000.2311996086.0000000000492000.00000002.00000001.01000000.00000015.sdmp, jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ip.sb/ip
                                Source: aea7caadbf.exe, 00000007.00000003.2765136933.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2824393145.00000000059FF000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2777346909.00000000058D8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2785902773.0000000006038000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2789092396.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2780916684.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2775126903.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2758813887.0000000005C5E000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2772626604.0000000005C89000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2798692847.0000000005E34000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2776044480.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2785721259.0000000005A0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.iplogger.org/favicon.ico
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.iplogger.org/redirect/logo-dark.png);background-position:center;background-repeat:no-rep
                                Source: aea7caadbf.exe, 00000007.00000003.2765136933.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2824393145.00000000059FF000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2777346909.00000000058D8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2785902773.0000000006038000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2789092396.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2780916684.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2775126903.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2758813887.0000000005C5E000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2772626604.0000000005C89000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2798692847.0000000005E34000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3259535350.000000002196B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2776044480.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2785721259.0000000005A0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                                Source: aea7caadbf.exe, 00000007.00000003.2765136933.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2824393145.00000000059FF000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2777346909.00000000058D8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2785902773.0000000006038000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2789092396.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2780916684.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2775126903.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2758813887.0000000005C5E000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2772626604.0000000005C89000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2798692847.0000000005E34000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3259535350.000000002196B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2776044480.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2785721259.0000000005A0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FD8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D6E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C33000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://counter.yadro.ru/hit?
                                Source: aea7caadbf.exe, 00000021.00000003.2679315135.0000000001104000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000002.3117284660.0000000001104000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2791013895.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2788181386.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2792650227.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/
                                Source: aea7caadbf.exe, 00000007.00000003.2675850557.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000002.3093234156.00000000010C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/.
                                Source: RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/demo/home.php?s=156.146.37.102
                                Source: RageMP131.exe, 00000030.00000003.2791013895.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2788181386.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2792650227.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/demo/home.php?s=156.146.37.102=Eg
                                Source: MPGPH131.exe, 00000014.00000002.3124637144.000000000147B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2694069291.000000000147B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2515455506.000000000147B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/demo/home.php?s=156.146.37.102O
                                Source: aea7caadbf.exe, 00000021.00000003.2679315135.0000000001104000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/demo/home.php?s=156.146.37.102P
                                Source: MPGPH131.exe, 00000013.00000002.2953499946.0000000001420000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/demo/home.php?s=156.146.37.102V
                                Source: MPGPH131.exe, 00000014.00000003.2515455506.000000000147B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/demo/home.php?s=156.146.37.102_
                                Source: MPGPH131.exe, 00000014.00000002.3124637144.000000000147B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2694069291.000000000147B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2515455506.000000000147B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com/demo/home.php?s=156.146.37.102y.co.ukd
                                Source: MPGPH131.exe, 00000013.00000002.2953499946.0000000001420000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000002.3117284660.0000000001077000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2788181386.000000000110C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.000000000110C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2792650227.000000000110C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.000000000110C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.000000000110C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.000000000110C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com:443/demo/home.php?s=156.146.37.102
                                Source: MPGPH131.exe, 00000014.00000002.3124637144.000000000147B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2694069291.000000000147B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2515455506.000000000147B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com:443/demo/home.php?s=156.146.37.102P
                                Source: aea7caadbf.exe, 00000007.00000003.2675850557.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000002.3093234156.00000000010C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://db-ip.com:443/demo/home.php?s=156.146.37.102hcon
                                Source: aea7caadbf.exe, 00000007.00000003.2765136933.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2824393145.00000000059FF000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2777346909.00000000058D8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2785902773.0000000006038000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2789092396.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2780916684.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2775126903.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2758813887.0000000005C5E000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2772626604.0000000005C89000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2798692847.0000000005E34000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3259535350.000000002196B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2776044480.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2785721259.0000000005A0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                                Source: aea7caadbf.exe, 00000007.00000003.2765136933.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2824393145.00000000059FF000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2777346909.00000000058D8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2785902773.0000000006038000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2789092396.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2780916684.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2775126903.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2758813887.0000000005C5E000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2772626604.0000000005C89000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2798692847.0000000005E34000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2776044480.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2785721259.0000000005A0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                                Source: aea7caadbf.exe, 00000007.00000003.2765136933.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2824393145.00000000059FF000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2777346909.00000000058D8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2785902773.0000000006038000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2789092396.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2780916684.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2775126903.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2758813887.0000000005C5E000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2772626604.0000000005C89000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2798692847.0000000005E34000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3259535350.000000002196B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2776044480.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2785721259.0000000005A0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firstfirecar.com
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002CB3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B72000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D2B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D5E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firstfirecar.com/980979aa037665b1a96df3348db08dc0/baf14778c246e15550645e30ba78ce1c.exe
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002EBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firstfirecar.comL
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002D2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firstfirecar.comL&f
                                Source: RageMP131.exe, 00000030.00000002.3131365441.0000000001061000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/
                                Source: aea7caadbf.exe, 00000021.00000002.3117284660.00000000010A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/#N
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2675850557.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000002.2953499946.0000000001416000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2694069291.000000000145B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3124637144.000000000145B000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2679315135.00000000010ED000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000002.3117284660.00000000010ED000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/Mozilla/5.0
                                Source: RageMP131.exe, 00000030.00000002.3131365441.000000000109A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/P
                                Source: aea7caadbf.exe, 00000007.00000003.2675850557.00000000010AD000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000002.3093234156.00000000010AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/RE
                                Source: aea7caadbf.exe, 00000007.00000003.2201507167.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmp, MPGPH131.exe, 00000013.00000002.2948125671.000000000073E000.00000040.00000001.01000000.0000000D.sdmp, MPGPH131.exe, 00000013.00000003.2273090811.0000000001310000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3121223500.000000000073E000.00000040.00000001.01000000.0000000D.sdmp, MPGPH131.exe, 00000014.00000003.2273399495.0000000001360000.00000004.00001000.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000002.3116197583.00000000002BE000.00000040.00000001.01000000.0000000A.sdmp, aea7caadbf.exe, 00000021.00000003.2327976824.0000000000FF0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3129483194.000000000075E000.00000040.00000001.01000000.0000001B.sdmp, RageMP131.exe, 00000030.00000003.2428078929.0000000002C10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
                                Source: MPGPH131.exe, 00000013.00000002.2953499946.00000000013D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/ocal
                                Source: aea7caadbf.exe, 00000021.00000002.3117284660.00000000010C1000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2679315135.00000000010ED000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.000000000107B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/156.146.37.102
                                Source: aea7caadbf.exe, 00000021.00000002.3117284660.00000000010ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/156.146.37.1020
                                Source: MPGPH131.exe, 00000014.00000003.2694069291.000000000145B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3124637144.000000000145B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/156.146.37.102q
                                Source: MPGPH131.exe, 00000014.00000002.3124637144.0000000001406000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/z
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2675850557.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2694069291.000000000145B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3124637144.000000000145B000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2679315135.00000000010ED000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000002.3117284660.00000000010ED000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io:443/widget/demo/156.146.37.102
                                Source: MPGPH131.exe, 00000013.00000002.2953499946.0000000001416000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io:443/widget/demo/156.146.37.102A
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://iplogger.com/1lyxz
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FD8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D6E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C33000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://iplogger.org/
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FD8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D6E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C33000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://iplogger.org/privacy/
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FD8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D6E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C33000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://iplogger.org/rules/
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://jonathantwo.com
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000003119000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.00000000030BD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002EC9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D2B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C37000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D72000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://jonathantwo.com/980979aa037665b1a96df3348db08dc0/6779d89b7a368f4f3f340b50a9d18d71.exe
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002D2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://jonathantwo.comH
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002D72000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://jonathantwo.comHdk
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002EF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://jonathantwo.comHvu
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://onlycitylink.com
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F87000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://onlycitylink.com/baf14778c246e15550645e30ba78ce1c.exe
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://onlycitylink.com/baf14778c246e15550645e30ba78ce1c.exe4c
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002CB3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://onlycitylink.com/baf14778c246e15550645e30ba78ce1c.exe4k
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/E0rY26ni
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002EBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://realdeepai.org
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://realdeepai.org/6779d89b7a368f4f3f340b50a9d18d71.exe
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://realdeepai.org/6779d89b7a368f4f3f340b50a9d18d71.exe4k
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://realdeepai.org/6779d89b7a368f4f3f340b50a9d18d71.exeW
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000D22000.00000004.00000020.00020000.00000000.sdmp, file300un.exe, 0000002B.00000002.3172832815.00000246D2601000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
                                Source: aea7caadbf.exe, 00000021.00000002.3118681563.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3134429233.0000000005A06000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3134429233.00000000059F4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.000000000102E000.00000004.00000020.00020000.00000000.sdmp, FBI40obsDIWEYEPEV328oLc.zip.33.drString found in binary or memory: https://t.me/RiseProSUPPORT
                                Source: MPGPH131.exe, 00000014.00000002.3124637144.00000000013E7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORT?b
                                Source: RageMP131.exe, 00000030.00000002.3131365441.000000000102E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORTPROCESSOR_LEVEL=6PROCES
                                Source: aea7caadbf.exe, 00000021.00000002.3117284660.0000000001077000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORTh
                                Source: MPGPH131.exe, 00000013.00000002.2957184812.0000000005BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORTl
                                Source: aea7caadbf.exe, 00000007.00000002.3094761202.0000000005890000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORTrJ
                                Source: MPGPH131.exe, 00000014.00000003.2694069291.000000000147B000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2679315135.0000000001104000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro
                                Source: RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789324736.000000000110F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2821833886.00000000065B9000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2794468417.0000000001116000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_bot
                                Source: aea7caadbf.exe, 00000007.00000003.2675850557.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000002.3093234156.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2791013895.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2788181386.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2792650227.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_bot07
                                Source: MPGPH131.exe, 00000014.00000002.3124637144.000000000147B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2694069291.000000000147B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_botK
                                Source: RageMP131.exe, 00000030.00000003.2791013895.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2788181386.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2792650227.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_botisepro_bot
                                Source: MPGPH131.exe, 00000013.00000002.2953499946.0000000001420000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_botlaterL;
                                Source: aea7caadbf.exe, 00000007.00000003.2675850557.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000002.3093234156.00000000010C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_botr
                                Source: aea7caadbf.exe, 00000007.00000003.2765136933.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2824393145.00000000059FF000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2777346909.00000000058D8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2785902773.0000000006038000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2789092396.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2780916684.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2775126903.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2758813887.0000000005C5E000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2772626604.0000000005C89000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2798692847.0000000005E34000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2776044480.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2785721259.0000000005A0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                                Source: aea7caadbf.exe, 00000007.00000003.2765136933.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2824393145.00000000059FF000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2777346909.00000000058D8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2785902773.0000000006038000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2789092396.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2780916684.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2775126903.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2758813887.0000000005C5E000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2772626604.0000000005C89000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2798692847.0000000005E34000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2776044480.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2785721259.0000000005A0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                                Source: aea7caadbf.exeString found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
                                Source: RegAsm.exe, 00000029.00000002.3009103992.000000000044B000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/
                                Source: RegAsm.exe, 00000029.00000002.3009103992.000000000044B000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/.exe
                                Source: RegAsm.exe, 00000029.00000002.3009103992.000000000044B000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/t.exe
                                Source: RegAsm.exe, 00000029.00000002.3009103992.000000000044B000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/
                                Source: RegAsm.exe, 00000029.00000002.3009103992.000000000044B000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/chrome.exe
                                Source: RegAsm.exe, 00000029.00000002.3009103992.000000000044B000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/vchost.exe
                                Source: RegAsm.exe, 00000029.00000002.3009103992.000000000044B000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
                                Source: 2c9ff67496.exe, 0000000B.00000003.3873951464.0000000003904000.00000004.00000020.00020000.00000000.sdmp, 2c9ff67496.exe, 0000000B.00000003.3873025945.00000000038D3000.00000004.00000020.00020000.00000000.sdmp, 2c9ff67496.exe, 0000000B.00000003.2526350598.0000000003840000.00000004.00000020.00020000.00000000.sdmp, 2c9ff67496.exe, 0000000B.00000003.3969608174.00000000038D4000.00000004.00000020.00020000.00000000.sdmp, 2c9ff67496.exe, 0000000B.00000003.2627476418.000000000386F000.00000004.00000020.00020000.00000000.sdmp, 2c9ff67496.exe, 0000000B.00000003.3903887566.0000000003876000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2787280837.0000000006026000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2779050766.0000000005C25000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2780783642.0000000005A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/account
                                Source: 2c9ff67496.exe, 0000000B.00000002.4120102195.0000000003904000.00000004.00000020.00020000.00000000.sdmp, 2c9ff67496.exe, 0000000B.00000003.3873951464.0000000003904000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/accountR
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://yip.su
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://yip.su/RNWPd
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://yip.su/RNWPd.exe
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2686000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4104870630.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://yip.su/RNWPd.exeChttps://pastebin.com/raw/E0rY26ni5https://iplogger.com/1lyxz
                                Source: InstallUtil.exe, 00000033.00000002.4166622967.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FD8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D6E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C33000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://yip.su/redirect-
                                Source: RegAsm.exe, 0000002F.00000002.2455354430.00000000014F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://zippyfinickysofwps.shop/R
                                Source: RegAsm.exe, 0000002F.00000002.2455354430.00000000014F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://zippyfinickysofwps.shop/api
                                Source: RegAsm.exe, 0000002F.00000002.2455143104.00000000014D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://zippyfinickysofwps.shop:443/apilike
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00245F70 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,702B74A0,DeleteObject,DeleteObject,ReleaseDC,7_2_00245F70
                                Source: 2c9ff67496.exe, 0000000B.00000003.3919375581.000000000385A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _WINAPI_GETRAWINPUTDATAmemstr_e2132641-c
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile created: C:\Users\user\AppData\Local\Temp\TmpE3C7.tmpJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile created: C:\Users\user\AppData\Local\Temp\TmpE3E7.tmpJump to dropped file

                                Spam, unwanted Advertisements and Ransom Demands

                                barindex
                                Writes many files with high entropy
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\install[1].exe entropy: 7.99674074491Jump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Temp\1000081001\install.exe entropy: 7.99674074491Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\1ZiD49yFoSPKKQmrglTINzlo.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\IwVIt8hVIPrEsgJdmcJDc0cp.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\F5nHoJjiPsXq9PqBPnN3uVb5.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\bsl30mcD1mRV5YLU9isxcsMk.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\ZA6xyNAEYiDprMq2qgywyku5.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\R7igej85hEl8p5QzHqqsVcc4.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\Czc5fung6FsMhCVG7EMYaiqO.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\JfX04QeZvezkOn3eIpEjUqc5.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\IGVPHrAShfg5S77hqubJkQGT.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\z2u4DwiwBezR2xi11GPVbROw.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\ARFJvysANOCKBRK3eId7VsQB.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\bVARrzkwQmnP1mnoffZ1HExy.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\Tn3AK9zqC5GmoiH5iA9IY9Q6.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\fybzTZ3WiLAPEZj0fVOx3M0F.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\fW9mvrDIULE1qzTuYb8DunLu.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\gpxXZca2LPxp8nx3YxfAq52Q.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\HUsiXwAPudopBX0gkG8zqZ9K.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\5Xza309AWSsKZ7QtcoKLlH6j.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\Zy6qmavCIexKIuB9nNrNHs9p.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\D6PuoAsNvye4jtgG7lWCsXEx.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\o70oR4A1odPm6ZpEPmcUY0kf.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\h9zNDFfiMy6YEXVQdIbIdOv5.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\ybCY5oONgBmPsQ2TsLXObZGj.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\DqApJooverXr18YkrozyIUpZ.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\cqEYVGnsRBmElwXA0pViDIv4.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\qXzqKXhtyyRVQ12sGB23FDz0.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\Ud8P6u9zcQkOThPmdNJauqRX.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\KEohnm8N5FXDryvXGbq4vqXq.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\iiEhcrEC7kfTSvcQ2xPEqYzR.exe entropy: 7.99595937804Jump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\GFV2yyE0PpJkpGdl2N1D7Pr9.exe entropy: 7.99595937804Jump to dropped file

                                System Summary

                                barindex
                                .NET source code contains very large array initializations
                                Source: swiiiii[1].exe.8.dr, RemoteObjects.csLarge array initialization: RemoteObjects: array initializer size 297472
                                Source: swiiiii.exe.8.dr, RemoteObjects.csLarge array initialization: RemoteObjects: array initializer size 297472
                                Source: swiy[1].exe.8.dr, RemoteObjects.csLarge array initialization: RemoteObjects: array initializer size 153088
                                Source: swiy.exe.8.dr, RemoteObjects.csLarge array initialization: RemoteObjects: array initializer size 153088
                                Binary is likely a compiled AutoIt script file
                                Source: 2c9ff67496.exe, 0000000B.00000000.2237972193.00000000007D2000.00000002.00000001.01000000.0000000C.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_ec53eccc-a
                                Source: 2c9ff67496.exe, 0000000B.00000000.2237972193.00000000007D2000.00000002.00000001.01000000.0000000C.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_167667d0-9
                                Source: 2c9ff67496.exe.2.drString found in binary or memory: This is a third-party compiled AutoIt script.memstr_2559f638-2
                                Source: 2c9ff67496.exe.2.drString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_d1123c48-6
                                PE file contains section with special chars
                                Source: fjL0EcgV6Y.exeStatic PE information: section name:
                                Source: fjL0EcgV6Y.exeStatic PE information: section name:
                                Source: fjL0EcgV6Y.exeStatic PE information: section name:
                                Source: fjL0EcgV6Y.exeStatic PE information: section name:
                                Source: fjL0EcgV6Y.exeStatic PE information: section name:
                                Source: explorta.exe.0.drStatic PE information: section name:
                                Source: explorta.exe.0.drStatic PE information: section name:
                                Source: explorta.exe.0.drStatic PE information: section name:
                                Source: explorta.exe.0.drStatic PE information: section name:
                                Source: explorta.exe.0.drStatic PE information: section name:
                                Source: sarra[1].exe.2.drStatic PE information: section name:
                                Source: sarra[1].exe.2.drStatic PE information: section name: .idata
                                Source: sarra[1].exe.2.drStatic PE information: section name:
                                Source: amert[1].exe.2.drStatic PE information: section name:
                                Source: amert[1].exe.2.drStatic PE information: section name: .idata
                                Source: amert[1].exe.2.drStatic PE information: section name:
                                Source: amert.exe.2.drStatic PE information: section name:
                                Source: amert.exe.2.drStatic PE information: section name: .idata
                                Source: amert.exe.2.drStatic PE information: section name:
                                Source: random[1].exe.2.drStatic PE information: section name:
                                Source: random[1].exe.2.drStatic PE information: section name:
                                Source: random[1].exe.2.drStatic PE information: section name:
                                Source: random[1].exe.2.drStatic PE information: section name:
                                Source: random[1].exe.2.drStatic PE information: section name:
                                Source: aea7caadbf.exe.2.drStatic PE information: section name:
                                Source: aea7caadbf.exe.2.drStatic PE information: section name:
                                Source: aea7caadbf.exe.2.drStatic PE information: section name:
                                Source: aea7caadbf.exe.2.drStatic PE information: section name:
                                Source: aea7caadbf.exe.2.drStatic PE information: section name:
                                Source: explorha.exe.6.drStatic PE information: section name:
                                Source: explorha.exe.6.drStatic PE information: section name: .idata
                                Source: explorha.exe.6.drStatic PE information: section name:
                                Source: RageMP131.exe.7.drStatic PE information: section name:
                                Source: RageMP131.exe.7.drStatic PE information: section name:
                                Source: RageMP131.exe.7.drStatic PE information: section name:
                                Source: RageMP131.exe.7.drStatic PE information: section name:
                                Source: RageMP131.exe.7.drStatic PE information: section name:
                                Source: MPGPH131.exe.7.drStatic PE information: section name:
                                Source: MPGPH131.exe.7.drStatic PE information: section name:
                                Source: MPGPH131.exe.7.drStatic PE information: section name:
                                Source: MPGPH131.exe.7.drStatic PE information: section name:
                                Source: MPGPH131.exe.7.drStatic PE information: section name:
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeFile created: C:\Windows\Tasks\explorta.jobJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile created: C:\Windows\Tasks\explorha.jobJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_010129182_2_01012918
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_0101703B2_2_0101703B
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_010124802_2_01012480
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_01016F1B2_2_01016F1B
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_010183802_2_01018380
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_010167C92_2_010167C9
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_010076332_2_01007633
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_0104D2502_2_0104D250
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001A002D7_2_001A002D
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001FF0507_2_001FF050
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0020A1807_2_0020A180
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001F63307_2_001F6330
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001FD3207_2_001FD320
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0023E3B07_2_0023E3B0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001F03C07_2_001F03C0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0029F4807_2_0029F480
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_002375807_2_00237580
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001F86307_2_001F8630
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0016B8E07_2_0016B8E0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001E1B907_2_001E1B90
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0025AC307_2_0025AC30
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0023FE807_2_0023FE80
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001F3EC07_2_001F3EC0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001FAEE07_2_001FAEE0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0023EFB07_2_0023EFB0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001F30007_2_001F3000
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001971A07_2_001971A0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_002042A07_2_002042A0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001A036F7_2_001A036F
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001E45607_2_001E4560
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0018F5807_2_0018F580
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_002035907_2_00203590
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_002A85F07_2_002A85F0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_002A76907_2_002A7690
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_002477607_2_00247760
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001B47BF7_2_001B47BF
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0019A9287_2_0019A928
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0019C9607_2_0019C960
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001ADA867_2_001ADA86
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0024FBA07_2_0024FBA0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0024EBA07_2_0024EBA0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001B8BB07_2_001B8BB0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00294C707_2_00294C70
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_002A6C507_2_002A6C50
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_002A5D107_2_002A5D10
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_002A1E307_2_002A1E30
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001B8E307_2_001B8E30
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00252F307_2_00252F30
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001FFFFF7_2_001FFFFF
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: String function: 0017ACE0 appears 86 times
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7680 -s 872
                                Source: aea7caadbf.exe.2.drStatic PE information: Number of sections : 12 > 10
                                Source: random[1].exe.2.drStatic PE information: Number of sections : 12 > 10
                                Source: MPGPH131.exe.7.drStatic PE information: Number of sections : 12 > 10
                                Source: explorta.exe.0.drStatic PE information: Number of sections : 12 > 10
                                Source: fjL0EcgV6Y.exeStatic PE information: Number of sections : 12 > 10
                                Source: RageMP131.exe.7.drStatic PE information: Number of sections : 12 > 10
                                Source: file300un[1].exe.8.drStatic PE information: No import functions for PE file found
                                Source: fjL0EcgV6Y.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                                Source: swiiiii[1].exe.8.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                Source: swiiiii.exe.8.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                Source: swiy[1].exe.8.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                Source: swiy.exe.8.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                Source: fjL0EcgV6Y.exeStatic PE information: Section: ZLIB complexity 0.9998032823741008
                                Source: fjL0EcgV6Y.exeStatic PE information: Section: ZLIB complexity 0.9933230377906976
                                Source: fjL0EcgV6Y.exeStatic PE information: Section: ZLIB complexity 1.00537109375
                                Source: fjL0EcgV6Y.exeStatic PE information: Section: .boot ZLIB complexity 0.9909273791480536
                                Source: fjL0EcgV6Y.exeStatic PE information: Section: .reloc ZLIB complexity 1.5
                                Source: explorta.exe.0.drStatic PE information: Section: ZLIB complexity 0.9998032823741008
                                Source: explorta.exe.0.drStatic PE information: Section: ZLIB complexity 0.9933230377906976
                                Source: explorta.exe.0.drStatic PE information: Section: ZLIB complexity 1.00537109375
                                Source: explorta.exe.0.drStatic PE information: Section: .boot ZLIB complexity 0.9909273791480536
                                Source: explorta.exe.0.drStatic PE information: Section: .reloc ZLIB complexity 1.5
                                Source: amert[1].exe.2.drStatic PE information: Section: ZLIB complexity 0.9982615616621984
                                Source: amert[1].exe.2.drStatic PE information: Section: tgqtxtnx ZLIB complexity 0.9945086732390126
                                Source: amert.exe.2.drStatic PE information: Section: ZLIB complexity 0.9982615616621984
                                Source: amert.exe.2.drStatic PE information: Section: tgqtxtnx ZLIB complexity 0.9945086732390126
                                Source: random[1].exe.2.drStatic PE information: Section: ZLIB complexity 1.0000324249267578
                                Source: random[1].exe.2.drStatic PE information: Section: ZLIB complexity 1.000295928030303
                                Source: random[1].exe.2.drStatic PE information: Section: ZLIB complexity 0.9901315789473685
                                Source: random[1].exe.2.drStatic PE information: Section: ZLIB complexity 0.9898745888157895
                                Source: random[1].exe.2.drStatic PE information: Section: .reloc ZLIB complexity 1.5
                                Source: aea7caadbf.exe.2.drStatic PE information: Section: ZLIB complexity 1.0000324249267578
                                Source: aea7caadbf.exe.2.drStatic PE information: Section: ZLIB complexity 1.000295928030303
                                Source: aea7caadbf.exe.2.drStatic PE information: Section: ZLIB complexity 0.9901315789473685
                                Source: aea7caadbf.exe.2.drStatic PE information: Section: ZLIB complexity 0.9898745888157895
                                Source: aea7caadbf.exe.2.drStatic PE information: Section: .reloc ZLIB complexity 1.5
                                Source: explorha.exe.6.drStatic PE information: Section: ZLIB complexity 0.9982615616621984
                                Source: explorha.exe.6.drStatic PE information: Section: tgqtxtnx ZLIB complexity 0.9945086732390126
                                Source: RageMP131.exe.7.drStatic PE information: Section: ZLIB complexity 1.0000324249267578
                                Source: RageMP131.exe.7.drStatic PE information: Section: ZLIB complexity 1.000295928030303
                                Source: RageMP131.exe.7.drStatic PE information: Section: ZLIB complexity 0.9901315789473685
                                Source: RageMP131.exe.7.drStatic PE information: Section: ZLIB complexity 0.9898745888157895
                                Source: RageMP131.exe.7.drStatic PE information: Section: .reloc ZLIB complexity 1.5
                                Source: MPGPH131.exe.7.drStatic PE information: Section: ZLIB complexity 1.0000324249267578
                                Source: MPGPH131.exe.7.drStatic PE information: Section: ZLIB complexity 1.000295928030303
                                Source: MPGPH131.exe.7.drStatic PE information: Section: ZLIB complexity 0.9901315789473685
                                Source: MPGPH131.exe.7.drStatic PE information: Section: ZLIB complexity 0.9898745888157895
                                Source: MPGPH131.exe.7.drStatic PE information: Section: .reloc ZLIB complexity 1.5
                                Source: classification engineClassification label: mal100.rans.phis.troj.spyw.expl.evad.winEXE@384/420@0/43
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0023FE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,7_2_0023FE80
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\sarra[1].exeJump to behavior
                                Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7680
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMutant created: NULL
                                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7628:120:WilError_03
                                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:500:120:WilError_03
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeMutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
                                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7704:120:WilError_03
                                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03
                                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7852:120:WilError_03
                                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeMutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
                                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5012:120:WilError_03
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeFile created: C:\Users\user\AppData\Local\Temp\5454e6f062Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeFile read: C:\Users\desktop.iniJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                Source: rundll32.exe, 00000017.00000002.4581588871.00007FFD84FAD000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                                Source: aea7caadbf.exe, 00000007.00000003.2201507167.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmp, MPGPH131.exe, 00000013.00000002.2948125671.000000000073E000.00000040.00000001.01000000.0000000D.sdmp, MPGPH131.exe, 00000013.00000003.2273090811.0000000001310000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3121223500.000000000073E000.00000040.00000001.01000000.0000000D.sdmp, MPGPH131.exe, 00000014.00000003.2273399495.0000000001360000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000017.00000002.4581588871.00007FFD84FAD000.00000002.00000001.01000000.00000011.sdmp, aea7caadbf.exe, 00000021.00000002.3116197583.00000000002BE000.00000040.00000001.01000000.0000000A.sdmp, aea7caadbf.exe, 00000021.00000003.2327976824.0000000000FF0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3129483194.000000000075E000.00000040.00000001.01000000.0000001B.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                                Source: RegAsm.exe, 00000029.00000002.3608349585.000000006880F000.00000002.00000001.01000000.0000001C.sdmp, RegAsm.exe, 00000029.00000002.3209060575.000000001B8FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3510041257.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
                                Source: rundll32.exe, 00000017.00000002.4581588871.00007FFD84FAD000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
                                Source: RegAsm.exe, 00000029.00000002.3608349585.000000006880F000.00000002.00000001.01000000.0000001C.sdmp, RegAsm.exe, 00000029.00000002.3209060575.000000001B8FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3510041257.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
                                Source: RegAsm.exe, 00000029.00000002.3608349585.000000006880F000.00000002.00000001.01000000.0000001C.sdmp, RegAsm.exe, 00000029.00000002.3209060575.000000001B8FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3510041257.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
                                Source: aea7caadbf.exe, 00000007.00000003.2201507167.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmp, MPGPH131.exe, 00000013.00000002.2948125671.000000000073E000.00000040.00000001.01000000.0000000D.sdmp, MPGPH131.exe, 00000013.00000003.2273090811.0000000001310000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3121223500.000000000073E000.00000040.00000001.01000000.0000000D.sdmp, MPGPH131.exe, 00000014.00000003.2273399495.0000000001360000.00000004.00001000.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000002.3116197583.00000000002BE000.00000040.00000001.01000000.0000000A.sdmp, aea7caadbf.exe, 00000021.00000003.2327976824.0000000000FF0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3129483194.000000000075E000.00000040.00000001.01000000.0000001B.sdmp, RageMP131.exe, 00000030.00000003.2428078929.0000000002C10000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                                Source: RegAsm.exe, 00000029.00000002.3608349585.000000006880F000.00000002.00000001.01000000.0000001C.sdmp, RegAsm.exe, 00000029.00000002.3209060575.000000001B8FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3510041257.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
                                Source: rundll32.exe, 00000017.00000002.4581588871.00007FFD84FAD000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                                Source: rundll32.exe, 00000017.00000002.4581588871.00007FFD84FAD000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                                Source: RegAsm.exe, 00000029.00000002.3608349585.000000006880F000.00000002.00000001.01000000.0000001C.sdmp, RegAsm.exe, 00000029.00000002.3209060575.000000001B8FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3510041257.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
                                Source: RegAsm.exe, 00000029.00000002.3608349585.000000006880F000.00000002.00000001.01000000.0000001C.sdmp, RegAsm.exe, 00000029.00000002.3209060575.000000001B8FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3510041257.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
                                Source: RegAsm.exe, 00000029.00000002.3209060575.000000001B8FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3510041257.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
                                Source: rundll32.exe, 00000017.00000002.4581588871.00007FFD84FAD000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
                                Source: aea7caadbf.exe, 00000007.00000003.2763923547.00000000058B6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2760437173.00000000058A8000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2756730026.00000000058A8000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2829759297.00000000058A9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2781020740.0000000005BD5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2784972575.0000000005BD5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2771103050.0000000005C18000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2774016505.0000000005C18000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000017.00000002.4575050800.000002161D618000.00000004.00000020.00020000.00000000.sdmp, jok.exe, 00000020.00000002.4626441113.0000000002DE2000.00000004.00000800.00020000.00000000.sdmp, jok.exe, 00000020.00000002.4626441113.0000000002DF8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                                Source: RegAsm.exe, 00000029.00000002.3209060575.000000001B8FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3510041257.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
                                Source: rundll32.exe, 00000017.00000002.4581588871.00007FFD84FAD000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                                Source: RegAsm.exe, 00000029.00000002.3209060575.000000001B8FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.3510041257.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
                                Source: fjL0EcgV6Y.exeReversingLabs: Detection: 55%
                                Source: amert.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                                Source: aea7caadbf.exeString found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeFile read: C:\Users\user\Desktop\fjL0EcgV6Y.exeJump to behavior
                                Source: unknownProcess created: C:\Users\user\Desktop\fjL0EcgV6Y.exe "C:\Users\user\Desktop\fjL0EcgV6Y.exe"
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeProcess created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"
                                Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess created: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe "C:\Users\user\AppData\Local\Temp\1000019001\amert.exe"
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess created: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe "C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe"
                                Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeProcess created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess created: C:\Users\user\1000021002\2c9ff67496.exe "C:\Users\user\1000021002\2c9ff67496.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                                Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Source: C:\Users\user\1000021002\2c9ff67496.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
                                Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 --field-trial-handle=2032,i,3277131894660533735,10710382389248485071,262144 /prefetch:8
                                Source: unknownProcess created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
                                Source: unknownProcess created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe "C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe"
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profiles
                                Source: C:\Windows\System32\netsh.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7680 -s 872
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe "C:\Users\user\AppData\Local\Temp\1000071001\jok.exe"
                                Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe "C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe"
                                Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe "C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 --field-trial-handle=2032,i,3277131894660533735,10710382389248485071,262144 /prefetch:8
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe"
                                Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000079001\gold.exe "C:\Users\user\AppData\Local\Temp\1000079001\gold.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force
                                Source: C:\Users\user\AppData\Local\Temp\1000079001\gold.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                Source: unknownProcess created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeProcess created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe" Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess created: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe "C:\Users\user\AppData\Local\Temp\1000019001\amert.exe" Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess created: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe "C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe" Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess created: C:\Users\user\1000021002\2c9ff67496.exe "C:\Users\user\1000021002\2c9ff67496.exe" Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeProcess created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe" Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHESTJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHESTJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe "C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe"
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe "C:\Users\user\AppData\Local\Temp\1000071001\jok.exe"
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe "C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe"
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe"
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000079001\gold.exe "C:\Users\user\AppData\Local\Temp\1000079001\gold.exe"
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: unknown unknown
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: unknown unknown
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: unknown unknown
                                Source: C:\Users\user\1000021002\2c9ff67496.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 --field-trial-handle=2032,i,3277131894660533735,10710382389248485071,262144 /prefetch:8
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profiles
                                Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000079001\gold.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: apphelp.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: wininet.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: uxtheme.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: mstask.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: windows.storage.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: mpr.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: dui70.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: duser.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: chartv.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: oleacc.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: atlthunk.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: textinputframework.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: coreuicomponents.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: coremessaging.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: ntmarta.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: coremessaging.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: wtsapi32.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: winsta.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: textshaping.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: propsys.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: iertutil.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: explorerframe.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: edputil.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: urlmon.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: srvcli.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: netutils.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: appresolver.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: bcp47langs.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: slc.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: userenv.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: sppc.dllJump to behavior
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: apphelp.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: wininet.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: iertutil.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: windows.storage.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: winhttp.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: mswsock.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: iphlpapi.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: winnsi.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: urlmon.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: srvcli.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: netutils.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: uxtheme.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: propsys.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: edputil.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: appresolver.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: bcp47langs.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: slc.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: userenv.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: sppc.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: wininet.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: apphelp.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: winmm.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: wininet.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: uxtheme.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: mstask.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: windows.storage.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: mpr.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: dui70.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: duser.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: chartv.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: oleacc.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: atlthunk.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: textinputframework.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: coreuicomponents.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: coremessaging.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: ntmarta.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: coremessaging.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: wtsapi32.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: winsta.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: textshaping.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: propsys.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: iertutil.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: explorerframe.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: edputil.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: urlmon.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: srvcli.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: netutils.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: appresolver.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: bcp47langs.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: slc.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: userenv.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: sppc.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: apphelp.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: rstrtmgr.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: ncrypt.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: ntasn1.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: d3d11.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: dxgi.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: resourcepolicyclient.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: d3d10warp.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: uxtheme.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: dxcore.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: ntmarta.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: winhttp.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: wininet.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: mswsock.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: devobj.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: webio.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: iphlpapi.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: winnsi.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: dnsapi.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: rasadhlp.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: fwpuclnt.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: schannel.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: mskeyprotect.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: ncryptsslp.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: msasn1.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: cryptsp.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: rsaenh.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: cryptbase.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: gpapi.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: vaultcli.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: windows.storage.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: dpapi.dllJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: apphelp.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: winmm.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: wininet.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: sspicli.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: iertutil.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: windows.storage.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: wldp.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: profapi.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: kernel.appcore.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: ondemandconnroutehelper.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: winhttp.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: iphlpapi.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: mswsock.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: urlmon.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: srvcli.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: netutils.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: winnsi.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: uxtheme.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: propsys.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: edputil.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: windows.staterepositoryps.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: wintypes.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: appresolver.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: bcp47langs.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: slc.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: userenv.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: sppc.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: onecorecommonproxystub.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: onecoreuapcommonproxystub.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: winmm.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: wininet.dll
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSection loaded: kernel.appcore.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: wsock32.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: version.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: winmm.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: mpr.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: wininet.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: iphlpapi.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: userenv.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: uxtheme.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: kernel.appcore.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: windows.storage.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: wldp.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: propsys.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: profapi.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: edputil.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: urlmon.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: iertutil.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: srvcli.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: netutils.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: windows.staterepositoryps.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: sspicli.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: wintypes.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: appresolver.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: bcp47langs.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: slc.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: sppc.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: onecorecommonproxystub.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: onecoreuapcommonproxystub.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: pcacli.dll
                                Source: C:\Users\user\1000021002\2c9ff67496.exeSection loaded: sfc_os.dll
                                Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
                                Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
                                Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
                                Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dll
                                Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
                                Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
                                Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
                                Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: apphelp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rstrtmgr.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncrypt.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntasn1.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: d3d11.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dxgi.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: resourcepolicyclient.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: kernel.appcore.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: d3d10warp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: uxtheme.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dxcore.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sspicli.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winhttp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wininet.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mswsock.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: devobj.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: webio.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iphlpapi.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winnsi.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dnsapi.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rasadhlp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: fwpuclnt.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: schannel.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mskeyprotect.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncryptsslp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: msasn1.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptsp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rsaenh.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptbase.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: gpapi.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: vaultcli.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.storage.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wldp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntmarta.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dpapi.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rstrtmgr.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncrypt.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntasn1.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: d3d11.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dxgi.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: resourcepolicyclient.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: kernel.appcore.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: d3d10warp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: uxtheme.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dxcore.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sspicli.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winhttp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wininet.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mswsock.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: devobj.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: webio.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iphlpapi.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winnsi.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dnsapi.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rasadhlp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: fwpuclnt.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: schannel.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mskeyprotect.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncryptsslp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: msasn1.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptsp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rsaenh.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptbase.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: gpapi.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: vaultcli.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.storage.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wldp.dll
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntmarta.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeSection loaded: mscoree.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeSection loaded: apphelp.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeSection loaded: kernel.appcore.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeSection loaded: version.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeSection loaded: vcruntime140_clr0400.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeSection loaded: ucrtbase_clr0400.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeSection loaded: ucrtbase_clr0400.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeSection loaded: cryptsp.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeSection loaded: rsaenh.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeSection loaded: cryptbase.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: apphelp.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: aclayers.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winhttp.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ondemandconnroutehelper.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: webio.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mswsock.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: iphlpapi.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winnsi.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sspicli.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dnsapi.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rasadhlp.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: fwpuclnt.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: schannel.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mskeyprotect.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ntasn1.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ncrypt.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ncryptsslp.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msasn1.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rsaenh.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptbase.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: gpapi.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dpapi.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ondemandconnroutehelper.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ondemandconnroutehelper.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ondemandconnroutehelper.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ondemandconnroutehelper.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ondemandconnroutehelper.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ondemandconnroutehelper.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: kernel.appcore.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wbemcomn.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: amsi.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: userenv.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: profapi.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wbemcomn.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dll
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ondemandconnroutehelper.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: kernel.appcore.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: ifmon.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: iphlpapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: mprapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: rasmontr.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: rasapi32.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: fwpuclnt.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: rasman.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: mfc42u.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: rasman.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: authfwcfg.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: fwpolicyiomgr.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: firewallapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: dnsapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: fwbase.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: dhcpcmonitor.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: dot3cfg.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: dot3api.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: onex.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: eappcfg.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: ncrypt.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: eappprxy.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: ntasn1.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: fwcfg.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: hnetmon.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: netshell.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: nlaapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: netsetupapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: netiohlp.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: dhcpcsvc.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: winnsi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: nettrace.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: sspicli.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: nshhttp.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: httpapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: nshipsec.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: userenv.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: activeds.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: polstore.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: winipsec.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: adsldpc.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: nshwfp.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: cabinet.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: p2pnetsh.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: p2p.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: profapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: cryptbase.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: rpcnsh.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: wcnnetsh.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: wlanapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: whhelper.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: winhttp.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: wlancfg.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: cryptsp.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: wshelper.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: wevtapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: mswsock.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: wwancfg.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: wwapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: wcmapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: rmclient.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: mobilenetworking.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: peerdistsh.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: uxtheme.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: slc.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: sppc.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: gpapi.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: ktmw32.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: mprmsg.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: windows.storage.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: wldp.dll
                                Source: C:\Windows\System32\netsh.exeSection loaded: msasn1.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: mscoree.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: apphelp.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: kernel.appcore.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: version.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: vcruntime140_clr0400.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: ucrtbase_clr0400.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: ucrtbase_clr0400.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: uxtheme.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: windows.storage.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: wldp.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: profapi.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: cryptsp.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: rsaenh.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: cryptbase.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: dwrite.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: msvcp140_clr0400.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: msasn1.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: msisip.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: wshext.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: appxsip.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: opcservices.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: esdsip.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: userenv.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: dpapi.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: gpapi.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: sxs.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: mpr.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: scrrun.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: propsys.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: linkinfo.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: mswsock.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: sspicli.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: secur32.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: wbemcomn.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: amsi.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: rstrtmgr.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: ncrypt.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: ntasn1.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeSection loaded: windowscodecs.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: rstrtmgr.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: ncrypt.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: ntasn1.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: d3d11.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: dxgi.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: resourcepolicyclient.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: kernel.appcore.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: d3d10warp.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: uxtheme.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: dxcore.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: sspicli.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: winhttp.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: wininet.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: mswsock.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: devobj.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: ondemandconnroutehelper.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: webio.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: iphlpapi.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: winnsi.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: dnsapi.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: rasadhlp.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: fwpuclnt.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: schannel.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: mskeyprotect.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: ncryptsslp.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: msasn1.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: cryptsp.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: rsaenh.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: cryptbase.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: gpapi.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: vaultcli.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: wintypes.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: windows.storage.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: wldp.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSection loaded: ntmarta.dll
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32Jump to behavior
                                Source: Window RecorderWindow detected: More than 3 window changes detected
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                                Source: fjL0EcgV6Y.exeStatic file information: File size 1804304 > 1048576
                                Source: fjL0EcgV6Y.exeStatic PE information: Raw size of .boot is bigger than: 0x100000 < 0x187c00
                                Source: Binary string: mozglue.pdbP source: RegAsm.exe, 00000029.00000002.3564561340.000000006864D000.00000002.00000001.01000000.0000001D.sdmp
                                Source: Binary string: nss3.pdb@ source: RegAsm.exe, 00000029.00000002.3608349585.000000006880F000.00000002.00000001.01000000.0000001C.sdmp
                                Source: Binary string: c:\tx2yxmt09kx\obj\Release\Croco.pdbt source: swiiiii.exe, 00000016.00000002.2448650373.0000000003043000.00000004.00000800.00020000.00000000.sdmp
                                Source: Binary string: c:\tx2yxmt09kx\obj\Release\Croco.pdb source: swiiiii.exe, 00000016.00000002.2448650373.0000000003043000.00000004.00000800.00020000.00000000.sdmp
                                Source: Binary string: D:\Mktmp\StealerDLL\x64\Release\STEALERDLL.pdb source: rundll32.exe, 00000017.00000002.4581588871.00007FFD84FAD000.00000002.00000001.01000000.00000011.sdmp
                                Source: Binary string: System.ServiceModel.pdb source: jok.exe, 00000020.00000002.4972745129.0000000006284000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: nss3.pdb source: RegAsm.exe, 00000029.00000002.3608349585.000000006880F000.00000002.00000001.01000000.0000001C.sdmp
                                Source: Binary string: mozglue.pdb source: RegAsm.exe, 00000029.00000002.3564561340.000000006864D000.00000002.00000001.01000000.0000001D.sdmp
                                Source: Binary string: kx\obj\Release\Croco.pdb source: swiiiii.exe, 00000016.00000002.2430582865.0000000001537000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: c:\j6qffzq3zw24\obj\Release\NETCrypt.pdb source: explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\1000066001\Croco.pdb&[ source: swiiiii.exe, 00000016.00000002.2430582865.0000000001504000.00000004.00000020.00020000.00000000.sdmp

                                Data Obfuscation

                                barindex
                                Detected unpacking (changes PE section rights)
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeUnpacked PE file: 6.2.amert.exe.e30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tgqtxtnx:EW;ouenqhoa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tgqtxtnx:EW;ouenqhoa:EW;.taggant:EW;
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeUnpacked PE file: 8.2.explorha.exe.d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tgqtxtnx:EW;ouenqhoa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tgqtxtnx:EW;ouenqhoa:EW;.taggant:EW;
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeUnpacked PE file: 9.2.explorha.exe.d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tgqtxtnx:EW;ouenqhoa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tgqtxtnx:EW;ouenqhoa:EW;.taggant:EW;
                                Source: jok[1].exe.8.drStatic PE information: 0xFC177629 [Thu Jan 10 08:13:29 2104 UTC]
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0022F200 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,7_2_0022F200
                                Source: initial sampleStatic PE information: section where entry point is pointing to: .boot
                                Source: explorha.exe.6.drStatic PE information: real checksum: 0x1da068 should be: 0x1d31b5
                                Source: amert[1].exe.2.drStatic PE information: real checksum: 0x1da068 should be: 0x1d31b5
                                Source: NewB.exe.8.drStatic PE information: real checksum: 0x0 should be: 0x6bd55
                                Source: swiy.exe.8.drStatic PE information: real checksum: 0x0 should be: 0x32404
                                Source: NewB[1].exe.8.drStatic PE information: real checksum: 0x0 should be: 0x6bd55
                                Source: swiy[1].exe.8.drStatic PE information: real checksum: 0x0 should be: 0x32404
                                Source: alexxxxxxxx.exe.8.drStatic PE information: real checksum: 0x0 should be: 0x2b7dd5
                                Source: cred64.dll.8.drStatic PE information: real checksum: 0x0 should be: 0x147ee8
                                Source: cred64[1].dll.8.drStatic PE information: real checksum: 0x0 should be: 0x147ee8
                                Source: jok[1].exe.8.drStatic PE information: real checksum: 0x0 should be: 0x547e4
                                Source: swiiiii.exe.8.drStatic PE information: real checksum: 0x562fb should be: 0x5eece
                                Source: alexxxxxxxx[1].exe.8.drStatic PE information: real checksum: 0x0 should be: 0x2b7dd5
                                Source: sarra[1].exe.2.drStatic PE information: real checksum: 0x25c164 should be: 0x25b84a
                                Source: clip64.dll.8.drStatic PE information: real checksum: 0x0 should be: 0x1f783
                                Source: install[1].exe.8.drStatic PE information: real checksum: 0x22d33 should be: 0x44be5e
                                Source: clip64[1].dll.8.drStatic PE information: real checksum: 0x0 should be: 0x1f783
                                Source: amert.exe.2.drStatic PE information: real checksum: 0x1da068 should be: 0x1d31b5
                                Source: jok.exe.8.drStatic PE information: real checksum: 0x0 should be: 0x547e4
                                Source: install.exe.8.drStatic PE information: real checksum: 0x22d33 should be: 0x44be5e
                                Source: swiiiii[1].exe.8.drStatic PE information: real checksum: 0x562fb should be: 0x5eece
                                Source: fjL0EcgV6Y.exeStatic PE information: section name:
                                Source: fjL0EcgV6Y.exeStatic PE information: section name:
                                Source: fjL0EcgV6Y.exeStatic PE information: section name:
                                Source: fjL0EcgV6Y.exeStatic PE information: section name:
                                Source: fjL0EcgV6Y.exeStatic PE information: section name:
                                Source: fjL0EcgV6Y.exeStatic PE information: section name: .vm_sec
                                Source: fjL0EcgV6Y.exeStatic PE information: section name: .themida
                                Source: fjL0EcgV6Y.exeStatic PE information: section name: .boot
                                Source: explorta.exe.0.drStatic PE information: section name:
                                Source: explorta.exe.0.drStatic PE information: section name:
                                Source: explorta.exe.0.drStatic PE information: section name:
                                Source: explorta.exe.0.drStatic PE information: section name:
                                Source: explorta.exe.0.drStatic PE information: section name:
                                Source: explorta.exe.0.drStatic PE information: section name: .vm_sec
                                Source: explorta.exe.0.drStatic PE information: section name: .themida
                                Source: explorta.exe.0.drStatic PE information: section name: .boot
                                Source: sarra[1].exe.2.drStatic PE information: section name:
                                Source: sarra[1].exe.2.drStatic PE information: section name: .idata
                                Source: sarra[1].exe.2.drStatic PE information: section name:
                                Source: sarra[1].exe.2.drStatic PE information: section name: pebjcioa
                                Source: sarra[1].exe.2.drStatic PE information: section name: qliweygd
                                Source: sarra[1].exe.2.drStatic PE information: section name: .taggant
                                Source: amert[1].exe.2.drStatic PE information: section name:
                                Source: amert[1].exe.2.drStatic PE information: section name: .idata
                                Source: amert[1].exe.2.drStatic PE information: section name:
                                Source: amert[1].exe.2.drStatic PE information: section name: tgqtxtnx
                                Source: amert[1].exe.2.drStatic PE information: section name: ouenqhoa
                                Source: amert[1].exe.2.drStatic PE information: section name: .taggant
                                Source: amert.exe.2.drStatic PE information: section name:
                                Source: amert.exe.2.drStatic PE information: section name: .idata
                                Source: amert.exe.2.drStatic PE information: section name:
                                Source: amert.exe.2.drStatic PE information: section name: tgqtxtnx
                                Source: amert.exe.2.drStatic PE information: section name: ouenqhoa
                                Source: amert.exe.2.drStatic PE information: section name: .taggant
                                Source: random[1].exe.2.drStatic PE information: section name:
                                Source: random[1].exe.2.drStatic PE information: section name:
                                Source: random[1].exe.2.drStatic PE information: section name:
                                Source: random[1].exe.2.drStatic PE information: section name:
                                Source: random[1].exe.2.drStatic PE information: section name:
                                Source: random[1].exe.2.drStatic PE information: section name: .vm_sec
                                Source: random[1].exe.2.drStatic PE information: section name: .themida
                                Source: random[1].exe.2.drStatic PE information: section name: .boot
                                Source: aea7caadbf.exe.2.drStatic PE information: section name:
                                Source: aea7caadbf.exe.2.drStatic PE information: section name:
                                Source: aea7caadbf.exe.2.drStatic PE information: section name:
                                Source: aea7caadbf.exe.2.drStatic PE information: section name:
                                Source: aea7caadbf.exe.2.drStatic PE information: section name:
                                Source: aea7caadbf.exe.2.drStatic PE information: section name: .vm_sec
                                Source: aea7caadbf.exe.2.drStatic PE information: section name: .themida
                                Source: aea7caadbf.exe.2.drStatic PE information: section name: .boot
                                Source: explorha.exe.6.drStatic PE information: section name:
                                Source: explorha.exe.6.drStatic PE information: section name: .idata
                                Source: explorha.exe.6.drStatic PE information: section name:
                                Source: explorha.exe.6.drStatic PE information: section name: tgqtxtnx
                                Source: explorha.exe.6.drStatic PE information: section name: ouenqhoa
                                Source: explorha.exe.6.drStatic PE information: section name: .taggant
                                Source: RageMP131.exe.7.drStatic PE information: section name:
                                Source: RageMP131.exe.7.drStatic PE information: section name:
                                Source: RageMP131.exe.7.drStatic PE information: section name:
                                Source: RageMP131.exe.7.drStatic PE information: section name:
                                Source: RageMP131.exe.7.drStatic PE information: section name:
                                Source: RageMP131.exe.7.drStatic PE information: section name: .vm_sec
                                Source: RageMP131.exe.7.drStatic PE information: section name: .themida
                                Source: RageMP131.exe.7.drStatic PE information: section name: .boot
                                Source: MPGPH131.exe.7.drStatic PE information: section name:
                                Source: MPGPH131.exe.7.drStatic PE information: section name:
                                Source: MPGPH131.exe.7.drStatic PE information: section name:
                                Source: MPGPH131.exe.7.drStatic PE information: section name:
                                Source: MPGPH131.exe.7.drStatic PE information: section name:
                                Source: MPGPH131.exe.7.drStatic PE information: section name: .vm_sec
                                Source: MPGPH131.exe.7.drStatic PE information: section name: .themida
                                Source: MPGPH131.exe.7.drStatic PE information: section name: .boot
                                Source: alexxxxxxxx[1].exe.8.drStatic PE information: section name: .00cfg
                                Source: alexxxxxxxx.exe.8.drStatic PE information: section name: .00cfg
                                Source: cred64[1].dll.8.drStatic PE information: section name: _RDATA
                                Source: cred64.dll.8.drStatic PE information: section name: _RDATA
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_00FED10C push ecx; ret 2_2_00FED11F
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0050931A push ebp; mov dword ptr [esp], edx7_2_005E1C33
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0050931A push 7ACA4E51h; mov dword ptr [esp], ecx7_2_005E1D10
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0050931A push 3065C6BDh; mov dword ptr [esp], esp7_2_005E1D18
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00193F59 push ecx; ret 7_2_00193F6C
                                Source: fjL0EcgV6Y.exeStatic PE information: section name: entropy: 7.9986498410293665
                                Source: fjL0EcgV6Y.exeStatic PE information: section name: .boot entropy: 7.956255917420769
                                Source: explorta.exe.0.drStatic PE information: section name: entropy: 7.9986498410293665
                                Source: explorta.exe.0.drStatic PE information: section name: .boot entropy: 7.956255917420769
                                Source: sarra[1].exe.2.drStatic PE information: section name: entropy: 7.924648547837475
                                Source: sarra[1].exe.2.drStatic PE information: section name: pebjcioa entropy: 7.9321971040715535
                                Source: amert[1].exe.2.drStatic PE information: section name: entropy: 7.984896223453351
                                Source: amert[1].exe.2.drStatic PE information: section name: tgqtxtnx entropy: 7.953308816348314
                                Source: amert.exe.2.drStatic PE information: section name: entropy: 7.984896223453351
                                Source: amert.exe.2.drStatic PE information: section name: tgqtxtnx entropy: 7.953308816348314
                                Source: random[1].exe.2.drStatic PE information: section name: entropy: 7.999592556641182
                                Source: random[1].exe.2.drStatic PE information: section name: .boot entropy: 7.955099922607866
                                Source: aea7caadbf.exe.2.drStatic PE information: section name: entropy: 7.999592556641182
                                Source: aea7caadbf.exe.2.drStatic PE information: section name: .boot entropy: 7.955099922607866
                                Source: explorha.exe.6.drStatic PE information: section name: entropy: 7.984896223453351
                                Source: explorha.exe.6.drStatic PE information: section name: tgqtxtnx entropy: 7.953308816348314
                                Source: RageMP131.exe.7.drStatic PE information: section name: entropy: 7.999592556641182
                                Source: RageMP131.exe.7.drStatic PE information: section name: .boot entropy: 7.955099922607866
                                Source: MPGPH131.exe.7.drStatic PE information: section name: entropy: 7.999592556641182
                                Source: MPGPH131.exe.7.drStatic PE information: section name: .boot entropy: 7.955099922607866
                                Source: swiiiii[1].exe.8.drStatic PE information: section name: .text entropy: 7.992152217310619
                                Source: swiiiii.exe.8.drStatic PE information: section name: .text entropy: 7.992152217310619
                                Source: swiy[1].exe.8.drStatic PE information: section name: .text entropy: 7.985989435134696
                                Source: swiy.exe.8.drStatic PE information: section name: .text entropy: 7.985989435134696

                                Persistence and Installation Behavior

                                barindex
                                Installs new ROOT certificates
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Temp\1000088001\NewB.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\VOC2vgozeooRPwe4xNfnekbg.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\o70oR4A1odPm6ZpEPmcUY0kf.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\91UaPJ59dXTYhY2K658YFFeC.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\Ud8P6u9zcQkOThPmdNJauqRX.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\LmG3qDHSUq8w4Wsw1PGm8pPm.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\XBajRwldCSS42gwh4zu9f3ce.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\ArokRzfYMxWDCVlcYzlFE2Lj.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\EqMO5smfp2bzSmy94pnHeeak.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\p7KXtY1OslUIeP9Ce7HA7pcJ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\ar5KINQCCayk0Kw6DN1FAVFx.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\3YZhMRbhtqchUxr6HrEmYWxb.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dllJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\swiiiii[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\qXzqKXhtyyRVQ12sGB23FDz0.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\EmEyDLXTX7wKV3Hm4GA8AbdZ.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeFile created: C:\ProgramData\MPGPH131\MPGPH131.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\iiEhcrEC7kfTSvcQ2xPEqYzR.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\WIZZw2jIWtghnINz7Bolcg6s.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\HUsiXwAPudopBX0gkG8zqZ9K.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\h9zNDFfiMy6YEXVQdIbIdOv5.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\GcbucsdsAk7dv2EzyRdhbByI.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeFile created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\2MTLbmRYdCbpYlRWWULShPZa.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\R7igej85hEl8p5QzHqqsVcc4.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\IwVIt8hVIPrEsgJdmcJDc0cp.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\k4a17b3U4KeqWyuMzrdWzqyt.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\joRzh0eN9ubjpRYMOMHaTsYl.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\zQeTuw5vxgdbKmiVRBeW6SUZ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\ProgramData\nss3.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\vG3D68E3KVPIYrQEMWMU27tl.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\zqrjs0OTmaC5sGR5VDn5k391.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\vQkPzCCvFzBxzLEPKtUXhb4x.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\FsKEmkdvDCAc7VY3lRIiRKAL.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\27xttgdEmHmLdE1NNbjDPunl.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\WmwQPTarASP4EtQ3MAZKQqLX.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\29IA9rCjPmrMnnZQZ7YKNcOZ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\4ebcbWCvvuWPOCPYovXXMriV.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\87yah1hG3sRWG8d7DMFA6UPI.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\CwwSkg4Z6r2CyUx7eieftoSL.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\LzRxHxBk5eAHgaCKyeZTvsuN.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\US6SMVSChPuNg0C79rqEySgv.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\clip64[1].dllJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\alexxxxxxxx[1].exeJump to dropped file
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeFile created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\Nx2ualF4WR83o8BLpmD9zVrW.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\9DP8FgphO9xB4vzM75llXw4b.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dllJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\fW9mvrDIULE1qzTuYb8DunLu.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\0FhI3ymKwyu4YKH0P5aiSwr9.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\8gEIcaaLXjtHWMkCknRgnRyn.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\ProgramData\msvcp140.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\NAw5Utgp8P611rdec0BR0MlI.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\7mRVtPlrMfZmo26ldo406lmd.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\1llpE1der8s65YfF1DaRwzoA.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeFile created: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\JfX04QeZvezkOn3eIpEjUqc5.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\kivxs7Zej5QjZRx4S943Y5EA.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\Yv6kDvOTN4rtEsFYOeCJZShm.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\Zy6qmavCIexKIuB9nNrNHs9p.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\OjMaXQfausZW7L4bZ74RhT97.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\FMABIYNaDvdpX82vGnLOftDu.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\jDKkqPCmIoUaiq9LrPYuCKQs.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\ProgramData\vcruntime140.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\GXqvrU2YdMIpdqoqkBIkuQ4a.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\NXXoMKuzuftWWcaGwWfRizTp.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Temp\1000079001\gold.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\KjpvJ8EHnBGQBp0fiOyr1f1m.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\TexEUOb49XCfEjOcQuxS4LdR.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\F5nHoJjiPsXq9PqBPnN3uVb5.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\DqApJooverXr18YkrozyIUpZ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\qiW5UZkXzhMJ8qrVDgrcAGm1.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\jok[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\ARFJvysANOCKBRK3eId7VsQB.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\CS3gyNCBkgUy4GD82bQforlP.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\aR1aAXIrzQtExVh9FbdfoBrR.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\lI1wLYD1b5s5Qo04Ewg0WqV1.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\xFvJiGaaRqrUdwrQth3PHHC0.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\NAo5jaAAmqipcIgVfrpEqrOC.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\5N2KVotsup59l0rdMarxmZjH.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\KEohnm8N5FXDryvXGbq4vqXq.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\IGVPHrAShfg5S77hqubJkQGT.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\fRiNFTEVJnpONJofzyWKlqwW.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\gsF9GZceaIYWveF9Wn0mXwbt.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\6lvatP6Q76Lt1uvfZT2GD6HY.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\4WIaPCqUVwVYRafs2f1atHjf.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\Loo9WoJBx4a6RLa9vZq7467f.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\UrMKiBsPUmHBdjATiF2xGFWW.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeFile created: C:\Users\user\1000021002\2c9ff67496.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\5Xza309AWSsKZ7QtcoKLlH6j.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\xYhK2iEXeksXlPa9BMLXm5tE.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\NewB[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\ProgramData\mozglue.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\4ptz7FM4kP7qMGFoFqE5j0zm.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\amert[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\D8TGVGr0asGkgU3ycSpOmYcn.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\Yg9IAPVdFD93gbLGPdcvbgw2.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\KfIHlc6gAJQcL38Vr6ssqJ5m.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\Y0ZKJ4dRBRkIRESl8nT570lZ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\CZ8BPZs8awoPJiACUS73pAe6.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\enEog6vYdNgmFKOyGbVQTrXc.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\91wCUE8aqMgtssmXq8JjQEVt.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\OFqYXukHEjQzmQ3ijziOsyC5.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\Czc5fung6FsMhCVG7EMYaiqO.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeFile created: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\file300un[1].exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Temp\1000080001\alexxxxxxxx.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\ProgramData\softokn3.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\ELbDrf9qIHQaBWPxuiJjUCoM.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\f3qMySWuesp6iqsnQUyX8UG1.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\v4pPJZm6TK3eJidyD0YTpSI8.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\VUhKLgvybQx21ilX50E3IN7y.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\cqEYVGnsRBmElwXA0pViDIv4.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\nw6IIdZQfEhqp8k6unIrj2qH.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\N14E2wCpaY7ufVWw1V4rquym.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\w73g23dHAf0dTWCMUXFqmd74.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\dLosfqkp920zMbaetcnvwrJJ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\z2u4DwiwBezR2xi11GPVbROw.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\ybCY5oONgBmPsQ2TsLXObZGj.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\aAFMFn8XgxK4ax5TQ7f1st28.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\bVARrzkwQmnP1mnoffZ1HExy.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\WllNfMrTNMJ4E1bpkfOuURJc.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\4zlsKqSOTzijQzm8qevqChAD.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\AdqitUVCSO3pnZ13PPMmTugt.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\O8qlhpLK7TtBYe0J94Fm1B86.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\PbrRyuOT2DJaFlbAzGY6neq7.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\ProgramData\freebl3.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\VRZS2eg6KpyehTgltwjCKDt4.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\J6EKnVYc7FheOARgvJ4DtZho.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\RbvLNaGRBEsayaSXnP4Zo5B2.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\JkJexXpPrIyNVfwGJRUJua9O.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\LdBVJ0t5gC67YMsVTHQfk739.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\604jEG5qQpdnhPVOdLS1sPeh.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\ZFNbxiSI6dIgrSto9a3Z7jlo.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\YdDMLcotJvPaOVEHpalanl1d.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Temp\1000081001\install.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\tRGz8YUeJOvAWwmplTaCNv1T.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\2D21U1bRl2sEI2OnuIMYALNl.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\3bvlPX7g5Zc6pp8TPpEM470u.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\TwRm9Z0OjBAq1e9wDGeHmdCv.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\bU6cqro2wPcmClLzDGRpxfw1.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\4PmoraVG5R1jZgxSXUXnrPno.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\8sZNm50KnZ73Ir2IAGAzjiCM.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\1ZiD49yFoSPKKQmrglTINzlo.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\3OywHIBuj0AIQ7Aq3CE27htS.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\pTXFwTPyWVPZ4sTiGkA8a5ei.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\GFV2yyE0PpJkpGdl2N1D7Pr9.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\cred64[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\kqcWDzUDzGODoV7JWmwBlZRR.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\Tn3AK9zqC5GmoiH5iA9IY9Q6.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\sarra[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\v7Li9n9DDXtQeZJRorH86P5g.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\hQa9fYPzQBrGD6byFRloLN5U.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\gpxXZca2LPxp8nx3YxfAq52Q.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\J60VIKU1uGOij5ybpvmDPTRI.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\vwsgN3REbITHxJG5vlKYY3Vx.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\fybzTZ3WiLAPEZj0fVOx3M0F.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\install[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\7QngCiEI0nWQ5NI3rtCate4r.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\eNB1RX0hn7cF5yIvRdwV0Sdv.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\yNQkYyPgov8fX5k7nVDGzk6w.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\nRXc5v7fBpZ3Rt6WXas92N9q.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\KITnOquJmIbAAhc0DU20ke2n.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\0rCtm6Hv5UQtXJOFVlEJjcOA.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\swiy[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\bsl30mcD1mRV5YLU9isxcsMk.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\gold[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\UnZ9xXtOVzbDDdfuNC2Trxtk.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\Te8IoKHiu7i6R94P1wuixO8g.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\D6PuoAsNvye4jtgG7lWCsXEx.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\ZA6xyNAEYiDprMq2qgywyku5.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\TEpqQjIAfTfCTbePKUGsV0Gk.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\Pictures\uU9N3wILYLaLsdrVTU78EpKz.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Local\6xNdov8AZo7X4GIGr08JaGXe.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\ProgramData\nss3.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\ProgramData\mozglue.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\ProgramData\msvcp140.dllJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeFile created: C:\ProgramData\MPGPH131\MPGPH131.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\ProgramData\freebl3.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\ProgramData\vcruntime140.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile created: C:\ProgramData\softokn3.dllJump to dropped file

                                Boot Survival

                                barindex
                                Creates multiple autostart registry keys
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run aea7caadbf.exeJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2c9ff67496.exeJump to behavior
                                Drops script or batch files to the startup folder
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m7rmoohzeMWquAaKzkk44dVj.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hvqSJt3tl4h6cFLkNI7pBJj3.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6GqiHIfrVXBSZnggvuCnsYvX.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IjO2xpTHgE815NSQlystxL8c.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EEuXRjfzeiH8g0YM0L56zBMH.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c34MmnctgAY66QOjPh1MsOwS.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FOHad4INGlVgGUzrXOJHgTLE.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zTd9jVATVG0lNsWEWwXEZFpl.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zHj24vPtn17meARVbAfrBNWr.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZUVBQJWmw30MkYm7XlKt7AGj.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5plmIsCmu1c3pDoA2jFr0W4n.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiP2ZriYOwMApD298FYD4Lwu.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KmRS6Y6tZZ9BPfv48PJiBemY.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bHMeT4pgXesEvyW5uPXeXrhV.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n4riRFZEfbyVOzVYofZBOrtB.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LsPvdG3dCcHmKoaWKVaA23HW.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwiFh4sCwLoSouuc0prFCqtK.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UXpk6OrC4BILh0oiUWoQz54b.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DTIhxF5q0Qg6L1VWLqKGtCG4.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ukSLyv62ACmzThXwhB3niDP7.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\D5b1TWIrVUYsAwT3lLhmzDTv.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c71unQMWeg7PYGrwROGwHtyF.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qD3SrN8S7WnRLCMKBnzLsK1O.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dnmqTLPgvl17VM6aTOSeVWAl.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IrkwNHffMo4Eka7tqdiM1FpJ.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STCrhsi84NOAwKBL55hj4E9M.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gAslh7vC2xygVyjix2LVTyPC.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h7tMLzMWAx4CTbi9OWkNEVuS.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\o20nv1tLMaTOCdndUzZLyXfK.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yFtZUbxQWpIY2HaeXL30Ywxf.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q9pKFX60prYFxYuSKChGpHnm.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XAclRwykwhW5w1I14vXutIP8.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7DW6Gc6MAdQrxCFHJUHs17zd.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54jPFh9oLJVW9bkfFqvuPgKg.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jzizZsyjVCfkdBoHaY04ImfY.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cWf68SrrVhigcjAkioMoDc9M.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pe45LiQAO3PHwvHnhaBGnATu.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xVyc1vIYuCdL1tewhYCziFVg.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nA8bY9X2FgzDvoAfS8gVQ1wr.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oo2nklTvOQFEbMqjuAmf1Hnt.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6imaeIZVrnGARWYKvSqZT3zH.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xwizdCQzMqPRubh3w9ge1vnD.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vqU1ZUdZjjkc4TpP3qVRVTsG.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SrXTpI9TA9I1c40N4WaBDHUx.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jM4p86qq1bs1OanP3F710dRm.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t5H58EEc8NvQUOi24FS2QU9Z.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FUeo6cPMtQcyTnVLTt6Jjsg6.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EaH3os3XyhQRwzfrIoMsgfOT.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y1TuohWqsbj6qW86KEnlWYJT.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YopaqCHxlkH079wqgDq82QyC.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y29RiGWpm89ujqyBR956QKV7.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gTBwdxjcV58Ds0EuIxEHQuyT.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\knu0oyMuRWGGQcesFzGIw2Wt.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HPpcD7tAr9JffyluVr9Dqnzg.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sq2vrp3GOThXviJiP5PWUXgP.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q2MHhQs8ujbyxQ9nIy0rUSZ9.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rqQPiQHZVdsiyiCJe2b49hD1.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SoHZgMdmi98eGRLir19wIU3i.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62G1Wdx3GqQR8gREza0Qjrhd.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\te7OtjZEJK2Mk7mXcL1FVp1t.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ceU4OQADnN3GJaQwan1vgjT9.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pG2TxiBh4zhTCyAEyXazkYkx.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2nCXxdPnLk5JcX0DaVpRhjv8.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GVnNMQ4xWRaJB6uq68mTJkZN.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4jfLDdZXDrYucdBARadSTAAL.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FYpNAXn4iUQjB76qpm9rHvvP.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vAI2Xs35kAr2PgQ3tHk3TkCy.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JWTZFaAwxnpP4x7n3ZxQtmcV.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K7A3wvEg38KHuYPHbeRkE6OY.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KvisCbG5r0sGPjOu6iOuXUA7.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F82kF5QJtwswX0bD7pirl83T.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5sXlOTcmnXvKeyfdiBhcw4ND.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\egIuyYL0XWot1sQ1CKEo0yi2.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XEOnGkLosqdtoEbIuQ6cBGC6.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WH9sbyUogprfrhqfOzjOuvhY.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7xqIRWplklsXiVj9AJQsuokd.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9XRyJ5AMIyBRzhQ2TMbTCcnl.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ySmmNhEhk7waj4UzYYFLdjJ8.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hLGrDTl5wAe0ZCERmdwmmvPw.batJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RV9AxJTOIoBEpSVL349oMZiu.batJump to dropped file
                                Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeWindow searched: window name: FilemonClassJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeWindow searched: window name: RegmonClassJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeWindow searched: window name: FilemonClassJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: FilemonClass
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: RegmonClass
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: FilemonClass
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: Regmonclass
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: Filemonclass
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: Regmonclass
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: FilemonClass
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: RegmonClass
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: FilemonClass
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                                Uses schtasks.exe or at.exe to add and modify task schedules
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STCrhsi84NOAwKBL55hj4E9M.bat
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeFile created: C:\Windows\Tasks\explorta.jobJump to behavior
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STCrhsi84NOAwKBL55hj4E9M.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gAslh7vC2xygVyjix2LVTyPC.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7DW6Gc6MAdQrxCFHJUHs17zd.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q9pKFX60prYFxYuSKChGpHnm.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pe45LiQAO3PHwvHnhaBGnATu.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jzizZsyjVCfkdBoHaY04ImfY.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54jPFh9oLJVW9bkfFqvuPgKg.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xVyc1vIYuCdL1tewhYCziFVg.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SrXTpI9TA9I1c40N4WaBDHUx.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y1TuohWqsbj6qW86KEnlWYJT.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HPpcD7tAr9JffyluVr9Dqnzg.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\knu0oyMuRWGGQcesFzGIw2Wt.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62G1Wdx3GqQR8gREza0Qjrhd.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\te7OtjZEJK2Mk7mXcL1FVp1t.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ceU4OQADnN3GJaQwan1vgjT9.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pG2TxiBh4zhTCyAEyXazkYkx.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GVnNMQ4xWRaJB6uq68mTJkZN.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vAI2Xs35kAr2PgQ3tHk3TkCy.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JWTZFaAwxnpP4x7n3ZxQtmcV.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K7A3wvEg38KHuYPHbeRkE6OY.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\egIuyYL0XWot1sQ1CKEo0yi2.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XEOnGkLosqdtoEbIuQ6cBGC6.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WH9sbyUogprfrhqfOzjOuvhY.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7xqIRWplklsXiVj9AJQsuokd.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9XRyJ5AMIyBRzhQ2TMbTCcnl.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ySmmNhEhk7waj4UzYYFLdjJ8.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RV9AxJTOIoBEpSVL349oMZiu.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hLGrDTl5wAe0ZCERmdwmmvPw.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZUVBQJWmw30MkYm7XlKt7AGj.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiP2ZriYOwMApD298FYD4Lwu.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LsPvdG3dCcHmKoaWKVaA23HW.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UXpk6OrC4BILh0oiUWoQz54b.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DTIhxF5q0Qg6L1VWLqKGtCG4.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qD3SrN8S7WnRLCMKBnzLsK1O.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IrkwNHffMo4Eka7tqdiM1FpJ.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h7tMLzMWAx4CTbi9OWkNEVuS.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\o20nv1tLMaTOCdndUzZLyXfK.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yFtZUbxQWpIY2HaeXL30Ywxf.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XAclRwykwhW5w1I14vXutIP8.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cWf68SrrVhigcjAkioMoDc9M.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nA8bY9X2FgzDvoAfS8gVQ1wr.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oo2nklTvOQFEbMqjuAmf1Hnt.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xwizdCQzMqPRubh3w9ge1vnD.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6imaeIZVrnGARWYKvSqZT3zH.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vqU1ZUdZjjkc4TpP3qVRVTsG.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t5H58EEc8NvQUOi24FS2QU9Z.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jM4p86qq1bs1OanP3F710dRm.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y29RiGWpm89ujqyBR956QKV7.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rqQPiQHZVdsiyiCJe2b49hD1.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SoHZgMdmi98eGRLir19wIU3i.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q2MHhQs8ujbyxQ9nIy0rUSZ9.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2nCXxdPnLk5JcX0DaVpRhjv8.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4jfLDdZXDrYucdBARadSTAAL.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FYpNAXn4iUQjB76qpm9rHvvP.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KvisCbG5r0sGPjOu6iOuXUA7.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F82kF5QJtwswX0bD7pirl83T.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5sXlOTcmnXvKeyfdiBhcw4ND.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KmRS6Y6tZZ9BPfv48PJiBemY.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bHMeT4pgXesEvyW5uPXeXrhV.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c71unQMWeg7PYGrwROGwHtyF.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FUeo6cPMtQcyTnVLTt6Jjsg6.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YopaqCHxlkH079wqgDq82QyC.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EaH3os3XyhQRwzfrIoMsgfOT.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gTBwdxjcV58Ds0EuIxEHQuyT.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sq2vrp3GOThXviJiP5PWUXgP.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m7rmoohzeMWquAaKzkk44dVj.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hvqSJt3tl4h6cFLkNI7pBJj3.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6GqiHIfrVXBSZnggvuCnsYvX.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IjO2xpTHgE815NSQlystxL8c.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EEuXRjfzeiH8g0YM0L56zBMH.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c34MmnctgAY66QOjPh1MsOwS.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FOHad4INGlVgGUzrXOJHgTLE.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zTd9jVATVG0lNsWEWwXEZFpl.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zHj24vPtn17meARVbAfrBNWr.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5plmIsCmu1c3pDoA2jFr0W4n.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n4riRFZEfbyVOzVYofZBOrtB.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwiFh4sCwLoSouuc0prFCqtK.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ukSLyv62ACmzThXwhB3niDP7.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\D5b1TWIrVUYsAwT3lLhmzDTv.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dnmqTLPgvl17VM6aTOSeVWAl.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OGxF8QiZwcaGkQdKkNxhjtKC.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DaF2Olxq73DrcM5XABIaSDSs.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0AhsRiT9HXP8nUVjVsC7lnJ0.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gJg50l6myURZCwtjufWOVpuQ.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\r2YWMyz1YP2FRpENqKhaRZyt.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QdpodRlWnGVsi1g0pQlfyjkP.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cybr2MFwU04XAQwxPolKMqQO.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\z40K3kSz8nbFzfavMmb2eQ1n.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ud84rpY6iPONwnxDRebDCuje.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nDPvMcSCVReoFfNwWf9VtsJX.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\riJi6LbnhEUeeWoDdafUeGUh.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cx4e8RO84usGaXQVOUIGUHN7.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sMtjKcNXah8bWY1GB43Z2Nvo.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\twq4PH3MymMUgP37K2gZssJh.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nNNHEyhgRrOs4sf0Abdt3Wtz.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dpHGv1tNgh6UmtLh4Mqkjgjv.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hSCCnQw7GVDGmVOXtfvP2hU8.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jUWcmuyDRAqLaCBd9Dir7NUA.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZR34XbNproylHK1OhCoumicm.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EFmSJTQNwHQpsEsQ8FhGjVhf.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XCGrdnJ1qQVZI63zkxF23uXt.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iL5NcfykjvYjelixOHPRaZHt.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6FszJF4Jwp3QxyxLpDvQzAl2.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dx9XlsFGiH3rpffDOMJTlVCT.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3GVdArWrvqFumsoLu9aCMU9n.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\L27QyUwBuL8LDeoeiTYngDXN.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zf4TbZ9xgzGXCn5nRSi3ASnS.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PHfwD6qh2lBvC75Opce7fium.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2jk5Ed8sbV1MdGoz8FX4N9Hp.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bdAu1py9oGqttgGdYGDbSYEP.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uGCuCvTDug6xrGNCcg8Zzr4Q.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\87Myp1xPYg474LfEvPhin1sM.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1Ok8j6Gi15r9nn69GkEMiN0f.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CvTF5Stn8q8opEUq3BUf9Rv0.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SOLSA4x4asjbGy8gzHU30TYG.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WNOBUZbm9yxe1iRKWoynoUIy.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Vo4ffLpBFZ5sdbnp27l8y074.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kPJfV3ZQezcsvjAhmetWY8Y8.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xP7yTfvHKKcmGH9LL4Y0EV5l.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mCcYLhQDhaKCD8C2TL308Ccy.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4HuOT9Y3iOProWVE46tkp5iF.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qIV5IkUFJT6RzFUeYYNriiUV.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hPV8AWYTryNpE1mC5rBtXit0.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\liIn7TjvcDqHfsnz7CkJCEKM.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AYOpd6e3YCsTXY2lWZg8CTug.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WDgC9U0r7503UsfGkF2RRn3x.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WiaMMQARpLPsDSLsvQ9qjDcs.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tF8eEwyMMvkaTDsee1xL3HLS.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mdSL4NdEKZVGIWPsxIYWdkjz.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\brLaHNHGLFYzGG6LomG1B4Tq.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rZgSTCkIvN8yd8LayN7at2rk.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9lhml6yObMMtVfHgzhCEXKiW.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TQ7Xj8C54JgaNX9piUAHzDC2.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yDZBDFrQOFQSKgaXcgr0m0SH.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIVjzIwHnUmpEmAuV0FqOhZ9.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jLDKPYpbZFVU5NBr5mETep15.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WsnDe5krusoqelWGCXOp3Ese.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\80Iomx6dMXCqhiHR5OZ8eWyc.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iMvChnakRPEkaD9Vn8Vadnrf.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\46J92a3ClQAsYFD6LVy9eCdW.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stm7mydXoCajWO8whM7xdLvc.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6Sdb7d8DprhURPQDGAKSK94j.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1pHRZ1WVTkwE1Jqqj49K6TVM.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wcn2wv9yjThIe2YI0pq7eSRN.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3HBynVapH8nz8IySMCRtzjIo.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lbsaepAiLNJYR1eyWB3aJPen.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\98JvCEwV6EjOk0MbNLLOtSSq.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rqxMDrzhq4w4Wyoz26je6XFO.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YZwOWglUJKZNfk0Tr6ufVqnF.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9oim7S2Do6aMr062mmsJ8og6.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1OUEB4W7HwU4gIL2MQvEH1zP.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7jzqF6B7KYhIwop5Du95n6t0.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0g2ftn8MzMEKjC1SL91RWtO0.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spQnYLsoZn8FuPq7Rq7CHj3C.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\90sjRPCwDoM2H2uL8wp1VHna.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5IpslyurCImJpLxB2skJQKtk.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dMlEgFklgLyUXbgOt2CQSyeo.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ouwt4wjaBzBbldWsocbACzsI.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sgnCc8y5AIKgge6nJLgAKezu.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ydL2O2Rp2S7GYzpUl5sssvWL.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\53G4C7fkisr75N0k0Yr3sc1j.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YhaxdmO6NS59ZyhzMB2qT76V.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BcXOICI69P2jzAegsKAB9xIZ.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1cEElHYdot58DykVLbQVOezn.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yEv7UzOa4D2SQVTKdy0KZBrz.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vD86VQ7j1YxDcHW3sRNL2keZ.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0GMv9jZTcSw3m2Zzo1oAc5Kp.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qMSbk05eVuh0cDCaZ05cqYYm.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LCtB7VLSyqko0a8UPu9cDXNs.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5eoWgqllqSYAN6GnQgnRWOyK.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pe2zVb5Lx59tdswPSzNRCctx.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d8tScOKc2FhcNTydZgmwXpKG.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MF1n1MMRavEUlAvxHRMPbdvM.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UkzNDwjKmksIzh7O57WF1ALJ.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyAKpWmpR7jV1gZPnSl06Cdn.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\njwwrVvaL3wGhJS4ZxillTvY.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OiAPJYfgX9RwDDruEp6r5bnw.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fgz7tPPFnFUHpWfqwocbe2NH.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BDgLEqYP2vYDLgaMARikOx9C.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4ijWfD0OEdNC6VkDu24y3Rne.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3zRfMhMIC0AjDney9eMJdTjf.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DyQcp4eyTi30uvGlVwNKPZWh.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\223Wr2Fp2qzADNFnnB7poHrJ.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FXCwMu1qq8h2DZK7BzuD0YTA.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RSL5hB44p9iAfNXRGSPd5HdW.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HMWAVeXs6h4p9OUG1VPvRvUf.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g3U1TJxNY6EWdrE5XnfwjDNZ.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lvsAqBcs14MSMj5n8WcpjIQJ.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jyNSGsdxxLbtbZT1tgJZbFBN.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JWTvMja1w8IFflYe4c1dWcn2.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tzTXHdO2770KAyXRmuUqLq0v.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBifmCHAE32dJaBTudWeQeic.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\p1DEZhGyn4e3rEGBiwRbbVS5.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RO0wJRSV6jerStwWPZ7Qg7Es.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Opa6VpUVU4ItMsikkorVFHGh.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qMiyYzXywQQ6HUsYsiYCgMTf.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0pgNNYepfpd1ep72J4H70XqG.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nmYshULAdXuSoLNh9KiorD58.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UhNz9jeL1xn8sCR8SjowJpOc.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hRUjFbJoTvrGefLBcITlKfd9.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZlsvkS6ByVyXxkmQMdGfEcfr.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cyLJ3m7ZPJSLd3ZuRVxbnE3s.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\isKrb1wLEweQlNV1B0xqzvxk.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4tAPySWDAPFfsDLEdFtyXetO.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OMxR9o5aAvZMrjCQUhD9HCL1.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9PLm3CoXN6343EaXDXwAfru9.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7ZzCXoj423gmjbO1IwxWNDHP.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tg5rCqW3mqvoxBUo1G1Of67b.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Oqr25Evsg9WOTrsZ0VQQcZl8.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mazxvv4LSujOl8iDjugFvUbN.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lin1MFBl3hwvuCO3b41Oausr.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\z7n7OAst48KiwRxw3CThSB7H.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\beTl29zkSOhao4hDAQ3xc2IX.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\V2G0bqE887F5d6XIWH4lyRCS.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BPtxlAAYArafirsKvhTulnE8.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fe7rLLgjrc7oFSlDzs5a0QrD.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g6MpvBSYy7QSy59FE2mASGDR.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y0YyyGkClVNh7AiOB60bb5xx.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VEGRZKNIwf60Lgl1MBoJQ0ZR.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hvvH2hK6rryg4Cg1rwqWElGj.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LisYZCjcRKMOA9tgqlvWBYFX.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CNfd5FiEPcxMOKTNBgdpS1PY.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UOqMHoQ6sJWPszKy9pdAJESM.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jgNmv2f3PC4ea6prF24Y1Q3O.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e51Og1eFOzino0O7DaaBhKzx.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lmJNQ79PtAIeJXJjb4pH4xzP.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\flZPnObYdJxjXam4b7Afu6fW.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Uf6B5fw4fXszXeBdZJje8qoI.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5mRkxrSVZ8mQXdnkR0bcs9BN.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z2I3VgiKnHXlxEW8sZRfqj3o.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cTUA6hJRQqZfaaHxpQsjvDGi.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DCgckEGm4PGsBp4hNII9RWCb.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sUgvnBNq9F0hYR8cgb1rDE7N.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Se1CGrooWTbosMPUIM3bKpgi.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CCWH8TaW9IQZKg5DQkHbDqxJ.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CuvvB4T4Z5K1LwZb28zOvoO7.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jDlZpZ3M3en2qQO1cfoPA1I1.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\whVnM9rGJ13QjhGc1Rt16wa2.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ypAzZbAHcREafMGRflK8FqL.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6VNYKWyURTETEJdXck74Vgpa.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FFTGVMEfsqk6j5oSz6zolzfL.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ly548Y6PjIWHZ05puZx1i8N8.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bixO5L74B9ixnhuSceKTzqO3.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZlyNt4NgQIAJoJxWDPAmAsPv.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ok6RlED8S3NTX5X3U5Jy2kCe.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\02yWcihZkPqdFfZMeYSvhncc.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NT0kx2lWWZ91znDneizhQaHo.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IRxeCoXJY6JkXTxGsdt0TUFl.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sLBemkmbPAWlcMw9HPzyIWd1.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\L2O86RPVrJVS3laNoEySAhRr.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sUXJBtnLfTGR9tyzbLiQcmcD.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jljpEbOjbYACwFqIBm1kiJGi.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2XUzlA8k5WK5zlvt3tTJwImN.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5zFgbHWM50vrkEjI3vzuyBIW.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dL9MJob9nWX8FZAYyWD9Ut4N.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kBriyiDzNpHyax19IH3WQHvV.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MLoIrKhz34gPeslplYeXvTYE.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\maiZkA6ZHQSr4zLaqV7nMF8g.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CK8mgIhAZK0QzLNTNZuSbUoH.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zbz0wpakMIyBfTSoyYM85bCt.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cVh0F5xHsjXT8AKR9GZ1WCxY.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\N5je2TuP0NZeaqaqdxYy85NF.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QKZYxLRDuoUz2qJHflbvTYna.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F4jGAqx0AlFkEFV9d1HGs00R.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AR4dLubUhSpG7yYwe01z0wt1.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OzzXoIKlVGWCCm8n1jA0R77y.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\44FJzHoQ1A4IsV1f1ac9TihC.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A7fQLTArS05zuFFcZCiF4aV9.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\U9kQAbIjmfH5gnYDkkcr5N0B.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vxSMT75ZK9xqII2EvqG5wUyR.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FGgboOj6M0Japikm1aF93yr1.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nVhAOQdd2NnYXtsOhH2CoEIv.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ft0WOttlZlpKpMdZSnKtpGBX.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TqqykfPo7pEIpGfLS98j6JLn.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lvWH6jTdmaobHQpeKa8QMfmF.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEi7QcndVjucI1YTwi4LH8yG.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tOi4FRPVOEbPzOmbwntlzt2Q.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\euZx2LVZcKmVfRuQHSHBly5W.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K6ER7CKyfGlYZfnc9LFL2pPe.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dSTotanv7U42nerMY8Xbncl5.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NHebJu3zFkPDrak3auvIjrSB.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1zoVu5VJKkUoNKt6ZUPBgGLd.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iW32fBwuXqTRXkwTTV9tnE4Y.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GXVNvm9czP30VfGRKOb8NQ99.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gkdNInesmzVzVnL58vVmpOC0.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ElwTXFgYpDJPq6ia2zSutSfk.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\50nriTd7pYXWjJrxKQVsJbjK.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DjAynFk5t26gdRT9HQ6r6Ha4.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zvydu6CveySMcgpTmnCqZHFi.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b0mI3ziaaiGwEZw2JcH1QmfK.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERJjdWXBMC4KwkZbMy3aNp7s.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d4VWKGnOZbSrWJcYB0IuLOHh.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m47NhrS8mJ7FJOyuNP7YLcDb.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h131SDDbHMqABr109sBD1eGu.bat
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2OltYTqremlJnfAVhyJtnVrc.bat
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run aea7caadbf.exeJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run aea7caadbf.exeJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2c9ff67496.exeJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2c9ff67496.exeJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior

                                Hooking and other Techniques for Hiding and Protection

                                barindex
                                Loading BitLocker PowerShell Module
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\1000021002\2c9ff67496.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\1000021002\2c9ff67496.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\1000021002\2c9ff67496.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX

                                Malware Analysis System Evasion

                                barindex
                                Yara detected AntiVM3
                                Source: Yara matchFile source: Process Memory Space: file300un.exe PID: 3940, type: MEMORYSTR
                                Found stalling execution ending in API Sleep call
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeStalling execution: Execution stalls by calling Sleepgraph_7-46067
                                Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
                                Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                                Query firmware table information (likely to detect VMs)
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeSystem information queried: FirmwareTableInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSystem information queried: FirmwareTableInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSystem information queried: FirmwareTableInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSystem information queried: FirmwareTableInformationJump to behavior
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSystem information queried: FirmwareTableInformation
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeSystem information queried: FirmwareTableInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSystem information queried: FirmwareTableInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeSystem information queried: FirmwareTableInformation
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeSystem information queried: FirmwareTableInformation
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSystem information queried: FirmwareTableInformation
                                Tries to detect sandboxes / dynamic malware analysis system (registry check)
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                                Tries to detect virtualization through RDTSC time measurements
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: E9F47A second address: E9F495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCC1D4AC756h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCC1D4AC75Eh 0x00000012 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: E9F495 second address: E9F499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 102050F second address: 102052C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC1D4AC762h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 102052C second address: 1020539 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1020539 second address: 102053E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 102053E second address: 102054C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC1D4AF17Ah 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 102054C second address: 102055B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 101F56D second address: 101F5C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FCC1D4AF176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FCC1D4AF17Dh 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 pushad 0x00000015 popad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 popad 0x00000019 jmp 00007FCC1D4AF17Ch 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FCC1D4AF183h 0x00000026 jmp 00007FCC1D4AF189h 0x0000002b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 101F9E7 second address: 101FA00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCC1D4AC756h 0x0000000a popad 0x0000000b jng 00007FCC1D4AC758h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 101FA00 second address: 101FA0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FCC1D4AF176h 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 101FA0A second address: 101FA23 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jp 00007FCC1D4AC756h 0x00000011 push edx 0x00000012 pop edx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 101FA23 second address: 101FA2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 101FBBC second address: 101FBC6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10232AA second address: 10232AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10232AE second address: 10232F9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c jnl 00007FCC1D4AC768h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push ecx 0x00000017 jmp 00007FCC1D4AC75Bh 0x0000001c pop ecx 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 pushad 0x00000027 jmp 00007FCC1D4AC75Ah 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10232F9 second address: 1023308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1023308 second address: 102330D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 102330D second address: 102336D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCC1D4AF186h 0x00000008 jnl 00007FCC1D4AF176h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop eax 0x00000012 jmp 00007FCC1D4AF17Bh 0x00000017 js 00007FCC1D4AF17Bh 0x0000001d mov esi, 7172AA25h 0x00000022 push 00000003h 0x00000024 push 00000000h 0x00000026 or cl, FFFFFFA3h 0x00000029 push 00000003h 0x0000002b mov dl, 8Fh 0x0000002d call 00007FCC1D4AF179h 0x00000032 jmp 00007FCC1D4AF17Ch 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push ecx 0x0000003b pushad 0x0000003c popad 0x0000003d pop ecx 0x0000003e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 102336D second address: 1023392 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1023392 second address: 1023398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1023398 second address: 10233BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jmp 00007FCC1D4AC767h 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10233BC second address: 1023410 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ebx 0x0000000c jmp 00007FCC1D4AF183h 0x00000011 pop ebx 0x00000012 pop eax 0x00000013 cmc 0x00000014 movzx esi, bx 0x00000017 lea ebx, dword ptr [ebp+12458141h] 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007FCC1D4AF178h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 or dword ptr [ebp+122D2ACBh], ebx 0x0000003d xchg eax, ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1023410 second address: 1023416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1023416 second address: 102341B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 102341B second address: 102342E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FCC1D4AC756h 0x00000013 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 102345F second address: 10234B0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCC1D4AF176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FCC1D4AF178h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 movzx ecx, bx 0x0000002b push 00000000h 0x0000002d adc di, A334h 0x00000032 call 00007FCC1D4AF179h 0x00000037 push ecx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FCC1D4AF17Ah 0x0000003f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10234B0 second address: 10234C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push ecx 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop ecx 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10234C7 second address: 10234CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10235CD second address: 102362A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC766h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jns 00007FCC1D4AC756h 0x00000010 pop edi 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 jl 00007FCC1D4AC760h 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jng 00007FCC1D4AC756h 0x00000023 popad 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 jnp 00007FCC1D4AC75Ah 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 pop edx 0x00000032 pop eax 0x00000033 add dword ptr [ebp+122D3294h], ecx 0x00000039 lea ebx, dword ptr [ebp+1245814Ah] 0x0000003f mov esi, dword ptr [ebp+122D397Ah] 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a push esi 0x0000004b pop esi 0x0000004c rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 102362A second address: 1023630 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1023748 second address: 1023752 instructions: 0x00000000 rdtsc 0x00000002 js 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1023752 second address: 102377D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ebx 0x0000000d jns 00007FCC1D4AF187h 0x00000013 pop ebx 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 102377D second address: 1023810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 je 00007FCC1D4AC756h 0x0000000c jnl 00007FCC1D4AC756h 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 jmp 00007FCC1D4AC762h 0x0000001d pop eax 0x0000001e mov ch, al 0x00000020 lea ebx, dword ptr [ebp+12458155h] 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007FCC1D4AC758h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000018h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 mov cl, bh 0x00000042 add dword ptr [ebp+122D27A1h], eax 0x00000048 xchg eax, ebx 0x00000049 jns 00007FCC1D4AC76Ah 0x0000004f jng 00007FCC1D4AC764h 0x00000055 jmp 00007FCC1D4AC75Eh 0x0000005a push eax 0x0000005b pushad 0x0000005c jne 00007FCC1D4AC766h 0x00000062 pushad 0x00000063 push edx 0x00000064 pop edx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1042922 second address: 1042926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1042926 second address: 104293D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCC1D4AC75Fh 0x0000000d rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 104293D second address: 1042947 instructions: 0x00000000 rdtsc 0x00000002 js 00007FCC1D4AF176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1042947 second address: 1042958 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FCC1D4AC75Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1042958 second address: 1042970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jng 00007FCC1D4AF17Ah 0x00000010 pushad 0x00000011 popad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1042970 second address: 1042976 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1042DF0 second address: 1042DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1042DF6 second address: 1042DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1042F46 second address: 1042F6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FCC1D4AF17Ah 0x0000000b jmp 00007FCC1D4AF17Eh 0x00000010 popad 0x00000011 pushad 0x00000012 jnc 00007FCC1D4AF176h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10433C7 second address: 10433D9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCC1D4AC756h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10433D9 second address: 10433DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10433DF second address: 1043428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FCC1D4AC772h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 js 00007FCC1D4AC756h 0x00000019 push edx 0x0000001a pop edx 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FCC1D4AC75Fh 0x00000023 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1043428 second address: 104342C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1043593 second address: 10435B9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FCC1D4AC764h 0x0000000f jne 00007FCC1D4AC75Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1044310 second address: 1044314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1044314 second address: 104431E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 104431E second address: 1044325 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1012A3E second address: 1012A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1012A42 second address: 1012A79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FCC1D4AF176h 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007FCC1D4AF17Bh 0x00000014 jl 00007FCC1D4AF176h 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007FCC1D4AF181h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10495E6 second address: 10495EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1049C90 second address: 1049CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FCC1D4AF176h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push ebx 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 jmp 00007FCC1D4AF189h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1049CC5 second address: 1049CE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jp 00007FCC1D4AC75Ah 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1049CE1 second address: 1049CE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1048453 second address: 1048464 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1048464 second address: 1048468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1049E4D second address: 1049E54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1049E54 second address: 1049E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1050652 second address: 1050661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC1D4AC75Bh 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105092E second address: 1050934 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1050934 second address: 105094E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC1D4AC766h 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105094E second address: 1050952 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10537B3 second address: 10537B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1053CE2 second address: 1053CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1053DC4 second address: 1053DCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FCC1D4AC756h 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10544B6 second address: 10544C0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCC1D4AF176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10548B2 second address: 10548B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10558B9 second address: 10558BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10558BD second address: 10558C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10558C1 second address: 10558E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jmp 00007FCC1D4AF188h 0x0000000f pop ebx 0x00000010 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1056905 second address: 105691B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FCC1D4AC75Ch 0x00000010 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1057356 second address: 105735C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105735C second address: 1057360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1058744 second address: 105874E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FCC1D4AF176h 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1058516 second address: 105851A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10591DB second address: 10591DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105C41C second address: 105C420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105D3F2 second address: 105D3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105E32B second address: 105E335 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105E335 second address: 105E33A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105F32F second address: 105F333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105E5AB second address: 105E5B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105E5B1 second address: 105E5B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105F46C second address: 105F471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105F471 second address: 105F477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105F536 second address: 105F54B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105F54B second address: 105F551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105F551 second address: 105F555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1063E55 second address: 1063E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCC1D4AC769h 0x0000000e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1064EE3 second address: 1064EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1064EE7 second address: 1064EF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1066CA1 second address: 1066D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FCC1D4AF178h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov bl, al 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push esi 0x0000002c call 00007FCC1D4AF178h 0x00000031 pop esi 0x00000032 mov dword ptr [esp+04h], esi 0x00000036 add dword ptr [esp+04h], 0000001Ch 0x0000003e inc esi 0x0000003f push esi 0x00000040 ret 0x00000041 pop esi 0x00000042 ret 0x00000043 push 00000000h 0x00000045 mov di, si 0x00000048 xchg eax, esi 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007FCC1D4AF183h 0x00000050 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1066D12 second address: 1066D18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1066D18 second address: 1066D1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1066E83 second address: 1066F3D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCC1D4AC76Dh 0x00000008 jmp 00007FCC1D4AC767h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 je 00007FCC1D4AC75Ch 0x00000018 or dword ptr [ebp+122D1B32h], ebx 0x0000001e push dword ptr fs:[00000000h] 0x00000025 push 00000000h 0x00000027 push ebp 0x00000028 call 00007FCC1D4AC758h 0x0000002d pop ebp 0x0000002e mov dword ptr [esp+04h], ebp 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc ebp 0x0000003b push ebp 0x0000003c ret 0x0000003d pop ebp 0x0000003e ret 0x0000003f jmp 00007FCC1D4AC75Ah 0x00000044 mov edi, dword ptr [ebp+122D394Eh] 0x0000004a mov dword ptr fs:[00000000h], esp 0x00000051 jmp 00007FCC1D4AC764h 0x00000056 mov eax, dword ptr [ebp+122D13E9h] 0x0000005c movzx edi, bx 0x0000005f push FFFFFFFFh 0x00000061 push 00000000h 0x00000063 push ebp 0x00000064 call 00007FCC1D4AC758h 0x00000069 pop ebp 0x0000006a mov dword ptr [esp+04h], ebp 0x0000006e add dword ptr [esp+04h], 00000016h 0x00000076 inc ebp 0x00000077 push ebp 0x00000078 ret 0x00000079 pop ebp 0x0000007a ret 0x0000007b mov ebx, 229C56CCh 0x00000080 nop 0x00000081 push eax 0x00000082 push edx 0x00000083 push eax 0x00000084 pushad 0x00000085 popad 0x00000086 pop eax 0x00000087 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1068F32 second address: 1068F36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1066F3D second address: 1066F67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC767h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FCC1D4AC75Ch 0x00000012 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1069DBC second address: 1069DF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF185h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FCC1D4AF188h 0x00000012 jmp 00007FCC1D4AF182h 0x00000017 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1066F67 second address: 1066F6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1069DF0 second address: 1069DF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 106BD6C second address: 106BD70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 106B04F second address: 106B053 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 106BD70 second address: 106BDC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FCC1D4AC75Fh 0x0000000d nop 0x0000000e xor dword ptr [ebp+122D1A1Fh], ebx 0x00000014 push 00000000h 0x00000016 movzx edi, di 0x00000019 push 00000000h 0x0000001b mov edi, ecx 0x0000001d xchg eax, esi 0x0000001e jmp 00007FCC1D4AC760h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FCC1D4AC765h 0x0000002b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 106B053 second address: 106B059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 106BDC0 second address: 106BDC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 106B059 second address: 106B05E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 106E776 second address: 106E77C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 106CF28 second address: 106CF2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 101B162 second address: 101B167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10758C6 second address: 10758CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10758CA second address: 10758D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10758D0 second address: 10758D5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10758D5 second address: 10758E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jnp 00007FCC1D4AC756h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 107FD8E second address: 107FD94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 107FD94 second address: 107FD9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 107FD9A second address: 107FD9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 107FD9E second address: 107FDAD instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 107FF07 second address: 107FF17 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FCC1D4AF17Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10801C7 second address: 10801E6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007FCC1D4AC756h 0x0000000d pushad 0x0000000e popad 0x0000000f jng 00007FCC1D4AC756h 0x00000015 popad 0x00000016 push ecx 0x00000017 ja 00007FCC1D4AC756h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108062B second address: 1080638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FCC1D4AF176h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10807C4 second address: 10807F5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FCC1D4AC765h 0x00000008 jmp 00007FCC1D4AC765h 0x0000000d pop ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108092E second address: 1080932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1080932 second address: 108093B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108093B second address: 108095C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC1D4AF17Ch 0x00000009 pop esi 0x0000000a jno 00007FCC1D4AF17Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108095C second address: 1080960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1080960 second address: 1080986 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 ja 00007FCC1D4AF196h 0x0000000d pushad 0x0000000e jmp 00007FCC1D4AF186h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10850A6 second address: 10850AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10851FD second address: 1085203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1085203 second address: 108520C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108520C second address: 1085212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108536D second address: 1085382 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCC1D4AC75Fh 0x0000000b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10856CF second address: 10856DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FCC1D4AF176h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10856DB second address: 10856E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10856E3 second address: 10856EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10856EB second address: 10856F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10856F5 second address: 10856FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1084DC9 second address: 1084DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1084DCD second address: 1084DDC instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCC1D4AF176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1085B38 second address: 1085B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1085C7B second address: 1085C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCC1D4AF182h 0x0000000e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1085C96 second address: 1085CA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1085CA5 second address: 1085CB6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCC1D4AF178h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1085CB6 second address: 1085CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108BDC1 second address: 108BDE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCC1D4AF183h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108A859 second address: 108A864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FCC1D4AC756h 0x0000000a pop edx 0x0000000b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108A864 second address: 108A869 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108ADB0 second address: 108ADB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108ADB4 second address: 108ADC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop esi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108ADC3 second address: 108ADCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B088 second address: 108B08C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B08C second address: 108B092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B092 second address: 108B09C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FCC1D4AF176h 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B1F6 second address: 108B1FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B1FA second address: 108B208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FCC1D4AF176h 0x0000000e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B208 second address: 108B226 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCC1D4AC75Ah 0x0000000f jmp 00007FCC1D4AC75Ah 0x00000014 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B226 second address: 108B236 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B38B second address: 108B38F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B38F second address: 108B399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B399 second address: 108B39F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B39F second address: 108B3A9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B3A9 second address: 108B3AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108B3AF second address: 108B3B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108BC48 second address: 108BC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC1D4AC75Bh 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 jp 00007FCC1D4AC756h 0x00000016 popad 0x00000017 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 108BC65 second address: 108BC6F instructions: 0x00000000 rdtsc 0x00000002 js 00007FCC1D4AF17Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1052171 second address: 1036DB3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FCC1D4AC765h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e adc cx, 0CA7h 0x00000013 call dword ptr [ebp+122D2E90h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FCC1D4AC75Fh 0x00000020 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1052383 second address: 1052393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FCC1D4AF178h 0x0000000e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1052393 second address: 1052399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105261D second address: 1052622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1052622 second address: 1052628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1052628 second address: 105262C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105262C second address: 1052630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1052721 second address: 1052725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1052725 second address: 105272B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105272B second address: 1052731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10527E2 second address: 105281A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FCC1D4AC769h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007FCC1D4AC758h 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105281A second address: 105287E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCC1D4AF178h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f jnl 00007FCC1D4AF180h 0x00000015 pop eax 0x00000016 pop eax 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FCC1D4AF178h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 jc 00007FCC1D4AF17Dh 0x00000037 jnp 00007FCC1D4AF177h 0x0000003d push FB3ACA71h 0x00000042 pushad 0x00000043 push esi 0x00000044 jns 00007FCC1D4AF176h 0x0000004a pop esi 0x0000004b pushad 0x0000004c pushad 0x0000004d popad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10529AE second address: 10529C3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCC1D4AC758h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1052B0C second address: 1052B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1052D65 second address: 1052D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 105349B second address: 10534A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109289C second address: 10928D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FCC1D4AC769h 0x0000000b jne 00007FCC1D4AC756h 0x00000011 popad 0x00000012 push ecx 0x00000013 jmp 00007FCC1D4AC75Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10928D0 second address: 10928D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10928D9 second address: 10928DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10928DD second address: 10928E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10928E8 second address: 10928F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10928F3 second address: 1092911 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FCC1D4AF183h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1092BAF second address: 1092BBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1092CFF second address: 1092D07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1092D07 second address: 1092D1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1092D1A second address: 1092D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1092D1E second address: 1092D22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1093046 second address: 109304B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1098993 second address: 109899A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109899A second address: 10989AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC1D4AF17Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10989AD second address: 10989B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109ACCA second address: 109ACD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109A9D3 second address: 109A9DD instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109DCCC second address: 109DCD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109DCD0 second address: 109DCD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109D720 second address: 109D72E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 js 00007FCC1D4AF176h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109D72E second address: 109D732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109D87F second address: 109D883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109D883 second address: 109D8A3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCC1D4AC756h 0x00000008 jmp 00007FCC1D4AC766h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109D9A3 second address: 109D9A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109D9A9 second address: 109D9B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109D9B4 second address: 109D9F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jns 00007FCC1D4AF176h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop esi 0x00000013 ja 00007FCC1D4AF183h 0x00000019 jmp 00007FCC1D4AF17Dh 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jnc 00007FCC1D4AF17Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109D9F1 second address: 109D9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109D9F8 second address: 109DA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 109DA01 second address: 109DA1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCC1D4AC767h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10160CF second address: 10160D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10160D3 second address: 1016100 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC765h 0x00000007 js 00007FCC1D4AC756h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnl 00007FCC1D4AC75Eh 0x00000015 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10A462A second address: 10A4636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FCC1D4AF176h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10A4636 second address: 10A4643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FCC1D4AC756h 0x0000000d rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10160FC second address: 1016100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10A493B second address: 10A494F instructions: 0x00000000 rdtsc 0x00000002 js 00007FCC1D4AC75Ch 0x00000008 je 00007FCC1D4AC756h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10A4AD2 second address: 10A4AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10A4E16 second address: 10A4E1C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10A4E1C second address: 10A4E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10A4E22 second address: 10A4E28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10A4E28 second address: 10A4E2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1052F57 second address: 1052F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10A511E second address: 10A512E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FCC1D4AF17Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10A512E second address: 10A5134 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10A5134 second address: 10A514D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10A514D second address: 10A5151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AACE4 second address: 10AACEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AACEA second address: 10AACEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AA593 second address: 10AA59A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AA840 second address: 10AA848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AA848 second address: 10AA87C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCC1D4AF176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FCC1D4AF188h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b jns 00007FCC1D4AF176h 0x00000021 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AA87C second address: 10AA888 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCC1D4AC756h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AA888 second address: 10AA88D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AD2D9 second address: 10AD2DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AD2DD second address: 10AD2E7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AD2E7 second address: 10AD2ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AD2ED second address: 10AD2F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AD2F1 second address: 10AD2FF instructions: 0x00000000 rdtsc 0x00000002 js 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AD459 second address: 10AD47F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FCC1D4AF176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jl 00007FCC1D4AF176h 0x00000013 pop edx 0x00000014 pushad 0x00000015 jmp 00007FCC1D4AF17Bh 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AD47F second address: 10AD489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AD489 second address: 10AD4B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC1D4AF183h 0x00000009 je 00007FCC1D4AF176h 0x0000000f popad 0x00000010 jnl 00007FCC1D4AF17Eh 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AF239 second address: 10AF23F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10AF23F second address: 10AF263 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pushad 0x0000000b push edx 0x0000000c jno 00007FCC1D4AF176h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jnl 00007FCC1D4AF176h 0x0000001d rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10B0865 second address: 10B0869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10B0869 second address: 10B0876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10B0876 second address: 10B087D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10B6331 second address: 10B6341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jnc 00007FCC1D4AF176h 0x0000000f pop ebx 0x00000010 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10B6B85 second address: 10B6BAD instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FCC1D4AC75Fh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 ja 00007FCC1D4AC75Ch 0x00000018 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C0686 second address: 10C068B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C0AA8 second address: 10C0AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C0AAE second address: 10C0ADB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF180h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007FCC1D4AF187h 0x0000000f pop ebx 0x00000010 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C0D9B second address: 10C0DA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C0DA1 second address: 10C0DA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C0DA7 second address: 10C0DAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C0EFC second address: 10C0F10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C0F10 second address: 10C0F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C11A6 second address: 10C11AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C8606 second address: 10C8612 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FCC1D4AC756h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C8612 second address: 10C8618 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C8618 second address: 10C861E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C861E second address: 10C8624 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C8A6B second address: 10C8A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C8A71 second address: 10C8A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C8E9D second address: 10C8EB3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCC1D4AC75Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a jo 00007FCC1D4AC756h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C901D second address: 10C9021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C9E99 second address: 10C9E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C9E9F second address: 10C9EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C9EA5 second address: 10C9EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C7D3F second address: 10C7D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C7D45 second address: 10C7D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C7D49 second address: 10C7D4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10C7D4D second address: 10C7D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10DF307 second address: 10DF30F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10DF30F second address: 10DF34A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC1D4AC763h 0x00000009 popad 0x0000000a jmp 00007FCC1D4AC762h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 jne 00007FCC1D4AC756h 0x00000019 jno 00007FCC1D4AC756h 0x0000001f pop edx 0x00000020 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10DEEDB second address: 10DEEE1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10DEEE1 second address: 10DEF0E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jng 00007FCC1D4AC756h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCC1D4AC75Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FCC1D4AC75Fh 0x0000001a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10DEF0E second address: 10DEF2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10E2A28 second address: 10E2A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10E2A2C second address: 10E2A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10E23ED second address: 10E2403 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007FCC1D4AC75Ah 0x00000010 pop esi 0x00000011 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10EFF9E second address: 10EFFA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10F8114 second address: 10F8131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC1D4AC769h 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10F8131 second address: 10F8137 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10F8594 second address: 10F8598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10F885A second address: 10F88A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jng 00007FCC1D4AF176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007FCC1D4AF195h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FCC1D4AF17Bh 0x0000001a jp 00007FCC1D4AF17Eh 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10F88A3 second address: 10F88A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10F93A2 second address: 10F93BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC1D4AF189h 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10F93BF second address: 10F93C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10FBA51 second address: 10FBA5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10FBA5B second address: 10FBA84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Ch 0x00000007 jmp 00007FCC1D4AC764h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 10FBA84 second address: 10FBA8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 111F724 second address: 111F736 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007FCC1D4AC75Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 111F736 second address: 111F765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 jbe 00007FCC1D4AF176h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jp 00007FCC1D4AF176h 0x0000001c jmp 00007FCC1D4AF183h 0x00000021 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 111F765 second address: 111F772 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113558F second address: 113559A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113559A second address: 113559E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113A0C9 second address: 113A0CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1138FBB second address: 1138FE3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCC1D4AC756h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FCC1D4AC768h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1138FE3 second address: 1138FE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113911E second address: 1139128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FCC1D4AC756h 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 11393CD second address: 11393D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1139890 second address: 11398AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC760h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FCC1D4AC756h 0x00000013 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1139CA0 second address: 1139CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1139CA6 second address: 1139CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113B6FF second address: 113B708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113E307 second address: 113E30D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113E3A6 second address: 113E3FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF182h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122DBB12h], ecx 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007FCC1D4AF178h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e sub edx, dword ptr [ebp+122D2596h] 0x00000034 mov dx, cx 0x00000037 call 00007FCC1D4AF179h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push edi 0x00000041 pop edi 0x00000042 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113E3FD second address: 113E407 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113E407 second address: 113E443 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push esi 0x0000000c jmp 00007FCC1D4AF181h 0x00000011 pop esi 0x00000012 jc 00007FCC1D4AF178h 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113E443 second address: 113E447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113E6E1 second address: 113E714 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FCC1D4AF180h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jmp 00007FCC1D4AF188h 0x00000014 pop ecx 0x00000015 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113E714 second address: 113E71E instructions: 0x00000000 rdtsc 0x00000002 js 00007FCC1D4AC75Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113E71E second address: 113E74A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 xor dword ptr [ebp+122D19CAh], esi 0x0000000d push dword ptr [ebp+122D1C7Eh] 0x00000013 mov dx, 35B3h 0x00000017 mov edx, dword ptr [ebp+124AAEE2h] 0x0000001d push E352FBC6h 0x00000022 jc 00007FCC1D4AF184h 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 113E74A second address: 113E74E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 114182A second address: 1141831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 114134B second address: 1141356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1141356 second address: 114135A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 114135A second address: 114137A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCC1D4AC756h 0x00000008 jmp 00007FCC1D4AC766h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 114137A second address: 114137F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120D3B second address: 5120D41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120D41 second address: 5120D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120D45 second address: 5120D5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FCC1D4AC75Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120D5D second address: 5120D61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120D61 second address: 5120D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120D71 second address: 5120D80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120D80 second address: 5120DA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, E4h 0x00000005 call 00007FCC1D4AC760h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov esi, edx 0x00000013 push eax 0x00000014 push edx 0x00000015 mov bh, 77h 0x00000017 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120DA2 second address: 5120DB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCC1D4AF17Dh 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5110BC5 second address: 5110C27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 call 00007FCC1D4AC75Dh 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 push edi 0x00000012 mov ecx, 7E05BCAFh 0x00000017 pop eax 0x00000018 call 00007FCC1D4AC765h 0x0000001d pushfd 0x0000001e jmp 00007FCC1D4AC760h 0x00000023 or esi, 3743B708h 0x00000029 jmp 00007FCC1D4AC75Bh 0x0000002e popfd 0x0000002f pop esi 0x00000030 popad 0x00000031 mov ebp, esp 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5110C27 second address: 5110C37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5110C37 second address: 5110C77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushfd 0x00000010 jmp 00007FCC1D4AC761h 0x00000015 and esi, 0D0BDB86h 0x0000001b jmp 00007FCC1D4AC761h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5150971 second address: 5150975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5150975 second address: 515097B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 515097B second address: 515098C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC1D4AF17Dh 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 515098C second address: 5150990 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5150990 second address: 51509B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCC1D4AF188h 0x00000010 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51509B3 second address: 51509B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0096 second address: 50F00AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 jmp 00007FCC1D4AF17Ah 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F00AE second address: 50F00FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 call 00007FCC1D4AC768h 0x0000000a mov ecx, 4E9B3A81h 0x0000000f pop ecx 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007FCC1D4AC75Ch 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov al, D0h 0x0000001b movsx edx, cx 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FCC1D4AC761h 0x00000028 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F00FC second address: 50F0101 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0101 second address: 50F016F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FCC1D4AC75Dh 0x0000000a or esi, 2535A9E6h 0x00000010 jmp 00007FCC1D4AC761h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push dword ptr [ebp+04h] 0x0000001c jmp 00007FCC1D4AC75Eh 0x00000021 push dword ptr [ebp+0Ch] 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov ax, di 0x0000002a pushfd 0x0000002b jmp 00007FCC1D4AC769h 0x00000030 jmp 00007FCC1D4AC75Bh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51105FB second address: 5110610 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5110610 second address: 5110630 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 push edi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d mov al, bl 0x0000000f popad 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FCC1D4AC75Bh 0x0000001a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5110630 second address: 5110636 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5110636 second address: 511063C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 511063C second address: 5110640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5110640 second address: 5110644 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5110521 second address: 5110538 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC1D4AF183h 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5110538 second address: 511054D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov cx, 38B1h 0x0000000e push eax 0x0000000f push edx 0x00000010 mov esi, 715767B3h 0x00000015 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 511054D second address: 511056F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FCC1D4AF182h 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 511056F second address: 5110573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5110573 second address: 5110579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5110579 second address: 511058E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 1C7CD301h 0x00000008 mov dx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 511058E second address: 5110592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5110592 second address: 5110598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51102A0 second address: 5110334 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FCC1D4AF187h 0x00000008 pop ecx 0x00000009 movsx edx, si 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007FCC1D4AF17Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FCC1D4AF182h 0x0000001e sbb cl, FFFFFF88h 0x00000021 jmp 00007FCC1D4AF17Bh 0x00000026 popfd 0x00000027 pushfd 0x00000028 jmp 00007FCC1D4AF188h 0x0000002d or eax, 755E2AE8h 0x00000033 jmp 00007FCC1D4AF17Bh 0x00000038 popfd 0x00000039 popad 0x0000003a movzx ecx, dx 0x0000003d popad 0x0000003e mov ebp, esp 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FCC1D4AF17Eh 0x00000047 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51508DF second address: 51508EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51508EE second address: 51508F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5130034 second address: 5130067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 mov eax, edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FCC1D4AC75Fh 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FCC1D4AC765h 0x00000019 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5130067 second address: 513006D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 513006D second address: 513008C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCC1D4AC762h 0x00000012 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 513008C second address: 51300F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax], 00000000h 0x0000000c jmp 00007FCC1D4AF186h 0x00000011 and dword ptr [eax+04h], 00000000h 0x00000015 jmp 00007FCC1D4AF180h 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FCC1D4AF17Dh 0x00000024 and esi, 287FE656h 0x0000002a jmp 00007FCC1D4AF181h 0x0000002f popfd 0x00000030 mov cx, C3C7h 0x00000034 popad 0x00000035 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120C47 second address: 5120C5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 7D0Ah 0x00000007 movsx ebx, cx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120C5B second address: 5120C61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120C61 second address: 5120C8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FCC1D4AC75Ch 0x00000009 xor eax, 48CC8DF8h 0x0000000f jmp 00007FCC1D4AC75Bh 0x00000014 popfd 0x00000015 push esi 0x00000016 pop edx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120C8F second address: 5120C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120C93 second address: 5120C97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120C97 second address: 5120C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120C9D second address: 5120CB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC1D4AC764h 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5120CB5 second address: 5120CF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov esi, 764A511Bh 0x00000012 mov esi, 1032E3F7h 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FCC1D4AF189h 0x00000021 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 515000F second address: 515006D instructions: 0x00000000 rdtsc 0x00000002 mov dh, cl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FCC1D4AC767h 0x0000000c adc si, 57DEh 0x00000011 jmp 00007FCC1D4AC769h 0x00000016 popfd 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 jmp 00007FCC1D4AC75Eh 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FCC1D4AC75Eh 0x00000026 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 515006D second address: 51500AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c jmp 00007FCC1D4AF185h 0x00000011 mov ecx, 614E1667h 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FCC1D4AF184h 0x00000022 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51500AE second address: 51500B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51500B4 second address: 51500BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51500BA second address: 51500C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51500C9 second address: 51500CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51500CF second address: 515012F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FCC1D4AC766h 0x00000008 pop ecx 0x00000009 mov esi, edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FCC1D4AC75Ch 0x00000014 xchg eax, ecx 0x00000015 pushad 0x00000016 jmp 00007FCC1D4AC75Eh 0x0000001b mov ebx, ecx 0x0000001d popad 0x0000001e mov eax, dword ptr [774365FCh] 0x00000023 jmp 00007FCC1D4AC75Ch 0x00000028 test eax, eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FCC1D4AC75Ah 0x00000033 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 515012F second address: 515013E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 515013E second address: 5150168 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FCC8F70FF61h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov dx, ax 0x00000015 popad 0x00000016 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5150168 second address: 515016E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 515016E second address: 5150172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5150172 second address: 5150176 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5150176 second address: 51501E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a pushad 0x0000000b mov ax, di 0x0000000e mov bx, E116h 0x00000012 popad 0x00000013 xor eax, dword ptr [ebp+08h] 0x00000016 pushad 0x00000017 mov bl, al 0x00000019 jmp 00007FCC1D4AC765h 0x0000001e popad 0x0000001f and ecx, 1Fh 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FCC1D4AC763h 0x0000002b xor si, 22FEh 0x00000030 jmp 00007FCC1D4AC769h 0x00000035 popfd 0x00000036 push esi 0x00000037 pop edx 0x00000038 popad 0x00000039 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51501E1 second address: 5150232 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ror eax, cl 0x0000000b jmp 00007FCC1D4AF17Eh 0x00000010 leave 0x00000011 jmp 00007FCC1D4AF180h 0x00000016 retn 0004h 0x00000019 nop 0x0000001a mov esi, eax 0x0000001c lea eax, dword ptr [ebp-08h] 0x0000001f xor esi, dword ptr [00E94014h] 0x00000025 push eax 0x00000026 push eax 0x00000027 push eax 0x00000028 lea eax, dword ptr [ebp-10h] 0x0000002b push eax 0x0000002c call 00007FCC217ADC3Ch 0x00000031 push FFFFFFFEh 0x00000033 pushad 0x00000034 mov dh, ah 0x00000036 push edi 0x00000037 pop ebx 0x00000038 popad 0x00000039 pop eax 0x0000003a pushad 0x0000003b pushad 0x0000003c mov cx, 17FFh 0x00000040 push ecx 0x00000041 pop edx 0x00000042 popad 0x00000043 popad 0x00000044 ret 0x00000045 nop 0x00000046 push eax 0x00000047 call 00007FCC217ADC49h 0x0000004c mov edi, edi 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5150232 second address: 5150238 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5150238 second address: 5150257 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF182h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ah, bl 0x0000000f mov bl, ah 0x00000011 popad 0x00000012 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5150257 second address: 515028C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FCC1D4AC75Eh 0x00000009 or cx, 2B78h 0x0000000e jmp 00007FCC1D4AC75Bh 0x00000013 popfd 0x00000014 mov eax, 343EB2AFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push ecx 0x00000021 pop edi 0x00000022 movzx eax, dx 0x00000025 popad 0x00000026 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 515028C second address: 5150302 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FCC1D4AF182h 0x00000009 xor ecx, 57AD5508h 0x0000000f jmp 00007FCC1D4AF17Bh 0x00000014 popfd 0x00000015 push ecx 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007FCC1D4AF182h 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 jmp 00007FCC1D4AF17Dh 0x0000002a pushfd 0x0000002b jmp 00007FCC1D4AF180h 0x00000030 sub esi, 38C349C8h 0x00000036 jmp 00007FCC1D4AF17Bh 0x0000003b popfd 0x0000003c popad 0x0000003d rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100074 second address: 5100079 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100079 second address: 51000BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC1D4AF17Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ecx 0x0000000f jmp 00007FCC1D4AF17Eh 0x00000014 xchg eax, ebx 0x00000015 pushad 0x00000016 mov dx, 1EC0h 0x0000001a popad 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FCC1D4AF185h 0x00000023 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51000BD second address: 51000E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC761h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCC1D4AC75Dh 0x00000011 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51000E2 second address: 51000E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51000E9 second address: 5100153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, dword ptr [ebp+10h] 0x0000000a pushad 0x0000000b mov si, dx 0x0000000e push edx 0x0000000f mov ebx, esi 0x00000011 pop esi 0x00000012 popad 0x00000013 push ebp 0x00000014 jmp 00007FCC1D4AC766h 0x00000019 mov dword ptr [esp], esi 0x0000001c pushad 0x0000001d mov ebx, ecx 0x0000001f popad 0x00000020 mov esi, dword ptr [ebp+08h] 0x00000023 jmp 00007FCC1D4AC764h 0x00000028 xchg eax, edi 0x00000029 jmp 00007FCC1D4AC760h 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FCC1D4AC75Eh 0x00000036 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100153 second address: 5100159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100159 second address: 510015D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 510015D second address: 51001A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c jmp 00007FCC1D4AF17Eh 0x00000011 test esi, esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007FCC1D4AF17Dh 0x0000001b call 00007FCC1D4AF180h 0x00000020 pop eax 0x00000021 popad 0x00000022 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51001A3 second address: 51001A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51001A9 second address: 51001AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51001AD second address: 51001CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FCC8F75ABAEh 0x00000011 pushad 0x00000012 mov di, cx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51001CB second address: 510021B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000e jmp 00007FCC1D4AF180h 0x00000013 je 00007FCC8F75D5B8h 0x00000019 pushad 0x0000001a mov esi, 7CEC20DDh 0x0000001f mov ecx, 018EEDD9h 0x00000024 popad 0x00000025 mov edx, dword ptr [esi+44h] 0x00000028 jmp 00007FCC1D4AF184h 0x0000002d or edx, dword ptr [ebp+0Ch] 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 510021B second address: 5100238 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100238 second address: 5100259 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100259 second address: 510025D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 510025D second address: 5100270 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100270 second address: 510029F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, ADCAh 0x00000007 jmp 00007FCC1D4AC75Bh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jne 00007FCC8F75AB59h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FCC1D4AC760h 0x0000001e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 510029F second address: 51002AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0819 second address: 50F081D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F081D second address: 50F0821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0821 second address: 50F0827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0827 second address: 50F082D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F082D second address: 50F0858 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d call 00007FCC1D4AC75Eh 0x00000012 pop edx 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0858 second address: 50F085C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F085C second address: 50F0862 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0862 second address: 50F0868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0868 second address: 50F086C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F086C second address: 50F089C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FCC1D4AF17Eh 0x00000012 and ax, 7058h 0x00000017 jmp 00007FCC1D4AF17Bh 0x0000001c popfd 0x0000001d mov di, ax 0x00000020 popad 0x00000021 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F089C second address: 50F08A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F08A2 second address: 50F08A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F09D0 second address: 50F09F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c mov dx, si 0x0000000f mov edi, eax 0x00000011 popad 0x00000012 je 00007FCC8F7620FCh 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b mov edi, eax 0x0000001d rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F09F3 second address: 50F0A34 instructions: 0x00000000 rdtsc 0x00000002 mov dl, al 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cl, dl 0x00000008 popad 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007FCC1D4AF186h 0x00000015 mov ecx, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FCC1D4AF187h 0x0000001e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0A34 second address: 50F0AED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FCC8F7620A8h 0x0000000f pushad 0x00000010 call 00007FCC1D4AC75Ch 0x00000015 pushfd 0x00000016 jmp 00007FCC1D4AC762h 0x0000001b add ah, 00000068h 0x0000001e jmp 00007FCC1D4AC75Bh 0x00000023 popfd 0x00000024 pop esi 0x00000025 pushfd 0x00000026 jmp 00007FCC1D4AC769h 0x0000002b or ax, C886h 0x00000030 jmp 00007FCC1D4AC761h 0x00000035 popfd 0x00000036 popad 0x00000037 test byte ptr [77436968h], 00000002h 0x0000003e jmp 00007FCC1D4AC75Eh 0x00000043 jne 00007FCC8F76203Eh 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007FCC1D4AC767h 0x00000050 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0AED second address: 50F0AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0AF3 second address: 50F0AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0AF7 second address: 50F0B47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e pushad 0x0000000f mov ax, 771Bh 0x00000013 popad 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FCC1D4AF17Fh 0x0000001e and al, 0000007Eh 0x00000021 jmp 00007FCC1D4AF189h 0x00000026 popfd 0x00000027 mov cx, BCC7h 0x0000002b popad 0x0000002c rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0B47 second address: 50F0B4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0B4D second address: 50F0BB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e jmp 00007FCC1D4AF186h 0x00000013 xchg eax, ebx 0x00000014 pushad 0x00000015 mov cx, AD6Dh 0x00000019 movzx ecx, bx 0x0000001c popad 0x0000001d push eax 0x0000001e jmp 00007FCC1D4AF184h 0x00000023 xchg eax, ebx 0x00000024 jmp 00007FCC1D4AF180h 0x00000029 push dword ptr [ebp+14h] 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0BB4 second address: 50F0BD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0BD1 second address: 50F0BE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC1D4AF17Ch 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0BE1 second address: 50F0BFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+10h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0BFB second address: 50F0C01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0C2B second address: 50F0C31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0C31 second address: 50F0C9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF17Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FCC1D4AF17Ch 0x00000013 sub ax, EE18h 0x00000018 jmp 00007FCC1D4AF17Bh 0x0000001d popfd 0x0000001e call 00007FCC1D4AF188h 0x00000023 mov bx, si 0x00000026 pop eax 0x00000027 popad 0x00000028 mov esp, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FCC1D4AF188h 0x00000031 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0C9D second address: 50F0CA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, E484h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 50F0CA6 second address: 50F0CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov bh, al 0x0000000d pushfd 0x0000000e jmp 00007FCC1D4AF187h 0x00000013 sbb ax, CA4Eh 0x00000018 jmp 00007FCC1D4AF189h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1056522 second address: 105652C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1056713 second address: 1056717 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 1056717 second address: 1056758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007FCC1D4AC763h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FCC1D4AC768h 0x00000019 jp 00007FCC1D4AC756h 0x0000001f popad 0x00000020 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100BCA second address: 5100BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100BD0 second address: 5100BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100BD4 second address: 5100C2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b mov cx, B749h 0x0000000f call 00007FCC1D4AF186h 0x00000014 pop esi 0x00000015 popad 0x00000016 pushfd 0x00000017 jmp 00007FCC1D4AF17Bh 0x0000001c add ax, 35AEh 0x00000021 jmp 00007FCC1D4AF189h 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100C2E second address: 5100C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100C32 second address: 5100C38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100C38 second address: 5100C7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC765h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FCC1D4AC75Eh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FCC1D4AC767h 0x00000018 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 510085A second address: 5100874 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 jmp 00007FCC1D4AF17Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5100874 second address: 51008A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC1D4AC768h 0x00000009 popad 0x0000000a mov ch, 52h 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007FCC1D4AC75Ch 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51008A7 second address: 51008AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, bl 0x00000006 popad 0x00000007 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51008AE second address: 51008E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 mov si, 0593h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f jmp 00007FCC1D4AC766h 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 call 00007FCC1D4AC75Dh 0x0000001d pop ecx 0x0000001e mov ecx, edx 0x00000020 popad 0x00000021 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51008E8 second address: 51008EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51008EE second address: 51008F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 518071B second address: 5180720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5180720 second address: 518075F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 pushfd 0x00000007 jmp 00007FCC1D4AC765h 0x0000000c xor si, B746h 0x00000011 jmp 00007FCC1D4AC761h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov di, 55CEh 0x00000022 popad 0x00000023 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51708EF second address: 51708F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51708F3 second address: 51708F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51708F9 second address: 51708FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51708FF second address: 5170903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170903 second address: 5170907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170907 second address: 5170917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ax, dx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170917 second address: 517092C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCC1D4AF17Ch 0x0000000e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 517092C second address: 517093E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC1D4AC75Eh 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170844 second address: 5170849 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170849 second address: 51708A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FCC1D4AC75Dh 0x0000000a or esi, 0C1DA566h 0x00000010 jmp 00007FCC1D4AC761h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FCC1D4AC75Ch 0x00000022 sbb ax, 1D08h 0x00000027 jmp 00007FCC1D4AC75Bh 0x0000002c popfd 0x0000002d mov ax, C77Fh 0x00000031 popad 0x00000032 pop ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51708A3 second address: 51708A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51708A7 second address: 51708AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51708AD second address: 51708B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 51708B3 second address: 51708B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170AEC second address: 5170B51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FCC1D4AF17Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FCC1D4AF17Ch 0x00000019 sub ah, 00000068h 0x0000001c jmp 00007FCC1D4AF17Bh 0x00000021 popfd 0x00000022 jmp 00007FCC1D4AF188h 0x00000027 popad 0x00000028 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170B51 second address: 5170B9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FCC1D4AC766h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov ebx, eax 0x00000014 push eax 0x00000015 pushad 0x00000016 popad 0x00000017 pop ebx 0x00000018 popad 0x00000019 push dword ptr [ebp+0Ch] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov ax, di 0x00000022 call 00007FCC1D4AC763h 0x00000027 pop eax 0x00000028 popad 0x00000029 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170B9F second address: 5170BA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170BA5 second address: 5170BD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC760h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f push esi 0x00000010 mov si, dx 0x00000013 pop ebx 0x00000014 popad 0x00000015 push 8C89E878h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170BD0 second address: 5170BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170BD4 second address: 5170BDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170BDA second address: 5170C22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AF184h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 7377178Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FCC1D4AF17Dh 0x00000019 adc ch, 00000066h 0x0000001c jmp 00007FCC1D4AF181h 0x00000021 popfd 0x00000022 mov ah, DEh 0x00000024 popad 0x00000025 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170C5D second address: 5170CA4 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FCC1D4AC75Ah 0x00000008 adc al, FFFFFF98h 0x0000000b jmp 00007FCC1D4AC75Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 movzx eax, al 0x00000017 jmp 00007FCC1D4AC766h 0x0000001c pop ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FCC1D4AC75Ah 0x00000026 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeRDTSC instruction interceptor: First address: 5170CA4 second address: 5170CAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 13F47A second address: 13F495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCC1D4AC756h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FCC1D4AC75Eh 0x00000012 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 13F495 second address: 13F499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C050F second address: 2C052C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCC1D4AC762h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C052C second address: 2C0539 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C0539 second address: 2C053E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C053E second address: 2C054C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCC1D4AF17Ah 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C054C second address: 2C055B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC75Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2BF56D second address: 2BF5C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FCC1D4AF176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FCC1D4AF17Dh 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 pushad 0x00000015 popad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 popad 0x00000019 jmp 00007FCC1D4AF17Ch 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FCC1D4AF183h 0x00000026 jmp 00007FCC1D4AF189h 0x0000002b rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2BF9E7 second address: 2BFA00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCC1D4AC756h 0x0000000a popad 0x0000000b jng 00007FCC1D4AC758h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2BFA00 second address: 2BFA0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FCC1D4AF176h 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2BFA0A second address: 2BFA23 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jp 00007FCC1D4AC756h 0x00000011 push edx 0x00000012 pop edx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2BFA23 second address: 2BFA2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2BFBBC second address: 2BFBC6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C32AA second address: 2C32AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C32AE second address: 2C32F9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCC1D4AC756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c jnl 00007FCC1D4AC768h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push ecx 0x00000017 jmp 00007FCC1D4AC75Bh 0x0000001c pop ecx 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 pushad 0x00000027 jmp 00007FCC1D4AC75Ah 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C32F9 second address: 2C3308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C3308 second address: 2C330D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C330D second address: 2C336D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCC1D4AF186h 0x00000008 jnl 00007FCC1D4AF176h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop eax 0x00000012 jmp 00007FCC1D4AF17Bh 0x00000017 js 00007FCC1D4AF17Bh 0x0000001d mov esi, 7172AA25h 0x00000022 push 00000003h 0x00000024 push 00000000h 0x00000026 or cl, FFFFFFA3h 0x00000029 push 00000003h 0x0000002b mov dl, 8Fh 0x0000002d call 00007FCC1D4AF179h 0x00000032 jmp 00007FCC1D4AF17Ch 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push ecx 0x0000003b pushad 0x0000003c popad 0x0000003d pop ecx 0x0000003e rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C336D second address: 2C3392 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCC1D4AC769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C3392 second address: 2C3398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C3398 second address: 2C33BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jmp 00007FCC1D4AC767h 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C33BC second address: 2C3410 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ebx 0x0000000c jmp 00007FCC1D4AF183h 0x00000011 pop ebx 0x00000012 pop eax 0x00000013 cmc 0x00000014 movzx esi, bx 0x00000017 lea ebx, dword ptr [ebp+12458141h] 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007FCC1D4AF178h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 or dword ptr [ebp+122D2ACBh], ebx 0x0000003d xchg eax, ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C3410 second address: 2C3416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C3416 second address: 2C341B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C341B second address: 2C342E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FCC1D4AC756h 0x00000013 rdtsc
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeRDTSC instruction interceptor: First address: 2C345F second address: 2C34B0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCC1D4AF176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FCC1D4AF178h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 movzx ecx, bx 0x0000002b push 00000000h 0x0000002d adc di, A334h 0x00000032 call 00007FCC1D4AF179h 0x00000037 push ecx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FCC1D4AF17Ah 0x0000003f rdtsc
                                Tries to evade debugger and weak emulator (self modifying code)
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSpecial instruction interceptor: First address: E9ECA0 instructions caused by: Self-modifying code
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSpecial instruction interceptor: First address: E9C4EA instructions caused by: Self-modifying code
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSpecial instruction interceptor: First address: 106E7CC instructions caused by: Self-modifying code
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSpecial instruction interceptor: First address: 10D7A29 instructions caused by: Self-modifying code
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSpecial instruction interceptor: First address: 13ECA0 instructions caused by: Self-modifying code
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSpecial instruction interceptor: First address: 13C4EA instructions caused by: Self-modifying code
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSpecial instruction interceptor: First address: 30E7CC instructions caused by: Self-modifying code
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeSpecial instruction interceptor: First address: 377A29 instructions caused by: Self-modifying code
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeMemory allocated: 1480000 memory reserve | memory write watch
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeMemory allocated: 3040000 memory reserve | memory write watch
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeMemory allocated: 5040000 memory reserve | memory write watch
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeMemory allocated: 2600000 memory reserve | memory write watch
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeMemory allocated: 2810000 memory reserve | memory write watch
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeMemory allocated: 4810000 memory reserve | memory write watch
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeMemory allocated: 1220000 memory reserve | memory write watch
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeMemory allocated: 2F60000 memory reserve | memory write watch
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeMemory allocated: 2D80000 memory reserve | memory write watch
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeMemory allocated: 246C2560000 memory reserve | memory write watch
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeMemory allocated: 246DA5F0000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 11B0000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 2B30000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 4B30000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 6F80000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 7F80000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 8100000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 9100000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 9400000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 9400000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: AA00000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: BA00000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: CA00000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: DA00000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: E230000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: F230000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 10230000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 94C0000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: CA00000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 9100000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: BA00000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: F230000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 77C0000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 8A00000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: AA00000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: DFF0000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: EFF0000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: EFF0000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: DFF0000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: AB00000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: 8A00000 memory reserve | memory write watch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeMemory allocated: AB00000 memory reserve | memory write watch
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeCode function: 6_2_05170B9D rdtsc 6_2_05170B9D
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeThread delayed: delay time: 180000Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeThread delayed: delay time: 180000
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeThread delayed: delay time: 922337203685477
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeThread delayed: delay time: 922337203685477
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 922337203685477
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 600000
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 599790
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 599665
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 599393
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 599086
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 598959
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 300000
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 598668
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 598313
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 598000
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 597750
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 597532
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 596922
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 596391
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 595943
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 595625
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 595360
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 595032
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 594407
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 593844
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 593344
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 592735
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 592079
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 591585
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 590814
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 590313
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 589150
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 588679
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 588206
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 584814
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 584064
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 583315
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 582569
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 582066
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 581187
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 580173
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 579790
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 579252
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 577907
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 577283
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 576486
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 576048
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 574939
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 574283
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 573283
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 572830
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 572204
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 564345
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 560846
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 559627
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 558939
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 558064
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 557424
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 556814
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 555877
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 555049
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 554471
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 552846
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 551923
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 551188
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 549986
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 549303
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 548722
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 547329
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 546045
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 545579
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 545048
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 544408
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 543658
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 543236
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 542673
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 542251
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 541751
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 540689
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 540079
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 539658
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 538814
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 538345
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 537392
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 536564
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 535907
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 535486
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 535048
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 534126
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 533642
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 533392
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 533142
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 532861
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 532408
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 531861
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 531564
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 531173
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 530751
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 530501
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 530017
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 529236
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 528759
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 528361
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 527923
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 527080
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 526658
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 526236
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 525861
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 525330
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 525017
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 524533
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 524173
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 523689
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 523220
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 522376
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 522033
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 520814
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 519788
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 519189
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 518829
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 518368
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 517705
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 517361
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 517014
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 516736
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 516251
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 515876
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 515080
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 514611
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 514095
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 513595
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 512142
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 511423
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 511017
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 510314
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 510008
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 509517
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 509126
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 508736
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 508298
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 507845
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 507501
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 507033
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 506626
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 506343
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 505908
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 504439
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 503939
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 503205
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 502548
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 501985
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 501267
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 499798
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 499158
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 498727
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 497658
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 497095
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 496595
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 495658
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 495001
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 494455
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 493939
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 493533
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 492798
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 492236
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 491861
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 491501
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 491189
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 490673
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 490329
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 490109
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 489670
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 488720
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 488298
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 487908
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 486642
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 484626
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 482439
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 480626
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 478642
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 477908
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 476298
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 475782
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 475220
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 474501
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 473861
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 473314
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 472848
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 470533
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 469017
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 468283
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 466986
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 463876
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 462830
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 458970
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 457986
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 457345
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 456888
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 456173
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 455658
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 455080
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 454579
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 454048
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 453595
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 453283
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 452986
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 452189
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 451908
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 451517
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 451064
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 450783
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 450455
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 449829
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 449411
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 448626
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 448095
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 447811
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 447439
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 446814
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 446486
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 446220
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 445783
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 445486
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 445189
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 922337203685477
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeWindow / User API: threadDelayed 2948Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow / User API: threadDelayed 991
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow / User API: threadDelayed 919
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow / User API: threadDelayed 977
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow / User API: threadDelayed 1034
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow / User API: threadDelayed 1096
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow / User API: threadDelayed 852
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow / User API: threadDelayed 1059
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeWindow / User API: threadDelayed 1092
                                Source: C:\Users\user\1000021002\2c9ff67496.exeWindow / User API: threadDelayed 773
                                Source: C:\Windows\SysWOW64\rundll32.exeWindow / User API: threadDelayed 4297
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWindow / User API: threadDelayed 4143
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6944
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 637
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1774
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeWindow / User API: threadDelayed 732
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_7-46082
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000088001\NewB.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\o70oR4A1odPm6ZpEPmcUY0kf.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\VOC2vgozeooRPwe4xNfnekbg.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\Ud8P6u9zcQkOThPmdNJauqRX.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\91UaPJ59dXTYhY2K658YFFeC.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\XBajRwldCSS42gwh4zu9f3ce.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\LmG3qDHSUq8w4Wsw1PGm8pPm.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\EqMO5smfp2bzSmy94pnHeeak.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\p7KXtY1OslUIeP9Ce7HA7pcJ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\ArokRzfYMxWDCVlcYzlFE2Lj.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\ar5KINQCCayk0Kw6DN1FAVFx.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\3YZhMRbhtqchUxr6HrEmYWxb.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\qXzqKXhtyyRVQ12sGB23FDz0.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\EmEyDLXTX7wKV3Hm4GA8AbdZ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\iiEhcrEC7kfTSvcQ2xPEqYzR.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\WIZZw2jIWtghnINz7Bolcg6s.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\HUsiXwAPudopBX0gkG8zqZ9K.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\h9zNDFfiMy6YEXVQdIbIdOv5.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\GcbucsdsAk7dv2EzyRdhbByI.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\2MTLbmRYdCbpYlRWWULShPZa.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\R7igej85hEl8p5QzHqqsVcc4.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\k4a17b3U4KeqWyuMzrdWzqyt.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\joRzh0eN9ubjpRYMOMHaTsYl.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\IwVIt8hVIPrEsgJdmcJDc0cp.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\zQeTuw5vxgdbKmiVRBeW6SUZ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\vG3D68E3KVPIYrQEMWMU27tl.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\zqrjs0OTmaC5sGR5VDn5k391.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\vQkPzCCvFzBxzLEPKtUXhb4x.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\FsKEmkdvDCAc7VY3lRIiRKAL.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\27xttgdEmHmLdE1NNbjDPunl.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\WmwQPTarASP4EtQ3MAZKQqLX.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\29IA9rCjPmrMnnZQZ7YKNcOZ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\4ebcbWCvvuWPOCPYovXXMriV.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\87yah1hG3sRWG8d7DMFA6UPI.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\CwwSkg4Z6r2CyUx7eieftoSL.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\LzRxHxBk5eAHgaCKyeZTvsuN.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\clip64[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\US6SMVSChPuNg0C79rqEySgv.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\alexxxxxxxx[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Nx2ualF4WR83o8BLpmD9zVrW.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\9DP8FgphO9xB4vzM75llXw4b.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dllJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\fW9mvrDIULE1qzTuYb8DunLu.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\0FhI3ymKwyu4YKH0P5aiSwr9.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\8gEIcaaLXjtHWMkCknRgnRyn.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\NAw5Utgp8P611rdec0BR0MlI.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\7mRVtPlrMfZmo26ldo406lmd.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\1llpE1der8s65YfF1DaRwzoA.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\kivxs7Zej5QjZRx4S943Y5EA.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\JfX04QeZvezkOn3eIpEjUqc5.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\Yv6kDvOTN4rtEsFYOeCJZShm.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\FMABIYNaDvdpX82vGnLOftDu.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\OjMaXQfausZW7L4bZ74RhT97.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Zy6qmavCIexKIuB9nNrNHs9p.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\jDKkqPCmIoUaiq9LrPYuCKQs.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\NXXoMKuzuftWWcaGwWfRizTp.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\GXqvrU2YdMIpdqoqkBIkuQ4a.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\KjpvJ8EHnBGQBp0fiOyr1f1m.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\TexEUOb49XCfEjOcQuxS4LdR.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\DqApJooverXr18YkrozyIUpZ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\F5nHoJjiPsXq9PqBPnN3uVb5.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\qiW5UZkXzhMJ8qrVDgrcAGm1.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\ARFJvysANOCKBRK3eId7VsQB.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\CS3gyNCBkgUy4GD82bQforlP.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\aR1aAXIrzQtExVh9FbdfoBrR.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\lI1wLYD1b5s5Qo04Ewg0WqV1.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\xFvJiGaaRqrUdwrQth3PHHC0.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\5N2KVotsup59l0rdMarxmZjH.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\NAo5jaAAmqipcIgVfrpEqrOC.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\KEohnm8N5FXDryvXGbq4vqXq.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\IGVPHrAShfg5S77hqubJkQGT.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\fRiNFTEVJnpONJofzyWKlqwW.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\gsF9GZceaIYWveF9Wn0mXwbt.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\6lvatP6Q76Lt1uvfZT2GD6HY.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\4WIaPCqUVwVYRafs2f1atHjf.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\Loo9WoJBx4a6RLa9vZq7467f.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\UrMKiBsPUmHBdjATiF2xGFWW.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\5Xza309AWSsKZ7QtcoKLlH6j.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\xYhK2iEXeksXlPa9BMLXm5tE.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\NewB[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\4ptz7FM4kP7qMGFoFqE5j0zm.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\D8TGVGr0asGkgU3ycSpOmYcn.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Yg9IAPVdFD93gbLGPdcvbgw2.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\KfIHlc6gAJQcL38Vr6ssqJ5m.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Y0ZKJ4dRBRkIRESl8nT570lZ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\CZ8BPZs8awoPJiACUS73pAe6.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\enEog6vYdNgmFKOyGbVQTrXc.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\91wCUE8aqMgtssmXq8JjQEVt.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\OFqYXukHEjQzmQ3ijziOsyC5.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\Czc5fung6FsMhCVG7EMYaiqO.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000080001\alexxxxxxxx.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\ProgramData\softokn3.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\ELbDrf9qIHQaBWPxuiJjUCoM.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\f3qMySWuesp6iqsnQUyX8UG1.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\VUhKLgvybQx21ilX50E3IN7y.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\v4pPJZm6TK3eJidyD0YTpSI8.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\cqEYVGnsRBmElwXA0pViDIv4.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\nw6IIdZQfEhqp8k6unIrj2qH.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\N14E2wCpaY7ufVWw1V4rquym.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\w73g23dHAf0dTWCMUXFqmd74.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\dLosfqkp920zMbaetcnvwrJJ.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\z2u4DwiwBezR2xi11GPVbROw.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\ybCY5oONgBmPsQ2TsLXObZGj.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\aAFMFn8XgxK4ax5TQ7f1st28.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\bVARrzkwQmnP1mnoffZ1HExy.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\WllNfMrTNMJ4E1bpkfOuURJc.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\4zlsKqSOTzijQzm8qevqChAD.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\O8qlhpLK7TtBYe0J94Fm1B86.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\AdqitUVCSO3pnZ13PPMmTugt.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\PbrRyuOT2DJaFlbAzGY6neq7.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\ProgramData\freebl3.dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\VRZS2eg6KpyehTgltwjCKDt4.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\J6EKnVYc7FheOARgvJ4DtZho.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\RbvLNaGRBEsayaSXnP4Zo5B2.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\LdBVJ0t5gC67YMsVTHQfk739.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\JkJexXpPrIyNVfwGJRUJua9O.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\604jEG5qQpdnhPVOdLS1sPeh.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\ZFNbxiSI6dIgrSto9a3Z7jlo.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\YdDMLcotJvPaOVEHpalanl1d.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000081001\install.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\tRGz8YUeJOvAWwmplTaCNv1T.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\3bvlPX7g5Zc6pp8TPpEM470u.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\2D21U1bRl2sEI2OnuIMYALNl.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\TwRm9Z0OjBAq1e9wDGeHmdCv.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\bU6cqro2wPcmClLzDGRpxfw1.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\8sZNm50KnZ73Ir2IAGAzjiCM.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\4PmoraVG5R1jZgxSXUXnrPno.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\1ZiD49yFoSPKKQmrglTINzlo.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\3OywHIBuj0AIQ7Aq3CE27htS.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\pTXFwTPyWVPZ4sTiGkA8a5ei.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\GFV2yyE0PpJkpGdl2N1D7Pr9.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\cred64[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\kqcWDzUDzGODoV7JWmwBlZRR.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dllJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\Tn3AK9zqC5GmoiH5iA9IY9Q6.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\v7Li9n9DDXtQeZJRorH86P5g.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\sarra[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\hQa9fYPzQBrGD6byFRloLN5U.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\gpxXZca2LPxp8nx3YxfAq52Q.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\J60VIKU1uGOij5ybpvmDPTRI.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\vwsgN3REbITHxJG5vlKYY3Vx.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\fybzTZ3WiLAPEZj0fVOx3M0F.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\7QngCiEI0nWQ5NI3rtCate4r.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\install[1].exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\eNB1RX0hn7cF5yIvRdwV0Sdv.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\yNQkYyPgov8fX5k7nVDGzk6w.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\nRXc5v7fBpZ3Rt6WXas92N9q.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\0rCtm6Hv5UQtXJOFVlEJjcOA.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\KITnOquJmIbAAhc0DU20ke2n.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\bsl30mcD1mRV5YLU9isxcsMk.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\UnZ9xXtOVzbDDdfuNC2Trxtk.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Te8IoKHiu7i6R94P1wuixO8g.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\D6PuoAsNvye4jtgG7lWCsXEx.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\ZA6xyNAEYiDprMq2qgywyku5.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\TEpqQjIAfTfCTbePKUGsV0Gk.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\Pictures\uU9N3wILYLaLsdrVTU78EpKz.exeJump to dropped file
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\6xNdov8AZo7X4GIGr08JaGXe.exeJump to dropped file
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_7-46851
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe TID: 2716Thread sleep count: 2948 > 30Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe TID: 2716Thread sleep time: -88440000s >= -30000sJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe TID: 2132Thread sleep time: -540000s >= -30000sJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe TID: 6324Thread sleep count: 32 > 30Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe TID: 2716Thread sleep time: -30000s >= -30000sJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe TID: 5232Thread sleep count: 42 > 30Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe TID: 5232Thread sleep count: 97 > 30Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe TID: 2524Thread sleep count: 45 > 30Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe TID: 5232Thread sleep count: 109 > 30Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe TID: 5232Thread sleep count: 48 > 30Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 3328Thread sleep count: 991 > 30
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 3328Thread sleep time: -1982991s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 4180Thread sleep count: 919 > 30
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 4180Thread sleep time: -1838919s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 3320Thread sleep count: 977 > 30
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 3320Thread sleep time: -1954977s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 884Thread sleep time: -60000s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 3160Thread sleep count: 46 > 30
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 3160Thread sleep time: -1380000s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 5560Thread sleep count: 1034 > 30
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 5560Thread sleep time: -2069034s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 420Thread sleep count: 1096 > 30
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 420Thread sleep time: -2193096s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7280Thread sleep time: -2160000s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 2644Thread sleep count: 852 > 30
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 2644Thread sleep time: -1704852s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 2720Thread sleep count: 1059 > 30
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 2720Thread sleep time: -2119059s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 2224Thread sleep count: 1092 > 30
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 2224Thread sleep time: -2185092s >= -30000s
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2260Thread sleep count: 155 > 30
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7664Thread sleep count: 76 > 30
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7664Thread sleep count: 55 > 30
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2260Thread sleep count: 66 > 30
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7292Thread sleep count: 155 > 30
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7660Thread sleep count: 67 > 30
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7660Thread sleep count: 47 > 30
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7292Thread sleep count: 58 > 30
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7812Thread sleep time: -150000s >= -30000s
                                Source: C:\Windows\SysWOW64\rundll32.exe TID: 7976Thread sleep count: 4297 > 30
                                Source: C:\Windows\SysWOW64\rundll32.exe TID: 7976Thread sleep time: -4297000s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe TID: 16708Thread sleep time: -1844674407370954s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe TID: 16708Thread sleep time: -45000s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe TID: 8104Thread sleep count: 72 > 30
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe TID: 8104Thread sleep count: 104 > 30
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe TID: 4396Thread sleep count: 61 > 30
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe TID: 4396Thread sleep count: 47 > 30
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe TID: 8104Thread sleep count: 77 > 30
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5700Thread sleep time: -7378697629483816s >= -30000s
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5700Thread sleep time: -922337203685477s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe TID: 644Thread sleep time: -922337203685477s >= -30000s
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640Thread sleep time: -13835058055282155s >= -30000s
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1808Thread sleep time: -922337203685477s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7576Thread sleep time: -30000s >= -30000s
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7620Thread sleep count: 110 > 30
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7620Thread sleep count: 55 > 30
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8432Thread sleep count: 69 > 30
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8432Thread sleep count: 55 > 30
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7620Thread sleep count: 52 > 30
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep count: 42 > 30
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -38738162554790034s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -600000s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7532Thread sleep count: 732 > 30
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -599790s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -599665s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -599393s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -599086s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -598959s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8052Thread sleep time: -4200000s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -598668s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -598313s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -598000s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -597750s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -597532s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -596922s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -596391s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -595943s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -595625s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -595360s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -595032s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -594407s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -593844s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -593344s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -592735s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -592079s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -591585s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -590814s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -590313s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -589150s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -588679s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -588206s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -584814s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -584064s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -583315s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -582569s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -582066s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -581187s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -580173s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -579790s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -579252s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -577907s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -577283s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -576486s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -576048s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -574939s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -574283s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -573283s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -572830s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -572204s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -564345s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -560846s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -559627s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -558939s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -558064s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -557424s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -556814s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -555877s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -555049s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -554471s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -552846s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -551923s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -551188s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -549986s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -549303s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -548722s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -547329s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -546045s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -545579s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -545048s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -544408s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -543658s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -543236s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -542673s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -542251s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -541751s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -540689s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -540079s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -539658s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -538814s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -538345s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -537392s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -536564s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -535907s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -535486s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -535048s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -534126s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -533642s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -533392s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -533142s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -532861s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -532408s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -531861s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -531564s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -531173s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -530751s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -530501s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -530017s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -529236s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -528759s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -528361s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -527923s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -527080s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -526658s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -526236s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -525861s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -525330s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -525017s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -524533s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -524173s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -523689s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -523220s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -522376s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -522033s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -520814s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -519788s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -519189s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -518829s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -518368s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -517705s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -517361s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -517014s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -516736s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -516251s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -515876s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -515080s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -514611s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -514095s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -513595s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -512142s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -511423s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -511017s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -510314s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -510008s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -509517s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -509126s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -508736s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -508298s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -507845s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -507501s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -507033s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -506626s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -506343s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -505908s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -504439s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -503939s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -503205s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -502548s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -501985s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -501267s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -499798s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -499158s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -498727s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -497658s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -497095s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -496595s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -495658s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -495001s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -494455s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -493939s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -493533s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -492798s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -492236s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -491861s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -491501s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -491189s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -490673s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -490329s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -490109s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -489670s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -488720s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -488298s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -487908s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -486642s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -484626s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -482439s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -480626s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -478642s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -477908s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -476298s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -475782s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -475220s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -474501s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -473861s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -473314s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -472848s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -470533s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -469017s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -468283s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -466986s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -463876s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -462830s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -458970s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -457986s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -457345s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -456888s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -456173s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -455658s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -455080s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -454579s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -454048s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -453595s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -453283s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -452986s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -452189s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -451908s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -451517s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -451064s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -450783s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -450455s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -449829s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -449411s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -448626s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -448095s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -447811s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -447439s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -446814s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -446486s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -446220s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -445783s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -445486s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -445189s >= -30000s
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7892Thread sleep time: -922337203685477s >= -30000s
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeLast function: Thread delayed
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeLast function: Thread delayed
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeLast function: Thread delayed
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeLast function: Thread delayed
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeLast function: Thread delayed
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeLast function: Thread delayed
                                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeLast function: Thread delayed
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeLast function: Thread delayed
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeLast function: Thread delayed
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeLast function: Thread delayed
                                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                                Source: C:\Windows\SysWOW64\rundll32.exeLast function: Thread delayed
                                Source: C:\Windows\SysWOW64\rundll32.exeLast function: Thread delayed
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeLast function: Thread delayed
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeLast function: Thread delayed
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeLast function: Thread delayed
                                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeLast function: Thread delayed
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeLast function: Thread delayed
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeLast function: Thread delayed
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_002466F0 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,7_2_002466F0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0023FE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,7_2_0023FE80
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001F3EC0 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,7_2_001F3EC0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00191F9C FindClose,FindFirstFileExW,GetLastError,7_2_00191F9C
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00225F80 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,7_2_00225F80
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00192022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,7_2_00192022
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001F3850 FindFirstFileA,FindNextFileA,GetLastError,FindClose,7_2_001F3850
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_00FD78B0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,2_2_00FD78B0
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeThread delayed: delay time: 30000Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeThread delayed: delay time: 180000Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeThread delayed: delay time: 30000Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeThread delayed: delay time: 30000
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeThread delayed: delay time: 180000
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeThread delayed: delay time: 922337203685477
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeThread delayed: delay time: 922337203685477
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 922337203685477
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 600000
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 599790
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 599665
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 599393
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 599086
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 598959
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 300000
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 598668
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 598313
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 598000
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 597750
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 597532
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 596922
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 596391
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 595943
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 595625
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 595360
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 595032
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 594407
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 593844
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 593344
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 592735
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 592079
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 591585
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 590814
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 590313
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 589150
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 588679
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 588206
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 584814
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 584064
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 583315
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 582569
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 582066
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 581187
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 580173
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 579790
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 579252
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 577907
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 577283
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 576486
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 576048
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 574939
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 574283
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 573283
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 572830
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 572204
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 564345
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 560846
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 559627
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 558939
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 558064
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 557424
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 556814
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 555877
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 555049
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 554471
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 552846
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 551923
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 551188
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 549986
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 549303
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 548722
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 547329
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 546045
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 545579
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 545048
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 544408
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 543658
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 543236
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 542673
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 542251
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 541751
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 540689
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 540079
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 539658
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 538814
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 538345
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 537392
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 536564
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 535907
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 535486
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 535048
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 534126
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 533642
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 533392
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 533142
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 532861
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 532408
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 531861
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 531564
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 531173
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 530751
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 530501
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 530017
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 529236
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 528759
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 528361
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 527923
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 527080
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 526658
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 526236
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 525861
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 525330
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 525017
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 524533
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 524173
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 523689
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 523220
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 522376
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 522033
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 520814
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 519788
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 519189
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 518829
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 518368
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 517705
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 517361
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 517014
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 516736
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 516251
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 515876
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 515080
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 514611
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 514095
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 513595
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 512142
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 511423
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 511017
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 510314
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 510008
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 509517
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 509126
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 508736
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 508298
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 507845
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 507501
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 507033
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 506626
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 506343
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 505908
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 504439
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 503939
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 503205
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 502548
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 501985
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 501267
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 499798
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 499158
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 498727
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 497658
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 497095
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 496595
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 495658
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 495001
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 494455
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 493939
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 493533
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 492798
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 492236
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 491861
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 491501
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 491189
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 490673
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 490329
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 490109
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 489670
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 488720
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 488298
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 487908
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 486642
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 484626
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 482439
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 480626
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 478642
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 477908
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 476298
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 475782
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 475220
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 474501
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 473861
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 473314
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 472848
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 470533
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 469017
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 468283
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 466986
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 463876
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 462830
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 458970
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 457986
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 457345
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 456888
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 456173
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 455658
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 455080
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 454579
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 454048
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 453595
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 453283
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 452986
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 452189
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 451908
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 451517
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 451064
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 450783
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 450455
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 449829
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 449411
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 448626
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 448095
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 447811
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 447439
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 446814
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 446486
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 446220
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 445783
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 445486
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 445189
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeThread delayed: delay time: 922337203685477
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: C:\Users\user\AppDataJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: C:\Users\userJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: C:\Users\user\Documents\desktop.iniJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
                                Source: RageMP131.exe, 00000030.00000002.3134429233.0000000005A06000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_4D80BF8A
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696487552}
                                Source: MPGPH131.exe, 00000014.00000003.2820152073.0000000005C2D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2820638469.0000000005C2D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2819486328.0000000005C2D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3127253259.0000000005C2D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2819877346.0000000005C2D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: lXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADM
                                Source: MPGPH131.exe, 00000013.00000003.2843661605.0000000006035000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUuj
                                Source: RageMP131.exe, 00000030.00000003.2791013895.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2788181386.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2792650227.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW2*
                                Source: aea7caadbf.exe, 00000007.00000003.2831123140.00000000058C2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nteractive Brokers - HKVMware20,11696487552]
                                Source: 2c9ff67496.exe, 0000000B.00000003.3969608174.00000000038D4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696487552t
                                Source: aea7caadbf.exe, 00000021.00000002.3117284660.00000000010C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW8i
                                Source: RegAsm.exe, 0000002F.00000002.2455354430.00000000014F0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBn
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696487552
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
                                Source: RegAsm.exe, 00000019.00000002.2402948638.000000000141B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWl
                                Source: MPGPH131.exe, 00000014.00000002.3124637144.000000000147B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Local\Temp\9ac011e0-5a83-469e-a698-55282c006efc.tmp
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696487552o
                                Source: explorha.exe, 00000008.00000002.4621717301.0000000000C70000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000002.2953499946.00000000013ED000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
                                Source: amert.exe, 00000006.00000003.2192470141.0000000000DBF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\!
                                Source: aea7caadbf.exe, 00000021.00000002.3118907177.0000000005D30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}ks
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696487552| UE
                                Source: netsh.exe, 0000001B.00000003.2305479100.0000022A9AC75000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQQ
                                Source: RageMP131.exe, 00000030.00000002.3131365441.0000000001080000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
                                Source: MPGPH131.exe, 00000013.00000002.2957184812.0000000005BEF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_4D80BF8A9uNEl
                                Source: aea7caadbf.exe, 00000007.00000003.2831123140.00000000058C2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rs.comVMware20,11696487552
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696487552
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
                                Source: RageMP131.exe, 00000030.00000002.3134429233.0000000005A06000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_4D80BF8A I
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
                                Source: aea7caadbf.exe, 00000007.00000003.2831123140.00000000058C2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nara Change Transaction PasswordVMware20,11696487552^
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696487552]
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552
                                Source: amert.exe, amert.exe, 00000006.00000002.2239077402.000000000102A000.00000040.00000001.01000000.00000009.sdmp, explorha.exe, 00000008.00000002.4578788023.00000000002CA000.00000040.00000001.01000000.0000000B.sdmp, explorha.exe, 00000009.00000002.2286142731.00000000002CA000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
                                Source: rundll32.exe, 00000017.00000002.4575050800.000002161D690000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@]m
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696487552| UE
                                Source: RageMP131.exe, 00000030.00000002.3131365441.000000000108A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
                                Source: MPGPH131.exe, 00000014.00000003.2290450601.0000000001447000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_
                                Source: aea7caadbf.exe, 00000021.00000003.2806627544.0000000005C48000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gs":{"sent_samples_count":0,"unsent_persisted_size_in_kb":0,"unsent_samples_count":0},"ongoing_logs":{"sent_samples_count":0,"unsent_persisted_size_in_kb":0,"unsent_samples_count":0}}},"variations_compressed_seed":"H4sIAAAAAAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02Ohsoxy
                                Source: RageMP131.exe, 00000030.00000002.3131365441.000000000108C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696487552x
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696487552x
                                Source: aea7caadbf.exe, 00000007.00000003.2831123140.00000000058C2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,116
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696487552d
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696487552s
                                Source: RageMP131.exe, 00000030.00000002.3134429233.0000000005A06000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Local\Temp\5567ef92-dbe9-4ad2-9045-8f930e3d7ed6.tmp
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696487552d
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696487552]
                                Source: explorta.exe, 0000002C.00000002.2755047302.0000000001868000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__q
                                Source: aea7caadbf.exe, 00000021.00000003.2808145085.0000000005C4E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}XNTV0SCJuN1GCyDeTsccFPeu9+DtRuOIzpuPOHMWFCH4SYrrhIIF+VmRVSkbN671zwLeLYomOj6BxuG4WR0H8+Rivo4a5BAWT1bV5dHpshkYrOka+p8vn3VPA9qlgL8Tk27kWvHNRJXPl7UkYvCoDMNFU/36++C/jG6pgvhw/J6+PCmsW1ynBiLNzuR9AXJKT6RtkzVJ5JXS6W4LXIi22NeLtP7Ikk+0n7QDGjovSf2FNmrxFItlk5hpx/2HxYs7bUXx8wlhYhOe6vmYTYhwDGkC95TfsGbkuhMXPDu24Tk7yZ0vkv8IwoJIe02kWQ6IIm9jZj5kyhHMSGTfMV1KramijuIQ61Lh4JuwhDKy5sdv4lPBppbXLx9SLeTS6Kn4usBfnhOPZZ7l5cpc73VFZYd77s7LnUzNMXxxIpimnULqgLSaHyIqzMQjKsPItp3JQyx5CerGBHz+72bou4eRv4TJR7md171SZI7d8swF+mIEVAJCa+4QbnpduN+YKaqd+XlImpqvGTlKejMnbf5C3VoY6JqyIprHM127oDjSKid9WWwYkCjOIWoJ9cPNs1rEHZ7g0TIw+CKfhqUxdWSSZy1s0xEmvRteTep7wHsWEq3bric1I0yUTA1xPBeKNpfYj0KIFBfGvzhZMFqKcVarTu4qW7iA/0/ou6h8oRON7pvR/Drqz1sh2V/nTyeLJBoScoTC2kP+Z5joN7z4enaTfObIPJ73aAl7nk82ybN7HgXREVh9sTgLim/ZFJ5ILI8FVqHlTjEcHZYzg3iLhWWXwtL8duCV9PO06EahABTLaH/dJMlgRfEm+xqei1EiLMQRE1A3wjzPysQesfpyIP7QZIIOwr8Fac1720ciptOJHnqRhOYMUatUHgvBfyvSdxZFncyCHH8s5lxNPR9Ckhzt/OyLoXmbZmd7lnu+m7uljsgn0XpsdfOO+Hb6A8sp3Lny7Crg5eEH7FkVTGHF1dB5sUfLHUBgegCLm9az5mP4IHm53G3d6FaRVSjxbt/cmY1A4yoMWgbu753WBLmKf7XoP0a3ATliu2meo4ycXIQcFDZxSBsE/n8lIc9Rjs7JH9hU+UalUXvLlk3QUNIdExIuU0zLb9VKS5YYAUp8v1L58qp6JEfI2T1GH8BNpLTSa1mvlaKprJUJIpnWr30WVhfG1wRno7Ou3cF2tpP3xF2pkOU5vy86XhhyxlqE9HTLQYUMojgV8q9ODzUXLbxWzK/ZKI3rkrIGFkZmRdr0WffmX91WbitQH63DCEnQ3rutG1DBIXV73QYXkiqmMW8Vu+F6IYaFLPFibpYCvWdqa5euzm4wASrFl7hx59wixe916VrWor7/LR1RwbfRM3ZDHiA9d+r6uLhAvkHE/7GY8XhfjaF3eiso7gDvw56tlyKHcJ9locNvwwauttSLO9tH2h4ABpfxVeWp5cNhRjml3ecGiVDs4vikm7dU4OOrv4FdDu3621TEC0ZAvx3cJzKlwVHqcJLgEQoOC9dwoKN8VJSL1Uo6cd8X/oURNbmKMNyh3jqv8o3J29EtLi4ZBGlmf8ljmlqYy97XCx4/+XmHd8a7VK/ZK+ox1GWo1ve2zhapCJZntBNUx2+Ab5E8v7CAFVcOpXvV+AAAxe3TeLs943LDxb4iTGvD6fIRB4J6ZR6jI+EPw959sgDkaVvANG7Nr72KQ8LuBIgyQfqf+m+iHiUj4SLub8eUbGXr45sj5eH6SVxU0CxrdR34NEWUjCII5KmpCckr5zRxXbaffxgnZdm2vKKO081W1smR0p8/nOBzQ8DI3feQCIChRSRIOORV9wT6RphUcA0b4nNYsG/2swVxRBK8YOLh3g0m
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
                                Source: jok.exe, 00000020.00000002.4626441113.0000000002D8E000.00000004.00000800.00020000.00000000.sdmp, jok.exe, 00000020.00000002.4626441113.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, jok.exe, 00000020.00000002.4626441113.0000000002C93000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbLR
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696487552
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696487552
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552x
                                Source: amert.exe, 00000006.00000002.2239077402.000000000102A000.00000040.00000001.01000000.00000009.sdmp, explorha.exe, 00000008.00000002.4578788023.00000000002CA000.00000040.00000001.01000000.0000000B.sdmp, explorha.exe, 00000009.00000002.2286142731.00000000002CA000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
                                Source: aea7caadbf.exe, 00000007.00000003.2846166620.00000000058AB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000al\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsL,
                                Source: MPGPH131.exe, 00000013.00000003.2844575612.000000000602B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}-1028231-15-52,P-X-1087217-10-23,P-X-1110552-2-3,P-X-1108288-1-7,P-X-1100779-2-7,P-X-1092122-2-9,P-X-1096650-2-6,P-X-1105131-2-6,P-X-1097232-7-13,P-X-1104872-1-9,P-X-1103964-2-3,P-X-1099080-1-9,P-X-1089758-2-11,P-X-1102990-2-3,P-X-1102008-2-7,P-X-1063575-3-11,P-X-1102153-2-4,P-X-1071006-1-5,P-X-1100769-1-3,P-X-1099659-1-3,P-X-1095668-2-7,P-X-1097226-1-5,P-X-1083898-4-17,P-X-1095524-1-3,P-X-1063514-2-6,P-X-1094047-1-6,P-X-1092821-2-3,P-X-1092738-2-3,P-X-1092158-1-3,P-X-1068889-5-13,P-X-1086546-21-84,P-X-1091091-2-4,P-X-1089774-2-7,P-X-1089256-2-5,P-X-1089119-2-6,P-X-1013679-2-5,P-X-1087661-2-6,P-X-1085156-1-3,P-X-1082985-5-11,P-X-1082074-3-7,P-X-1047521-4-21,P-X-1080712-1-5,P-X-1079473-2-6,P-X-1048662-1-13,P-X-1077532-1-5,P-X-1077147-1-9,P-X-1056699-36-118,P-X-1067018-2-4,P-X-1043380-1-18,P-X-1071593-2-4,P-X-1070560-4-8,P-X-1070133-1-6,P-X-1070026-3-7,P-X-1056537-1-9,P-X-1067718-1-3,P-X-1066229-1-7,P-X-1050101-1-9,P-X-1061902-3-17,P-X-1053062-1-5,P-X-1058142-1-7,P-X-1059966-1-9,P-X-1052772-23-44,P-X-1043219-25-50,P-X-1054089-1-3,P-X-1052254-4-10,P-X-1021723-3-16,P-X-1048870-3-8,P-X-1048071-1-5,P-X-1047513-1-5,P-X-1026324-3-20,P-X-1010579-1-9,P-X-1008556-23-99,P-X-1037615-1-7,P-X-1006190-9-15,P-X-1036081-1-3,P-X-1027402-7-15,P-X-1020537-2-6,P-X-1012411-2-9,P-X-100876-37-228,P-X-117040-1-5,P-X-113035-2-9,P-X-97954-9-89,P-X-91270-7-51,P-R-1089873-14-4,P-R-1080087-6-13,P-R-1075857-18-21,P-R-1068861-4-10,P-R-1047495-8-15,P-R-1044077-26-18,P-R-1008497-12-13,P-R-87486-2-16,P-R-86300-4-56,P-R-83096-12-34,P-R-67067-6-47,gb1ee141:447804,3j0gg466:431877,resetbing:447060,c1i80862:426410,wponsat2_50:441048,jj2e6986:422781,995h3546:443806,9djb2419:437170,bfcg7827:432826,t9qranimationemailautofill:439591,70030996:441561,ebd3g171:445684,tp-long:439700,b01ji385:438026,i1g2g604:437359,9ffeg962:402950,e37a0582:438880,bingchatqueries_5_impression_with_redirect_urls:403574,3da3b319:434919,d68dd294:435290,web-select-unship:450753,8j079527:448887,i2e7g608:426901,6h1eh131:441212,e92c6808:416905,10ad8400:434605,9d4ca945:415901,identifydb:415105,walletpswlinkupdate:438029,ijd96734:409016,1c484819:413463,0188i430:410947,74g97287:426089,3cej0868:387697,bi4f4994:450434,j4d0f649:415920,be37a759:398467,9cc60973:411866,downarrowscrollwithtriggernew:379502,nonfloatingwithouttoggle:430356,f7bdg612:421301,d78jg254:440485,60a06606:446395,e8455899:433611,ed254cf:256436,a5g3j174:427088,domexpansion_v1:408272,sidepanecashbackclickv1:392715,ed429:371711,savingsyesui:360239,0iie5378:378326,j3jdi477:407165,g9744299:382390,0ce12802:395899,ed0317:378541,d699f664:417781,v1_newnotificationsettingsu:371743,13gjf650:361709,2chfa640:363442,edse218:361564,i5ceh755:348150,pcproductbyregexenus:345020,2ae48381:440529,i4d2e897:416850,0cdi8526:390116,158hf900:358403,edpas404:384675,followablewebwpo:339322,1ebea465:393468,72dhd990:347218,b5691989:400307,v11_aocgroups2and3:393492,d8ej1711:320853,edtok960
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552}
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
                                Source: RageMP131.exe, 00000030.00000003.2822300520.0000000005A4C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}collectionv1:285601,edklo447:358232,designershoreline-215:384841,edweb468:191638,ed672:193569,linkui:417512,ededg840:189491","EdgeConfig":"P-R-1141099-1-3,P-R-1136586-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1132367-1-7,P-R-1132544-1-6,P-R-1132175-1-3,P-R-1130507-1-5,P-R-1113531-4-9,P-R-1108562-1-7,P-R-1103742-4-6,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1095721-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-25,P-R-1080066-1-13,P-R-1077170-1-3,P-R-1060324-1-5,P-R-1052391-1-8,P-R-1039913-1-16,P-R-1036635-2-5,P-R-110491-23-70,P-R-68474-9-12,P-R-61206-14-17,P-R-61153-10-15,P-R-45373-8-85,P-R-46265-41-100","EdgeDomainActions":"P-R-1093245-1-12,P-R-1037936-1-9,P-R-1024693-1-9,P-R-108604-1-34,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-463,P-D-1138318-1-3,P-D-98331-6-31","EdgeFirstRun":"P-R-1103650-18-8,P-R-1021718-2-31,P-R-116827-1-15","EdgeFirstRunConfig":"P-R-1075865-1-7","Segmentation":"P-R-1113915-25-8,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-1-3,P-R-42744-1-2"}96-12-34,P
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552x
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696487552f
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696487552j
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696487552u
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696487552}
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552}
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696487552
                                Source: explorta.exe, 00000002.00000002.4589350907.0000000001A61000.00000004.00000020.00020000.00000000.sdmp, explorta.exe, 00000002.00000002.4589350907.0000000001A15000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2675850557.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000002.3093234156.000000000108B000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000002.3093234156.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000002.2953499946.0000000001420000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3124637144.0000000001435000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3124637144.000000000147B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2694069291.000000000147B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696487552o
                                Source: RageMP131.exe, 00000030.00000002.3134429233.0000000005A41000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVCh
                                Source: RageMP131.exe, 00000030.00000003.2463397355.0000000001092000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696487552
                                Source: RageMP131.exe, 00000030.00000002.3134429233.0000000005A06000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Local\Microsoft\Windows\Explorer\thumbcache_256.db{
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696487552t
                                Source: aea7caadbf.exe, 00000007.00000002.3094761202.0000000005890000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}User Data\jhfjfclepacoldmjmkmdlmganfaalklb\CURRENTy
                                Source: aea7caadbf.exe, 00000007.00000003.2842683229.00000000059F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,116
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696487552
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696487552
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696487552j
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696487552
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696487552x
                                Source: MPGPH131.exe, 00000014.00000002.3124637144.00000000013E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_4D80BF8Aec
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696487552
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696487552
                                Source: aea7caadbf.exe, 00000021.00000003.2808145085.0000000005C4E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: hlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsu
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696487552h
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696487552h
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696487552t
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696487552f
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareVMware
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
                                Source: MPGPH131.exe, 00000014.00000002.3124637144.0000000001435000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&}
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696487552u
                                Source: MPGPH131.exe, 00000013.00000002.2953499946.0000000001420000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}User Data\Default\Local Storage\leveldb\000003.log
                                Source: MPGPH131.exe, 00000013.00000002.2953499946.00000000013ED000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&1
                                Source: aea7caadbf.exe, 00000007.00000003.2831123140.00000000058C2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: omVMware20,11696487552| UE
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
                                Source: RegAsm.exe, 00000029.00000002.3096645849.0000000001689000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWdY
                                Source: MPGPH131.exe, 00000013.00000002.2953499946.0000000001420000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Local\Google\Chrome\User Data\Default\Visited Links
                                Source: file300un.exe, 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                                Source: jok.exe, 00000020.00000002.4971718774.00000000061F6000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4106241586.0000000000E9C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                                Source: 2c9ff67496.exe, 0000000B.00000003.3969608174.00000000038D4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                                Source: aea7caadbf.exe, 00000021.00000002.3117284660.0000000001104000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}User Data\Default\Local Storage\leveldb\000003.log}'"*
                                Source: aea7caadbf.exe, 00000021.00000002.3118681563.0000000005C4E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}XNTV0SCJuN1GCyDeTsccFPeu9+DtRuOIzpuPOHMWFCH4SYrrhIIF+VmRVSkbN671zwLeLYomOj6BxuG4WR0H8+Rivo4a5BAWT1bV5dHpshkYrOka+p8vn3VPA9qlgL8Tk27kWvHNRJXPl7UkYvCoDMNFU/36++C/jG6pgvhw/J6+PCmsW1ynBiLNzuR9AXJKT6RtkzVJ5JXS6W4LXIi22NeLtP7Ikk+0n7QDGjovSf2FNmrxFItlk5hpx/2HxYs7bUXx8wlhYhOe6vmYTYhwDGkC95TfsGbkuhMXPDu24Tk7yZ0vkv8IwoJIe02kWQ6IIm9jZj5kyhHMSGTfMV1KramijuIQ61Lh4JuwhDKy5sdv4lPBppbXLx9SLeTS6Kn4usBfnhOPZZ7l5cpc73VFZYd77s7LnUzNMXxxIpimnULqgLSaHyIqzMQjKsPItp3JQyx5CerGBHz+72bou4eRv4TJR7md171SZI7d8swF+mIEVAJCa+4QbnpduN+YKaqd+XlImpqvGTlKejMnbf5C3VoY6JqyIprHM127oDjSKid9WWwYkCjOIWoJ9cPNs1rEHZ7g0TIw+CKfhqUxdWSSZy1s0xEmvRteTep7wHsWEq3bric1I0yUTA1xPBeKNpfYj0KIFBfGvzhZMFqKcVarTu4qW7iA/0/ou6h8oRON7pvR/Drqz1sh2V/nTyeLJBoScoTC2kP+Z5joN7z4enaTfObIPJ73aAl7nk82ybN7HgXREVh9sTgLim/ZFJ5ILI8FVqHlTjEcHZYzg3iLhWWXwtL8duCV9PO06EahABTLaH/dJMlgRfEm+xqei1EiLMQRE1A3wjzPysQesfpyIP7QZIIOwr8Fac1720ciptOJHnqRhOYMUatUHgvBfyvSdxZFncyCHH8s5lxNPR9Ckhzt/OyLoXmbZmd7lnu+m7uljsgn0XpsdfOO+Hb6A8sp3Lny7Crg5eEH7FkVTGHF1dB5sUfLHUBgegCLm9az5mP4IHm53G3d6FaRVSjxbt/cmY1A4yoMWgbu753WBLmKf7XoP0a3ATliu2meo4ycXIQcFDZxSBsE/n8lIc9Rjs7JH9hU+UalUXvLlk3QUNIdExIuU0zLb9VKS5YYAUp8v1L58qp6JEfI2T1GH8BNpLTSa1mvlaKprJUJIpnWr30WVhfG1wRno7Ou3cF2tpP3xF2pkOU5vy86XhhyxlqE9HTLQYUMojgV8q9ODzUXLbxWzK/ZKI3rkrIGFkZmRdr0WffmX91WbitQH63DCEnQ3rutG1DBIXV73QYXkiqmMW8Vu+F6IYaFLPFibpYCvWdqa5euzm4wASrFl7hx59wixe916VrWor7/LR1RwbfRM3ZDHiA9d+r6uLhAvkHE/7GY8XhfjaF3eiso7gDvw56tlyKHcJ9locNvwwauttSLO9tH2h4ABpfxVeWp5cNhRjml3ecGiVDs4vikm7dU4OOrv4FdDu3621TEC0ZAvx3cJzKlwVHqcJLgEQoOC9dwoKN8VJSL1Uo6cd8X/oURNbmKMNyh3jqv8o3J29EtLi4ZBGlmf8ljmlqYy97XCx4/+XmHd8a7VK/ZK+ox1GWo1ve2zhapCJZntBNUx2+Ab5E8v7CAFVcOpXvV+AAAxe3TeLs943LDxb4iTGvD6fIRB4J6ZR6jI+EPw959sgDkaVvANG7Nr72KQ8LuBIgyQfqf+m+iHiUj4SLub8eUbGXr45sj5eH6SVxU0CxrdR34NEWUjCII5KmpCckr5zRxXbaffxgnZdm2vKKO081W1smR0p8/nOBzQ8DI3feQCIChRSRIOORV9wT6RphUcA0b4nNYsG/2swVxRBK8YOLh3g0mL
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
                                Source: amert.exe, 00000006.00000003.2192470141.0000000000DBF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\*h
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
                                Source: MPGPH131.exe, 00000014.00000002.3124637144.000000000147B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}User Data\Default\Local Storage\leveldb\000003.logxh
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696487552s
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696487552
                                Source: RageMP131.exe, 00000030.00000003.2821833886.00000000065C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696487552t
                                Source: aea7caadbf.exe, 00000007.00000003.2675850557.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000002.3093234156.00000000010C3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWL
                                Source: jok.exe, 00000020.00000002.4795957308.0000000003C6B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696487552x
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeSystem information queried: ModuleInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeProcess information queried: ProcessInformationJump to behavior

                                Anti Debugging

                                barindex
                                Hides threads from debuggers
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeThread information set: HideFromDebuggerJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeThread information set: HideFromDebugger
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeThread information set: HideFromDebugger
                                Tries to detect sandboxes and other dynamic analysis tools (window names)
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeOpen window title or class name: regmonclass
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeOpen window title or class name: gbdyllo
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeOpen window title or class name: procmon_window_class
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeOpen window title or class name: ollydbg
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeOpen window title or class name: filemonclass
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile opened: NTICE
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile opened: SICE
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeFile opened: SIWVID
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeProcess queried: DebugPortJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeProcess queried: DebugPortJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeProcess queried: DebugPortJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeProcess queried: DebugPortJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeProcess queried: DebugPortJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess queried: DebugPort
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPort
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPort
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPort
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeCode function: 6_2_05170B9D rdtsc 6_2_05170B9D
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_0100628E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_0100628E
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0022F200 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,7_2_0022F200
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_01005D0B mov eax, dword ptr fs:[00000030h]2_2_01005D0B
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_01009A72 mov eax, dword ptr fs:[00000030h]2_2_01009A72
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00226D00 mov eax, dword ptr fs:[00000030h]7_2_00226D00
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_001F3EC0 mov eax, dword ptr fs:[00000030h]7_2_001F3EC0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_002499F0 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree,7_2_002499F0
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeProcess token adjusted: Debug
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess token adjusted: Debug
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_00FEC9CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00FEC9CC
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_0100628E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_0100628E
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0019451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_0019451D
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_00198A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_00198A64
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeMemory allocated: page read and write | page guard

                                HIPS / PFW / Operating System Protection Evasion

                                barindex
                                .NET source code references suspicious native API functions
                                Source: swiiiii[1].exe.8.dr, Angelo.csReference to suspicious API methods: Program.GetProcAddress(Program.GetModuleHandle(aScsrhgtr), "FreeConsole")
                                Source: swiiiii[1].exe.8.dr, Angelo.csReference to suspicious API methods: Program.GetProcAddress(Program.GetModuleHandle(aScsrhgtr), "VirtualProtectEx")
                                Source: swiy[1].exe.8.dr, Angelo.csReference to suspicious API methods: Program.CreateRemoteThread(uint.MaxValue, 0u, 0u, ref Eugene.SuperBook[num], RemoteObjects.userBuffer, 0, ref WPA)
                                Adds a directory exclusion to Windows Defender
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force
                                Allocates memory in foreign processes
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write
                                Source: C:\Users\user\AppData\Local\Temp\1000079001\gold.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
                                Contains functionality to inject code into remote processes
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_00FD6A70 std::_Xinvalid_argument,GetModuleFileNameA,CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,2_2_00FD6A70
                                Contains functionality to inject threads in other processes
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0022F200 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,7_2_0022F200
                                Injects a PE file into a foreign processes
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
                                Source: C:\Users\user\AppData\Local\Temp\1000079001\gold.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
                                LummaC encrypted strings found
                                Source: swiiiii.exe, 00000016.00000002.2638210902.0000000004045000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: pillowbrocccolipe.shop
                                Source: swiiiii.exe, 00000016.00000002.2638210902.0000000004045000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: communicationgenerwo.shop
                                Source: swiiiii.exe, 00000016.00000002.2638210902.0000000004045000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: diskretainvigorousiw.shop
                                Source: swiiiii.exe, 00000016.00000002.2638210902.0000000004045000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: affordcharmcropwo.shop
                                Source: swiiiii.exe, 00000016.00000002.2638210902.0000000004045000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: dismissalcylinderhostw.shop
                                Source: swiiiii.exe, 00000016.00000002.2638210902.0000000004045000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: enthusiasimtitleow.shop
                                Source: swiiiii.exe, 00000016.00000002.2638210902.0000000004045000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: worryfillvolcawoi.shop
                                Source: swiiiii.exe, 00000016.00000002.2638210902.0000000004045000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: cleartotalfisherwo.shop
                                Source: gold.exe, 0000002D.00000002.2412290927.000000000066D000.00000004.00000001.01000000.0000001A.sdmpString found in binary or memory: boredimperissvieos.shop
                                Source: gold.exe, 0000002D.00000002.2412290927.000000000066D000.00000004.00000001.01000000.0000001A.sdmpString found in binary or memory: holicisticscrarws.shop
                                Source: gold.exe, 0000002D.00000002.2412290927.000000000066D000.00000004.00000001.01000000.0000001A.sdmpString found in binary or memory: sweetsquarediaslw.shop
                                Source: gold.exe, 0000002D.00000002.2412290927.000000000066D000.00000004.00000001.01000000.0000001A.sdmpString found in binary or memory: plaintediousidowsko.shop
                                Source: gold.exe, 0000002D.00000002.2412290927.000000000066D000.00000004.00000001.01000000.0000001A.sdmpString found in binary or memory: miniaturefinerninewjs.shop
                                Source: gold.exe, 0000002D.00000002.2412290927.000000000066D000.00000004.00000001.01000000.0000001A.sdmpString found in binary or memory: zippyfinickysofwps.shop
                                Source: gold.exe, 0000002D.00000002.2412290927.000000000066D000.00000004.00000001.01000000.0000001A.sdmpString found in binary or memory: obsceneclassyjuwks.shop
                                Source: gold.exe, 0000002D.00000002.2412290927.000000000066D000.00000004.00000001.01000000.0000001A.sdmpString found in binary or memory: acceptabledcooeprs.shop
                                Writes to foreign memory regions
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 439000
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 447000
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: FC5008
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41B000
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 423000
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 636000
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1133008
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 404000
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 406000
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: AF9008
                                Source: C:\Users\user\AppData\Local\Temp\1000079001\gold.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
                                Source: C:\Users\user\AppData\Local\Temp\1000079001\gold.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
                                Source: C:\Users\user\AppData\Local\Temp\1000079001\gold.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000
                                Source: C:\Users\user\AppData\Local\Temp\1000079001\gold.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 443000
                                Source: C:\Users\user\AppData\Local\Temp\1000079001\gold.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 457000
                                Source: C:\Users\user\AppData\Local\Temp\1000079001\gold.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 11CF008
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_00FD6E30 ShellExecuteA,Sleep,Sleep,__Init_thread_footer,CreateThread,Sleep,2_2_00FD6E30
                                Source: C:\Users\user\Desktop\fjL0EcgV6Y.exeProcess created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe" Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess created: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe "C:\Users\user\AppData\Local\Temp\1000019001\amert.exe" Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess created: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe "C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe" Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeProcess created: C:\Users\user\1000021002\2c9ff67496.exe "C:\Users\user\1000021002\2c9ff67496.exe" Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exeProcess created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe" Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe "C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe"
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe "C:\Users\user\AppData\Local\Temp\1000071001\jok.exe"
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe "C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe"
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe"
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: C:\Users\user\AppData\Local\Temp\1000079001\gold.exe "C:\Users\user\AppData\Local\Temp\1000079001\gold.exe"
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: unknown unknown
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: unknown unknown
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeProcess created: unknown unknown
                                Source: C:\Users\user\1000021002\2c9ff67496.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profiles
                                Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                Source: C:\Users\user\AppData\Local\Temp\1000079001\gold.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeProcess created: unknown unknown
                                Source: 2c9ff67496.exe, 0000000B.00000000.2237972193.00000000007D2000.00000002.00000001.01000000.0000000C.sdmp, 2c9ff67496.exe.2.drBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
                                Source: amert.exe, amert.exe, 00000006.00000002.2239077402.000000000102A000.00000040.00000001.01000000.00000009.sdmp, explorha.exe, 00000008.00000002.4578788023.00000000002CA000.00000040.00000001.01000000.0000000B.sdmp, explorha.exe, 00000009.00000002.2286142731.00000000002CA000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: Program Manager
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_00FECBC7 cpuid 2_2_00FECBC7
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,7_2_0023FE80
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: EnumSystemLocalesW,7_2_001AB1B1
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: GetLocaleInfoW,7_2_001B31CA
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,7_2_001B32F3
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: GetLocaleInfoW,7_2_001B33F9
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,7_2_001B34CF
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: GetLocaleInfoW,7_2_001AB734
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: GetACP,IsValidCodePage,GetLocaleInfoW,7_2_001B2B5A
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: GetLocaleInfoW,7_2_001B2D5F
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: EnumSystemLocalesW,7_2_001B2E06
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: EnumSystemLocalesW,7_2_001B2E51
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: EnumSystemLocalesW,7_2_001B2EEC
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,7_2_001B2F77
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeQueries volume information: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe VolumeInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe VolumeInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe VolumeInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe VolumeInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe VolumeInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeQueries volume information: C:\Users\user\1000021002\2c9ff67496.exe VolumeInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeQueries volume information: C:\Users\user\1000021002\2c9ff67496.exe VolumeInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000079001\gold.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000079001\gold.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000080001\alexxxxxxxx.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000080001\alexxxxxxxx.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000081001\install.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000081001\install.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000088001\NewB.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000088001\NewB.exe VolumeInformation
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite VolumeInformation
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe VolumeInformation
                                Source: C:\Windows\System32\rundll32.exeQueries volume information: C:\Users\user\Desktop\IPKGELNTQY.xlsx VolumeInformation
                                Source: C:\Windows\System32\rundll32.exeQueries volume information: C:\Users\user\Desktop\MXPXCVPDVN.xlsx VolumeInformation
                                Source: C:\Windows\System32\rundll32.exeQueries volume information: C:\Users\user\Desktop\SQRKHNBNYN.docx VolumeInformation
                                Source: C:\Windows\System32\rundll32.exeQueries volume information: C:\Users\user\Desktop\SQRKHNBNYN.xlsx VolumeInformation
                                Source: C:\Windows\System32\rundll32.exeQueries volume information: C:\Users\user\Desktop\UOOJJOZIRH.docx VolumeInformation
                                Source: C:\Windows\System32\rundll32.exeQueries volume information: C:\Users\user\Desktop\VAMYDFPUND.docx VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\System32\netsh.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\lockfile VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeQueries volume information: C:\ VolumeInformation
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_0100ABF2 GetSystemTimeAsFileTime,2_2_0100ABF2
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_00FD6160 GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,2_2_00FD6160
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeCode function: 7_2_0023FE80 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,7_2_0023FE80
                                Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exeCode function: 2_2_00FD78B0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,2_2_00FD78B0
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                                Lowering of HIPS / PFW / Operating System Security Settings

                                barindex
                                Disables UAC (registry)
                                Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA
                                Uses netsh to modify the Windows network and firewall settings
                                Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profiles
                                Source: RegAsm.exe, 00000019.00000002.2403342364.000000000147D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

                                Stealing of Sensitive Information

                                barindex
                                Yara detected Amadeys Clipper DLL
                                Source: Yara matchFile source: 31.2.rundll32.exe.6be60000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\clip64[1].dll, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, type: DROPPED
                                Yara detected Amadeys stealer DLL
                                Source: Yara matchFile source: 31.2.rundll32.exe.6be60000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 8.2.explorha.exe.d0000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 6.2.amert.exe.e30000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 9.2.explorha.exe.d0000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 23.2.rundll32.exe.7ffd84eb0000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 2.2.explorta.exe.fd0000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 0.2.fjL0EcgV6Y.exe.db0000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 3.2.explorta.exe.fd0000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 44.2.explorta.exe.fd0000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 0000002C.00000002.2426954025.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000000.00000002.2083851627.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000003.00000002.2102606370.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000008.00000002.4574731193.00000000000D1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
                                Source: Yara matchFile source: 0000002C.00000003.2407964114.0000000001810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000017.00000002.4581588871.00007FFD84FAD000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
                                Source: Yara matchFile source: 0000001F.00000002.4578583730.000000006BE61000.00000020.00000001.01000000.00000014.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000008.00000003.2238783489.00000000048E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000006.00000002.2239011126.0000000000E31000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000000.00000003.2064758030.0000000003380000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000009.00000003.2245209175.0000000004860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000006.00000003.2177043340.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000002.00000003.2084843739.0000000001DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000009.00000002.2285975252.00000000000D1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000003.00000003.2091875914.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 7696, type: MEMORYSTR
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\clip64[1].dll, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\1000088001\NewB.exe, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\NewB[1].exe, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\cred64[1].dll, type: DROPPED
                                Yara detected LummaC Stealer
                                Source: Yara matchFile source: 00000019.00000002.2402948638.000000000141B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 7772, type: MEMORYSTR
                                Yara detected Mars stealer
                                Source: Yara matchFile source: 38.2.swiy.exe.3f65570.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 41.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 38.2.swiy.exe.3f65570.0.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 41.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 00000026.00000002.2353073715.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000029.00000002.3009103992.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                                Yara detected RedLine Stealer
                                Source: Yara matchFile source: 32.0.jok.exe.490000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 00000020.00000000.2311996086.0000000000492000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: jok.exe PID: 8040, type: MEMORYSTR
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\jok[1].exe, type: DROPPED
                                Yara detected RisePro Stealer
                                Source: Yara matchFile source: 00000007.00000002.3093234156.000000000103E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000030.00000002.3134429233.0000000005A06000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000013.00000002.2957184812.0000000005BC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000030.00000002.3134429233.00000000059F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000007.00000002.3094761202.0000000005890000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000021.00000002.3118681563.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000014.00000002.3127044186.0000000005C00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: aea7caadbf.exe PID: 5424, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: MPGPH131.exe PID: 5096, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: MPGPH131.exe PID: 7288, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: aea7caadbf.exe PID: 8100, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: RageMP131.exe PID: 7608, type: MEMORYSTR
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\FBI40obsDIWEYEPEV328oLc.zip, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\CaDLjLgaJOb2EJDbtX6Wfco.zip, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\rwhVS5Gl_u4JEiZA0FdJsuV.zip, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\bz4iHvznQtQ52p38FhmsRD6.zip, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\VuTSwQVdPxyUu9EXsE6w3ql.zip, type: DROPPED
                                Yara detected Stealc
                                Source: Yara matchFile source: 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3544, type: MEMORYSTR
                                Yara detected Vidar stealer
                                Source: Yara matchFile source: 38.2.swiy.exe.3f65570.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 41.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 38.2.swiy.exe.3f65570.0.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 41.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 00000026.00000002.2353073715.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000029.00000002.3009103992.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3544, type: MEMORYSTR
                                Found many strings related to Crypto-Wallets (likely being stolen)
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.000000000110F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: q4C:\Users\user\AppData\Roaming\Electrum\wallets\*
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx
                                Source: RegAsm.exe, 00000019.00000002.2402948638.000000000141B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: window-state.json
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\info.seco
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                                Source: aea7caadbf.exe, 00000007.00000002.3093234156.00000000010AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
                                Source: jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: q8C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco,>
                                Source: RegAsm.exe, 00000019.00000002.2402362277.00000000010F7000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: 5AWallets/ExodusAC:\Users\user\AppData\Roaming\Exodus\exodus.walletA%appdata%\Exodus\exodus.walletAkeystoreD
                                Source: aea7caadbf.exe, 00000007.00000002.3094761202.0000000005890000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live
                                Source: RegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
                                Tries to harvest and steal Bitcoin Wallet information
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
                                Tries to harvest and steal WLAN passwords
                                Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profiles
                                Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profiles
                                Tries to harvest and steal browser information (history, passwords, etc)
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\logins.json
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\formhistory.sqlite
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Local\Chedot\User Data\Default\Login Data
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Login Data
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\signons.sqlite
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\logins.json
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Local\Orbitum\User Data\Default\Login Data
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Login Data
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\key4.db
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\signons.sqlite
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Local\CocCoc\Browser\User Data\Default\Login Data
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Local\CentBrowser\User Data\Default\Login Data
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
                                Tries to harvest and steal ftp login credentials
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml
                                Tries to steal Crypto Currency Wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Binance
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Roaming\atomic\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Roaming\Binance\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\
                                Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\MultiDoge\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Binance\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Binance
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Binance
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
                                Tries to steal Instant Messenger accounts or passwords
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Windows\System32\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Windows\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Windows\SysWOW64\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Program Files (x86)\mUrODvZDsuNRBdTcXkdXtpnWOFAIBXFrVuRmIBrAF\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Local\Temp\5454e6f062\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Local\Temp\1000020001\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Local\Temp\09fd851a4f\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\1000021002\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Program Files\Google\Chrome\Application\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\ProgramData\MPGPH131\.purple\accounts.xml
                                Source: C:\Windows\System32\rundll32.exeFile opened: C:\Users\user\AppData\Local\Temp\1000066001\.purple\accounts.xml
                                Tries to steal Mail credentials (via file / registry access)
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                                Source: C:\ProgramData\MPGPH131\MPGPH131.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                                Source: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                                Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\BNAGMGSPLO
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\MXPXCVPDVN
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\SQRKHNBNYN
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\SUAVTZKNFL
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\VAMYDFPUND
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\BNAGMGSPLO
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\MXPXCVPDVN
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\NEBFQQYWPS
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\SQRKHNBNYN
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\VAMYDFPUND
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\NEBFQQYWPS
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\SUAVTZKNFL
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\NEBFQQYWPS
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\NEBFQQYWPS
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\SQRKHNBNYN
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\NEBFQQYWPS
                                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeDirectory queried: C:\Users\user\Documents\VAMYDFPUND
                                Source: Yara matchFile source: 00000007.00000002.3093234156.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000021.00000002.3118907177.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000030.00000002.3139553145.000000000654A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: aea7caadbf.exe PID: 5424, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: MPGPH131.exe PID: 5096, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: MPGPH131.exe PID: 7288, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 7696, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 7772, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: jok.exe PID: 8040, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: aea7caadbf.exe PID: 8100, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3544, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 6540, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: RageMP131.exe PID: 7608, type: MEMORYSTR

                                Remote Access Functionality

                                barindex
                                Yara detected LummaC Stealer
                                Source: Yara matchFile source: 00000019.00000002.2402948638.000000000141B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 7772, type: MEMORYSTR
                                Yara detected Mars stealer
                                Source: Yara matchFile source: 38.2.swiy.exe.3f65570.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 41.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 38.2.swiy.exe.3f65570.0.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 41.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 00000026.00000002.2353073715.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000029.00000002.3009103992.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                                Yara detected RedLine Stealer
                                Source: Yara matchFile source: 32.0.jok.exe.490000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 00000020.00000000.2311996086.0000000000492000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: jok.exe PID: 8040, type: MEMORYSTR
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\jok[1].exe, type: DROPPED
                                Yara detected RisePro Stealer
                                Source: Yara matchFile source: 00000007.00000002.3093234156.000000000103E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000030.00000002.3134429233.0000000005A06000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000013.00000002.2957184812.0000000005BC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000030.00000002.3134429233.00000000059F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000007.00000002.3094761202.0000000005890000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000021.00000002.3118681563.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000014.00000002.3127044186.0000000005C00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: aea7caadbf.exe PID: 5424, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: MPGPH131.exe PID: 5096, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: MPGPH131.exe PID: 7288, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: aea7caadbf.exe PID: 8100, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: RageMP131.exe PID: 7608, type: MEMORYSTR
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\FBI40obsDIWEYEPEV328oLc.zip, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\CaDLjLgaJOb2EJDbtX6Wfco.zip, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\rwhVS5Gl_u4JEiZA0FdJsuV.zip, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\bz4iHvznQtQ52p38FhmsRD6.zip, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\VuTSwQVdPxyUu9EXsE6w3ql.zip, type: DROPPED
                                Yara detected Stealc
                                Source: Yara matchFile source: 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3544, type: MEMORYSTR
                                Yara detected Vidar stealer
                                Source: Yara matchFile source: 38.2.swiy.exe.3f65570.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 41.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 38.2.swiy.exe.3f65570.0.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 41.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 00000026.00000002.2353073715.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000029.00000002.3009103992.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3544, type: MEMORYSTR

                                Mitre Att&ck Matrix

                                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                                Gather Victim Identity Information1
                                Scripting                                		Valid Accounts221
                                Windows Management Instrumentation                                		1
                                Scripting                                		1
                                Exploitation for Privilege Escalation                                		31
                                Disable or Modify Tools                                		2
                                OS Credential Dumping                                		2
                                System Time Discovery                                		Remote Services1
                                Archive Collected Data                                		1
                                Ingress Tool Transfer                                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                                CredentialsDomainsDefault Accounts12
                                Native API                                		1
                                DLL Side-Loading                                		1
                                DLL Side-Loading                                		11
                                Deobfuscate/Decode Files or Information                                		11
                                Input Capture                                		1
                                Account Discovery                                		Remote Desktop Protocol41
                                Data from Local System                                		2
                                Encrypted Channel                                		Exfiltration Over BluetoothNetwork Denial of Service
                                Email AddressesDNS ServerDomain Accounts2
                                Command and Scripting Interpreter                                		11
                                Scheduled Task/Job                                		512
                                Process Injection                                		3
                                Obfuscated Files or Information                                		1
                                Credentials in Registry                                		13
                                File and Directory Discovery                                		SMB/Windows Admin Shares1
                                Screen Capture                                		1
                                Application Layer Protocol                                		Automated ExfiltrationData Encrypted for Impact
                                Employee NamesVirtual Private ServerLocal Accounts11
                                Scheduled Task/Job                                		121
                                Registry Run Keys / Startup Folder                                		11
                                Scheduled Task/Job                                		1
                                Install Root Certificate                                		1
                                Credentials In Files                                		349
                                System Information Discovery                                		Distributed Component Object Model1
                                Email Collection                                		Protocol ImpersonationTraffic DuplicationData Destruction
                                Gather Victim Network InformationServerCloud Accounts1
                                PowerShell                                		Network Logon Script121
                                Registry Run Keys / Startup Folder                                		13
                                Software Packing                                		LSA Secrets1
                                Query Registry                                		SSH11
                                Input Capture                                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                                Timestomp                                		Cached Domain Credentials1191
                                Security Software Discovery                                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                                DLL Side-Loading                                		DCSync571
                                Virtualization/Sandbox Evasion                                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
                                Masquerading                                		Proc Filesystem3
                                Process Discovery                                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt571
                                Virtualization/Sandbox Evasion                                		/etc/passwd and /etc/shadow1
                                Application Window Discovery                                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                                IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron512
                                Process Injection                                		Network Sniffing1
                                System Owner/User Discovery                                		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                                Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
                                Rundll32                                		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

                                Behavior Graph

                                Hide Legend

                                Legend:

                                • Process
                                • Signature
                                • Created File
                                • DNS/IP Info
                                • Is Dropped
                                • Is Windows Process
                                • Number of created Registry Values
                                • Number of created Files
                                • Visual Basic
                                • Delphi
                                • Java
                                • .Net C# or VB.NET
                                • C, C++ or other language
                                • Is malicious
                                • Internet
                                behaviorgraph top1 signatures2 2 Behavior Graph ID: 1437711 Sample: fjL0EcgV6Y.exe Startdate: 07/05/2024 Architecture: WINDOWS Score: 100 167 Found malware configuration 2->167 169 Antivirus / Scanner detection for submitted sample 2->169 171 Sigma detected: Capture Wi-Fi password 2->171 173 25 other signatures 2->173 9 explorha.exe 8 2->9         started        14 fjL0EcgV6Y.exe 5 2->14         started        16 MPGPH131.exe 2->16         started        18 5 other processes 2->18 process3 dnsIp4 141 185.172.128.19 NADYMSS-ASRU Russian Federation 9->141 143 77.221.151.47 INFOBOX-ASInfoboxruAutonomousSystemRU Russian Federation 9->143 145 193.233.132.234 FREE-NET-ASFREEnetEU Russian Federation 9->145 101 C:\Users\user\AppData\Roaming\...\cred64.dll, PE32+ 9->101 dropped 103 C:\Users\user\AppData\Roaming\...\clip64.dll, PE32 9->103 dropped 105 C:\Users\user\AppData\Local\Temp\...105ewB.exe, PE32 9->105 dropped 117 17 other malicious files 9->117 dropped 237 Detected unpacking (changes PE section rights) 9->237 239 Tries to detect sandboxes and other dynamic analysis tools (window names) 9->239 241 Tries to evade debugger and weak emulator (self modifying code) 9->241 255 4 other signatures 9->255 20 file300un.exe 9->20         started        23 swiy.exe 9->23         started        25 swiiiii.exe 9->25         started        31 4 other processes 9->31 107 C:\Users\user\AppData\Local\...\explorta.exe, PE32 14->107 dropped 243 Query firmware table information (likely to detect VMs) 14->243 245 Tries to detect sandboxes / dynamic malware analysis system (registry check) 14->245 27 explorta.exe 2 23 14->27         started        109 C:\Users\user\...\VuTSwQVdPxyUu9EXsE6w3ql.zip, Zip 16->109 dropped 247 Multi AV Scanner detection for dropped file 16->247 249 Tries to steal Mail credentials (via file / registry access) 16->249 251 Machine Learning detection for dropped file 16->251 111 C:\Users\user\...\rwhVS5Gl_u4JEiZA0FdJsuV.zip, Zip 18->111 dropped 113 C:\Users\user\...\FBI40obsDIWEYEPEV328oLc.zip, Zip 18->113 dropped 115 C:\Users\user\...\CaDLjLgaJOb2EJDbtX6Wfco.zip, Zip 18->115 dropped 253 Tries to harvest and steal browser information (history, passwords, etc) 18->253 file5 signatures6 process7 dnsIp8 201 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 20->201 203 Writes to foreign memory regions 20->203 223 3 other signatures 20->223 33 InstallUtil.exe 20->33         started        44 3 other processes 20->44 205 Injects a PE file into a foreign processes 23->205 38 RegAsm.exe 23->38         started        46 2 other processes 23->46 207 LummaC encrypted strings found 25->207 48 3 other processes 25->48 157 193.233.132.56 FREE-NET-ASFREEnetEU Russian Federation 27->157 159 193.233.132.139 FREE-NET-ASFREEnetEU Russian Federation 27->159 119 C:\Users\user\AppData\...\aea7caadbf.exe, PE32 27->119 dropped 121 C:\Users\user\AppData\Local\...\amert.exe, PE32 27->121 dropped 123 C:\Users\user\AppData\Local\...\random[1].exe, PE32 27->123 dropped 125 4 other malicious files 27->125 dropped 209 Query firmware table information (likely to detect VMs) 27->209 211 Creates multiple autostart registry keys 27->211 213 Contains functionality to inject code into remote processes 27->213 215 Tries to detect sandboxes / dynamic malware analysis system (registry check) 27->215 40 aea7caadbf.exe 6 61 27->40         started        42 amert.exe 4 27->42         started        50 2 other processes 27->50 161 185.215.113.67 WHOLESALECONNECTIONSNL Portugal 31->161 217 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 31->217 219 Installs new ROOT certificates 31->219 221 Found many strings related to Crypto-Wallets (likely being stolen) 31->221 225 3 other signatures 31->225 52 2 other processes 31->52 file9 signatures10 process11 dnsIp12 127 187.204.4.219 UninetSAdeCVMX Mexico 33->127 129 185.172.128.59 NADYMSS-ASRU Russian Federation 33->129 135 14 other IPs or domains 33->135 83 C:\Users\...\zqrjs0OTmaC5sGR5VDn5k391.exe, PE32 33->83 dropped 85 C:\Users\...\zQeTuw5vxgdbKmiVRBeW6SUZ.exe, PE32 33->85 dropped 87 C:\Users\...\xYhK2iEXeksXlPa9BMLXm5tE.exe, PE32 33->87 dropped 95 221 other malicious files 33->95 dropped 175 Drops script or batch files to the startup folder 33->175 191 2 other signatures 33->191 131 49.13.229.86 HETZNER-ASDE Germany 38->131 89 C:\Users\user\AppData\...\softokn3[1].dll, PE32 38->89 dropped 97 11 other files (7 malicious) 38->97 dropped 193 4 other signatures 38->193 137 3 other IPs or domains 40->137 91 C:\Users\user\AppData\Local\...\RageMP131.exe, PE32 40->91 dropped 99 2 other malicious files 40->99 dropped 177 Query firmware table information (likely to detect VMs) 40->177 195 5 other signatures 40->195 54 schtasks.exe 40->54         started        56 schtasks.exe 40->56         started        93 C:\Users\user\AppData\Local\...\explorha.exe, PE32 42->93 dropped 179 Detected unpacking (changes PE section rights) 42->179 197 4 other signatures 42->197 58 explorha.exe 42->58         started        181 Loading BitLocker PowerShell Module 44->181 61 conhost.exe 44->61         started        139 2 other IPs or domains 48->139 183 Tries to steal Crypto Currency Wallets 48->183 185 Antivirus detection for dropped file 50->185 187 Binary is likely a compiled AutoIt script file 50->187 189 Machine Learning detection for dropped file 50->189 63 chrome.exe 50->63         started        133 172.67.148.231 CLOUDFLARENETUS United States 52->133 199 4 other signatures 52->199 66 powershell.exe 52->66         started        68 netsh.exe 52->68         started        file13 signatures14 process15 dnsIp16 70 conhost.exe 54->70         started        72 conhost.exe 56->72         started        227 Hides threads from debuggers 58->227 229 Tries to detect sandboxes / dynamic malware analysis system (registry check) 58->229 231 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 58->231 163 192.168.2.6 unknown unknown 63->163 165 239.255.255.250 unknown Reserved 63->165 74 chrome.exe 63->74         started        77 chrome.exe 63->77         started        233 Installs new ROOT certificates 66->233 235 Loading BitLocker PowerShell Module 66->235 79 conhost.exe 66->79         started        81 conhost.exe 68->81         started        signatures17 process18 dnsIp19 147 142.250.64.78 GOOGLEUS United States 74->147 149 142.250.65.174 GOOGLEUS United States 74->149 155 8 other IPs or domains 74->155 151 142.251.40.100 GOOGLEUS United States 77->151 153 142.251.40.131 GOOGLEUS United States 77->153

                                Screenshots

                                Thumbnails

                                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                                windows-stand

                                Antivirus, Machine Learning and Genetic Malware Detection

                                Initial Sample

                                SourceDetectionScannerLabelLink
                                fjL0EcgV6Y.exe55%ReversingLabsWin32.Trojan.Amadey
                                fjL0EcgV6Y.exe100%AviraTR/Crypt.XPACK.Gen
                                fjL0EcgV6Y.exe100%Joe Sandbox ML

                                Dropped Files

                                SourceDetectionScannerLabelLink
                                C:\Users\user\1000021002\2c9ff67496.exe100%AviraTR/AutoIt.mzmcv
                                C:\Users\user\1000021002\2c9ff67496.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\29IA9rCjPmrMnnZQZ7YKNcOZ.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\8gEIcaaLXjtHWMkCknRgnRyn.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\4PmoraVG5R1jZgxSXUXnrPno.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\1llpE1der8s65YfF1DaRwzoA.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\3YZhMRbhtqchUxr6HrEmYWxb.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\4zlsKqSOTzijQzm8qevqChAD.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\AdqitUVCSO3pnZ13PPMmTugt.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\4WIaPCqUVwVYRafs2f1atHjf.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\2MTLbmRYdCbpYlRWWULShPZa.exe100%Joe Sandbox ML
                                C:\ProgramData\MPGPH131\MPGPH131.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\1ZiD49yFoSPKKQmrglTINzlo.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\8sZNm50KnZ73Ir2IAGAzjiCM.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\87yah1hG3sRWG8d7DMFA6UPI.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\5N2KVotsup59l0rdMarxmZjH.exe100%Joe Sandbox ML
                                C:\Users\user\AppData\Local\91UaPJ59dXTYhY2K658YFFeC.exe100%Joe Sandbox ML
                                C:\ProgramData\MPGPH131\MPGPH131.exe47%ReversingLabsWin32.Trojan.RiseProStealer
                                C:\ProgramData\freebl3.dll0%ReversingLabs
                                C:\ProgramData\mozglue.dll0%ReversingLabs
                                C:\ProgramData\msvcp140.dll0%ReversingLabs
                                C:\ProgramData\nss3.dll0%ReversingLabs
                                C:\ProgramData\softokn3.dll0%ReversingLabs
                                C:\ProgramData\vcruntime140.dll0%ReversingLabs
                                C:\Users\user\AppData\Local\1ZiD49yFoSPKKQmrglTINzlo.exe79%ReversingLabsWin32.Trojan.Operaloader
                                C:\Users\user\AppData\Local\1llpE1der8s65YfF1DaRwzoA.exe50%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\29IA9rCjPmrMnnZQZ7YKNcOZ.exe50%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\2D21U1bRl2sEI2OnuIMYALNl.exe11%ReversingLabs
                                C:\Users\user\AppData\Local\2MTLbmRYdCbpYlRWWULShPZa.exe50%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\3bvlPX7g5Zc6pp8TPpEM470u.exe11%ReversingLabs
                                C:\Users\user\AppData\Local\4PmoraVG5R1jZgxSXUXnrPno.exe47%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\4WIaPCqUVwVYRafs2f1atHjf.exe50%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\4ptz7FM4kP7qMGFoFqE5j0zm.exe25%ReversingLabsWin64.Trojan.Generic
                                C:\Users\user\AppData\Local\5N2KVotsup59l0rdMarxmZjH.exe50%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\604jEG5qQpdnhPVOdLS1sPeh.exe11%ReversingLabs
                                C:\Users\user\AppData\Local\6xNdov8AZo7X4GIGr08JaGXe.exe25%ReversingLabsWin64.Trojan.Generic
                                C:\Users\user\AppData\Local\87yah1hG3sRWG8d7DMFA6UPI.exe47%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\8gEIcaaLXjtHWMkCknRgnRyn.exe50%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\91UaPJ59dXTYhY2K658YFFeC.exe50%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\CS3gyNCBkgUy4GD82bQforlP.exe50%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\CZ8BPZs8awoPJiACUS73pAe6.exe50%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\CwwSkg4Z6r2CyUx7eieftoSL.exe11%ReversingLabs
                                C:\Users\user\AppData\Local\D6PuoAsNvye4jtgG7lWCsXEx.exe79%ReversingLabsWin32.Trojan.Operaloader
                                C:\Users\user\AppData\Local\EmEyDLXTX7wKV3Hm4GA8AbdZ.exe25%ReversingLabsWin64.Trojan.Generic
                                C:\Users\user\AppData\Local\EqMO5smfp2bzSmy94pnHeeak.exe47%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\FsKEmkdvDCAc7VY3lRIiRKAL.exe47%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\GXqvrU2YdMIpdqoqkBIkuQ4a.exe50%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\HUsiXwAPudopBX0gkG8zqZ9K.exe79%ReversingLabsWin32.Trojan.Operaloader
                                C:\Users\user\AppData\Local\IGVPHrAShfg5S77hqubJkQGT.exe79%ReversingLabsWin32.Trojan.Operaloader
                                C:\Users\user\AppData\Local\IwVIt8hVIPrEsgJdmcJDc0cp.exe79%ReversingLabsWin32.Trojan.Operaloader
                                C:\Users\user\AppData\Local\J60VIKU1uGOij5ybpvmDPTRI.exe25%ReversingLabsWin64.Trojan.Generic
                                C:\Users\user\AppData\Local\JfX04QeZvezkOn3eIpEjUqc5.exe79%ReversingLabsWin32.Trojan.Operaloader
                                C:\Users\user\AppData\Local\KEohnm8N5FXDryvXGbq4vqXq.exe79%ReversingLabsWin32.Trojan.Operaloader
                                C:\Users\user\AppData\Local\KITnOquJmIbAAhc0DU20ke2n.exe47%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\KfIHlc6gAJQcL38Vr6ssqJ5m.exe47%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\KjpvJ8EHnBGQBp0fiOyr1f1m.exe47%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\LdBVJ0t5gC67YMsVTHQfk739.exe25%ReversingLabsWin64.Trojan.Generic
                                C:\Users\user\AppData\Local\LmG3qDHSUq8w4Wsw1PGm8pPm.exe25%ReversingLabsWin64.Trojan.Generic
                                C:\Users\user\AppData\Local\LzRxHxBk5eAHgaCKyeZTvsuN.exe47%ReversingLabsWin32.Ransomware.StopCrypt
                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\alexxxxxxxx[1].exe100%ReversingLabsWin32.Trojan.Emotet
                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\file300un[1].exe46%ReversingLabsWin64.Trojan.Amadey
                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\NewB[1].exe91%ReversingLabsWin32.Trojan.Malgent
                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\clip64[1].dll82%ReversingLabsWin32.Trojan.Amadey
                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\jok[1].exe92%ReversingLabsByteCode-MSIL.Trojan.Whispergate
                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\sarra[1].exe53%ReversingLabsWin32.Trojan.RisePro
                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll0%ReversingLabs
                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\gold[1].exe88%ReversingLabsWin32.Trojan.Amadey

                                Unpacked PE Files

                                ⊘No Antivirus matches

                                Domains

                                ⊘No Antivirus matches

                                URLs

                                ⊘No Antivirus matches

                                Domains and IPs

                                Contacted Domains

                                ⊘No contacted domains info

                                Contacted URLs

                                NameMaliciousAntivirus DetectionReputation
                                pillowbrocccolipe.shoptrue
                                  worryfillvolcawoi.shoptrue
                                    diskretainvigorousiw.shoptrue
                                      http://49.13.229.86/c73eed764cc59dcb.phptrue
                                        enthusiasimtitleow.shoptrue

                                          URLs from Memory and Binaries

                                          NameSourceMaliciousAntivirus DetectionReputation
                                          http://193.233.132.139/explorta.exe, 00000002.00000002.4589350907.0000000001A61000.00000004.00000020.00020000.00000000.sdmpfalse
                                            http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Textjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                              http://schemas.xmlsoap.org/ws/2005/02/sc/sctjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                http://193.233.132.175/server/ww12/AppGate2103v01.exe4kInstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  http://49.13.229.86/3.229.86/c73eed764cc59dcb.phpRegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    http://onlycitylink.comInstallUtil.exe, 00000033.00000002.4166622967.0000000002E5D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      https://ipinfo.io/widget/demo/156.146.37.102qMPGPH131.exe, 00000014.00000003.2694069291.000000000145B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3124637144.000000000145B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        https://db-ip.com/demo/home.php?s=156.146.37.102=EgRageMP131.exe, 00000030.00000003.2791013895.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2788181386.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2792650227.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          https://t.me/RiseProSUPPORTlMPGPH131.exe, 00000013.00000002.2957184812.0000000005BC0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            https://t.me/RiseProSUPPORThaea7caadbf.exe, 00000021.00000002.3117284660.0000000001077000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              http://tempuri.org/jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                http://tempuri.org/Entity/Id2Responsejok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, jok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  http://193.233.132.56/lend/alexxxxxxxx.exepexplorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    http://tempuri.org/Entity/Id21Responsejok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrapjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        https://yip.su/redirect-InstallUtil.exe, 00000033.00000002.4166622967.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FD8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B7B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D6E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C33000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLIDjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            https://t.me/riseproMPGPH131.exe, 00000014.00000003.2694069291.000000000147B000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2679315135.0000000001104000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              http://193.233.132.56/Pneh2sXQk0/index.phpdedexplorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                http://193.233.132.139/sev56rkm/index.phpded:explorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  http://193.233.132.139/00021002explorta.exe, 00000002.00000002.4589350907.0000000001A61000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequencejok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      http://193.233.132.56/Pneh2sXQk0/index.php00088001explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        http://schemas.xmlsoap.org/ws/2004/10/wsat/faultjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          http://schemas.xmlsoap.org/ws/2004/10/wsatjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            http://49.13.229.86/c73eed764cc59dcb.phplKKRegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              http://193.233.132.56/mine/random.exeexplorta.exe, 00000002.00000002.4589350907.0000000001A73000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                http://193.233.132.56/explorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKeyjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    http://49.13.229.86/84bad7132df89fd7/softokn3.dllRegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      https://api.ip.sb/ipjok.exe, 00000020.00000000.2311996086.0000000000492000.00000002.00000001.01000000.00000015.sdmp, jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        https://jonathantwo.comHInstallUtil.exe, 00000033.00000002.4166622967.0000000002D2B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          https://affordcharmcropwo.shop/hRegAsm.exe, 00000019.00000002.2402948638.00000000013EF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            https://ipinfo.io/widget/demo/156.146.37.1020aea7caadbf.exe, 00000021.00000002.3117284660.00000000010ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              http://193.233.132.56/cost/lenin.exeUserMPGPH131.exe, 00000013.00000002.2958708136.0000000006208000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000002.3127044186.0000000005C18000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                http://193.233.132.234/files/setup.exe4kInstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002CBD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    http://tempuri.org/Entity/Id24Responsejok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      https://www.ecosia.org/newtab/aea7caadbf.exe, 00000007.00000003.2765136933.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2824393145.00000000059FF000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000007.00000003.2777346909.00000000058D8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2785902773.0000000006038000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000013.00000003.2789092396.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2780916684.0000000005C5F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2775126903.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2758813887.0000000005C5E000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2772626604.0000000005C89000.00000004.00000020.00020000.00000000.sdmp, aea7caadbf.exe, 00000021.00000003.2798692847.0000000005E34000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2776044480.0000000005A0D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2785721259.0000000005A0D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        http://193.233.132.56/Pneh2sXQk0/index.php8001explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          https://affordcharmcropwo.shop/vRegAsm.exe, 00000019.00000002.2402948638.00000000013EF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnegojok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              http://193.233.132.56/cost/lenin.exeaterRageMP131.exe, 00000030.00000003.2791013895.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2788181386.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2792650227.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                http://schemas.xmlsoap.org/ws/2004/08/addressingjok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  https://ipinfo.io/RageMP131.exe, 00000030.00000002.3131365441.0000000001061000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789414202.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2796307180.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790307429.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000002.3131365441.00000000010A6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    http://193.233.132.56/cost/lenin.exea.exeoinRageMP131.exe, 00000030.00000002.3134911819.0000000005AF0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      http://193.233.132.56/Pneh2sXQk0/index.php8wexplorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        http://193.233.132.56/Pneh2sXQk0/index.phpsexplorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          http://193.233.132.56/Pneh2sXQk0/index.phpmrundll32.exe, 00000017.00000002.4575050800.000002161D690000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponsejok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                              http://tempuri.org/Entity/Id5Responsejok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                http://193.233.132.234/files/loader-2841.exe4kInstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  http://tempuri.org/Entity/Id10Responsejok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                    https://t.me/risepro_botKMPGPH131.exe, 00000014.00000002.3124637144.000000000147B000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000014.00000003.2694069291.000000000147B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      http://185.172.18InstallUtil.exe, 00000033.00000002.4166622967.0000000002F12000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        http://tempuri.org/Entity/Id8Responsejok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                          http://193.233.132.56/Pneh2sXQk0/index.phphrundll32.exe, 0000001F.00000002.4576475219.0000000002CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionIDjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                              http://193.233.132.56/Pneh2sXQk0/index.phpeexplorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                http://147.45.47.102:57893/hera/amadka.exeRageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  http://193.233.132.56/Pneh2sXQk0/index.phpdrundll32.exe, 0000001F.00000002.4576475219.0000000002CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    http://schemas.xmlsoap.org/ws/2006/02/addressingidentityjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                      http://49.13.229.86/84bad7132df89fd7/vcruntime140.dllXNRegAsm.exe, 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        http://193.233.132.56/Pneh2sXQk0/index.phprundll32.exe, 0000001F.00000002.4576475219.0000000002CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          http://193.233.132.56/lend/gold.exeexplorha.exe, 00000008.00000002.4621717301.0000000000C70000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            https://firstfirecar.com/980979aa037665b1a96df3348db08dc0/baf14778c246e15550645e30ba78ce1c.exeInstallUtil.exe, 00000033.00000002.4166622967.0000000002CB3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002B72000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D2B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002D5E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                              http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCTjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                http://schemas.xmlsoap.org/ws/2004/04/security/trust/Noncejok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                  http://193.233.132.234InstallUtil.exe, 00000033.00000002.4166622967.0000000002B31000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                    https://yip.suInstallUtil.exe, 00000033.00000002.4166622967.0000000002B8E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                      http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                        http://193.233.132.56/Pneh2sXQk0/index.php0rundll32.exe, 0000001F.00000002.4576475219.0000000002CCE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          http://193.233.132.56/Pneh2sXQk0/index.phpUsersexplorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            http://tempuri.org/Entity/Id13Responsejok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                              http://193.233.132.56/33.132.56/OneDriveexplorha.exe, 00000008.00000002.4621717301.0000000000CB8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  https://t.me/RiseProSUPPORTrJaea7caadbf.exe, 00000007.00000002.3094761202.0000000005890000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      https://ipinfo.io:443/widget/demo/156.146.37.102AMPGPH131.exe, 00000013.00000002.2953499946.0000000001416000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        http://193.233.132.56/Pneh2sXQk0/index.phpyu8explorha.exe, 00000008.00000002.4621717301.0000000000CCC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1jok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                            http://schemas.xmlsoap.org/ws/2005/05/identity/right/possesspropertyjok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              http://193.233.132.56/Pneh2sXQk0/index.php#explorha.exe, 00000008.00000002.4621717301.0000000000C70000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgementjok.exe, 00000020.00000002.4626441113.0000000002811000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  http://193.233.132.56/cost/go.exe0.1MPGPH131.exe, 00000014.00000002.3124637144.000000000147B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    http://tempuri.org/Entity/Id4ResponseDjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                      http://193.233.132.56/Pneh2sXQk0/index.php$rundll32.exe, 00000017.00000002.4575050800.000002161D6AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                        http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrapjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                          https://yip.su/RNWPdInstallUtil.exe, 00000033.00000002.4166622967.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FE8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000033.00000002.4166622967.0000000002DC4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                            http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issuejok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                              http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextjok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                http://schemas.xmlsoap.org/ws/2005/02/trust/Issuejok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                  http://193.233.132.56/cost/sarra.exe/z=explorta.exe, 00000002.00000002.4589350907.0000000001A46000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                    https://t.me/risepro_botRageMP131.exe, 00000030.00000003.2790787862.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2789324736.000000000110F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2821833886.00000000065B9000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000030.00000003.2794468417.0000000001116000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                      http://schemas.xmlsoap.org/ws/2005/02/trust/spnegojok.exe, 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmpfalse

                                                                                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                                                                                                        Public IPs

                                                                                                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                                        193.233.132.139
                                                                                                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                                                                                                        		2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                                                                                                        34.117.186.192
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                                                                                                        49.13.229.86
                                                                                                                                                                                                                                        		unknownGermany
                                                                                                                                                                                                                                        		24940HETZNER-ASDEtrue
                                                                                                                                                                                                                                        172.67.193.220
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        142.251.111.84
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                        185.215.113.67
                                                                                                                                                                                                                                        		unknownPortugal
                                                                                                                                                                                                                                        		206894WHOLESALECONNECTIONSNLtrue
                                                                                                                                                                                                                                        172.67.148.231
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        193.233.132.175
                                                                                                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                                                                                                        		2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                                                                                                        193.233.132.56
                                                                                                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                                                                                                        		2895FREE-NET-ASFREEnetEUtrue
                                                                                                                                                                                                                                        193.233.132.234
                                                                                                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                                                                                                        		2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                                                                                                        185.172.128.59
                                                                                                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                                                                                                        		50916NADYMSS-ASRUfalse
                                                                                                                                                                                                                                        104.21.60.76
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        142.250.80.67
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                        142.250.64.78
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                        142.251.40.131
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                        104.21.79.77
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        142.250.80.3
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                        104.21.31.124
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        20.42.73.29
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                        104.21.67.211
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        172.217.165.132
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                        104.21.90.14
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        77.221.151.47
                                                                                                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                                                                                                        		30968INFOBOX-ASInfoboxruAutonomousSystemRUfalse
                                                                                                                                                                                                                                        177.129.90.106
                                                                                                                                                                                                                                        		unknownBrazil
                                                                                                                                                                                                                                        		262394Internet58Ltda-MEBRfalse
                                                                                                                                                                                                                                        172.67.169.89
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        172.67.176.131
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        1.1.1.1
                                                                                                                                                                                                                                        		unknownAustralia
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        142.250.65.174
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                        147.45.47.126
                                                                                                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                                                                                                        		2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                                                                                                        142.251.40.238
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                        104.21.18.166
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        172.67.75.166
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        142.250.80.10
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                        185.172.128.19
                                                                                                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                                                                                                        		50916NADYMSS-ASRUfalse
                                                                                                                                                                                                                                        142.251.40.100
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                        104.20.4.235
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        172.67.193.79
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        239.255.255.250
                                                                                                                                                                                                                                        		unknownReserved
                                                                                                                                                                                                                                        		unknownunknownfalse
                                                                                                                                                                                                                                        187.204.4.219
                                                                                                                                                                                                                                        		unknownMexico
                                                                                                                                                                                                                                        		8151UninetSAdeCVMXfalse
                                                                                                                                                                                                                                        142.251.41.3
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                        104.21.76.57
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                        172.67.182.192
                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                                                        Private

                                                                                                                                                                                                                                        IP
                                                                                                                                                                                                                                        192.168.2.6

                                                                                                                                                                                                                                        General Information

                                                                                                                                                                                                                                        Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                                                                                                        Analysis ID:1437711
                                                                                                                                                                                                                                        Start date and time:2024-05-07 20:31:41 +02:00
                                                                                                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                                        Overall analysis duration:0h 16m 26s
                                                                                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                                        Report type:full
                                                                                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                                        Number of analysed new started processes analysed:126
                                                                                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                                                                                                        Technologies:
                                                                                                                                                                                                                                        • HCA enabled
                                                                                                                                                                                                                                        • EGA enabled
                                                                                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                                                                                        Sample name:fjL0EcgV6Y.exe
                                                                                                                                                                                                                                        renamed because original name is a hash value
                                                                                                                                                                                                                                        Original Sample Name:6bcab686349807f131a92c8fe7a4d736.exe
                                                                                                                                                                                                                                        Detection:MAL
                                                                                                                                                                                                                                        Classification:mal100.rans.phis.troj.spyw.expl.evad.winEXE@384/420@0/43
                                                                                                                                                                                                                                        EGA Information:
                                                                                                                                                                                                                                        • Successful, ratio: 40%
                                                                                                                                                                                                                                        HCA Information:Failed
                                                                                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                                                                                        • Found application associated with file extension: .exe
                                                                                                                                                                                                                                        • Override analysis time to 240s for rundll32

                                                                                                                                                                                                                                        Warnings

                                                                                                                                                                                                                                        • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                                                                                                                                                                                                                        • Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WerFault.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                                                                                        • Execution Graph export aborted for target amert.exe, PID 5784 because it is empty
                                                                                                                                                                                                                                        • Execution Graph export aborted for target explorta.exe, PID 1292 because there are no executed function
                                                                                                                                                                                                                                        • Execution Graph export aborted for target fjL0EcgV6Y.exe, PID 1424 because there are no executed function
                                                                                                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                                                                        • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                                                                                                                                                                                        • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                                                                                                        • VT rate limit hit for: fjL0EcgV6Y.exe

                                                                                                                                                                                                                                        Simulations

                                                                                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                                                                                        TimeTypeDescription
                                                                                                                                                                                                                                        20:32:28Task SchedulerRun new task: explorta path: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        20:32:29API Interceptor3820x Sleep call for process: explorta.exe modified
                                                                                                                                                                                                                                        20:32:39Task SchedulerRun new task: explorha path: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        20:32:43AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run aea7caadbf.exe C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        20:32:45Task SchedulerRun new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        20:32:46Task SchedulerRun new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        20:32:46API Interceptor37518x Sleep call for process: explorha.exe modified
                                                                                                                                                                                                                                        20:32:50API Interceptor8x Sleep call for process: RegAsm.exe modified
                                                                                                                                                                                                                                        20:32:52AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        20:32:55API Interceptor55x Sleep call for process: powershell.exe modified
                                                                                                                                                                                                                                        20:32:57API Interceptor1x Sleep call for process: WerFault.exe modified
                                                                                                                                                                                                                                        20:33:00AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2c9ff67496.exe C:\Users\user\1000021002\2c9ff67496.exe
                                                                                                                                                                                                                                        20:33:03API Interceptor264x Sleep call for process: InstallUtil.exe modified
                                                                                                                                                                                                                                        20:33:20AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run aea7caadbf.exe C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        20:33:28Task SchedulerRun new task: NewB.exe path: C:\Users\user\AppData\Local\Temp\1000088001\NewB.exe
                                                                                                                                                                                                                                        20:33:30API Interceptor4274x Sleep call for process: rundll32.exe modified
                                                                                                                                                                                                                                        20:33:58AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        20:34:01API Interceptor639x Sleep call for process: jok.exe modified
                                                                                                                                                                                                                                        20:34:17AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 2c9ff67496.exe C:\Users\user\1000021002\2c9ff67496.exe
                                                                                                                                                                                                                                        20:34:34AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0AhsRiT9HXP8nUVjVsC7lnJ0.bat
                                                                                                                                                                                                                                        20:34:53AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0g2ftn8MzMEKjC1SL91RWtO0.bat
                                                                                                                                                                                                                                        20:35:19AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0GMv9jZTcSw3m2Zzo1oAc5Kp.bat
                                                                                                                                                                                                                                        20:35:52AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1cEElHYdot58DykVLbQVOezn.bat
                                                                                                                                                                                                                                        20:36:14AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1Ok8j6Gi15r9nn69GkEMiN0f.bat
                                                                                                                                                                                                                                        20:36:37AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1OUEB4W7HwU4gIL2MQvEH1zP.bat
                                                                                                                                                                                                                                        20:37:01AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1pHRZ1WVTkwE1Jqqj49K6TVM.bat

                                                                                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                                                                                        IPs

                                                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                                                        Domains

                                                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                                                        ASNs

                                                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                                                        Dropped Files

                                                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                                                        C:\ProgramData\DAAECAFH

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\ECAKECAE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\IJDHDGDAAAAKFIDGHJDGCGCFHJ

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):98304
                                                                                                                                                                                                                                        Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                        MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                        SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                        SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                        SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\IJJDBAEHIJKJKEBFIEGHIDAAEC

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20480
                                                                                                                                                                                                                                        Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                        MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                        SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                        SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                        SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\JDGCGHCGHCBFHJJKKJEH

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):51200
                                                                                                                                                                                                                                        Entropy (8bit):0.8745947603342119
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
                                                                                                                                                                                                                                        MD5:378391FDB591852E472D99DC4BF837DA
                                                                                                                                                                                                                                        SHA1:10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
                                                                                                                                                                                                                                        SHA-256:513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
                                                                                                                                                                                                                                        SHA-512:F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\JJEGCBGIDHCAKEBGIIDBKFIEHI

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5242880
                                                                                                                                                                                                                                        Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                                                        MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                                                        SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                                                        SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                                                        SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\KECBGCGCGIEGCBFHIIEB

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\KFIJJEGHDAEBGCAKJKFHDHCFHC

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20480
                                                                                                                                                                                                                                        Entropy (8bit):0.8508558324143882
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
                                                                                                                                                                                                                                        MD5:933D6D14518371B212F36C3835794D75
                                                                                                                                                                                                                                        SHA1:92D056D912B3C0260D379330D3CC0359B57A322B
                                                                                                                                                                                                                                        SHA-256:55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
                                                                                                                                                                                                                                        SHA-512:EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\MPGPH131\MPGPH131.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2204176
                                                                                                                                                                                                                                        Entropy (8bit):7.946698135836806
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:YF4+SacvZxqngqv+OIsAsaj46MBt3mGDDKHbxG2/MMF+9:YWvabnIlnMBtVqbx5NO
                                                                                                                                                                                                                                        MD5:9B38B95FC36FD9B330018EC18E7DEB9D
                                                                                                                                                                                                                                        SHA1:AF345696F24DB54679D45AAC9D9642D7F51355E8
                                                                                                                                                                                                                                        SHA-256:50666D01B555E2376B9CB9415309DCEAFCD7CE1F7C6B3DDCC66CFBC13B21B0C7
                                                                                                                                                                                                                                        SHA-512:AD0CD27DB2667A42A20751C0427EFF9DBFD4E3C1B2236781A90A99C5B60CFBFB045B40E43224EA68A9B805B654EE394FD40BB07200A625070DE813ACF1DC76B4
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....96f...............'............X`P...........@...........................g......c"...@..................................Q.......p.......................pg..............................`...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@... .........r..................@..@ X....p...L...D..............@..B.vm_sec..@.......@..................@....idata.......P......................@....tls.........`...........................rsrc........p......................@..@.themida. 5..@......................`....boot........`P.....................`..`.reloc.......pg.......!.

                                                                                                                                                                                                                                        C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_swiiiii.exe_4644a13ebcdb6e10e65a72b8ec8bc0b0ff32d1fa_6563360f_9596a87c-22a4-437b-88d7-c630f25935ff\Report.wer

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):65536
                                                                                                                                                                                                                                        Entropy (8bit):0.9275844009195585
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:AA7lN1S1X6c0BU/SrFaGszuiFPZ24IO84d3:DS1X6XBU/SrFadzuiFPY4IO84d3
                                                                                                                                                                                                                                        MD5:DDD6263A14FD4910B10B19BBCDBAE0A2
                                                                                                                                                                                                                                        SHA1:931B7391155AD0D244A704718AEE4DE2C4388CBA
                                                                                                                                                                                                                                        SHA-256:06BBBB332629E67F9539DD3C95B69A7B4C0822D7C3DF2E7230603556DC78ABED
                                                                                                                                                                                                                                        SHA-512:86669991A02BD3D1B111324005241B8FE089A160708A8DC6927ECB83CC0003B1B4206CDDC75DBC08819B41A2112590210319AEECD24DD64A1AC34895221C1D71
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.5.8.0.3.7.0.5.3.4.2.5.9.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.5.8.0.3.7.1.9.6.0.1.5.7.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.5.9.6.a.8.7.c.-.2.2.a.4.-.4.3.7.b.-.8.8.d.7.-.c.6.3.0.f.2.5.9.3.5.f.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.9.f.b.8.e.4.2.-.4.a.8.1.-.4.3.b.7.-.a.3.7.5.-.b.3.d.d.e.5.8.3.4.a.d.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.w.i.i.i.i.i...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.M.S.T.P...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.0.0.-.0.0.0.1.-.0.0.1.5.-.1.7.4.d.-.7.0.f.6.a.c.a.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.f.4.0.2.9.a.9.7.d.3.e.3.4.2.c.a.a.8.8.8.2.3.7.5.d.c.b.c.2.b.1.0.0.0.0.0.9.0.4.!.0.0.0.0.3.3.a.e.d.a.d.b.5.3.6.1.f.1.6.4.6.c.f.f.d.6.8.7.9.1.d.7.2.b.a.5.f.1.4.2.4.1.1.4.!.

                                                                                                                                                                                                                                        C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE58.tmp.dmp

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        File Type:Mini DuMP crash report, 15 streams, Tue May 7 18:32:50 2024, 0x1205a4 type
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):172605
                                                                                                                                                                                                                                        Entropy (8bit):3.9507521128812115
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:at4zp9pXMuBojRypN4uE2aOo6BCDj0LTgAW2vAZ+SVXftTrBDx1EX:at4tUU4uEqoT4LTgAWwylRd2
                                                                                                                                                                                                                                        MD5:D37F1DF6CCEBA5BF1DEE582C968C0F0C
                                                                                                                                                                                                                                        SHA1:9D85098539251A3672310DB300023518FD90C3E2
                                                                                                                                                                                                                                        SHA-256:6FBB0E2830AFFD44022CD143A73190C485EBC50B6013219E481734993134DEFC
                                                                                                                                                                                                                                        SHA-512:4F2FF63A60F45F7D64D29DE10D0C3E1C31F7902CCC7FA14FF7F9F1555EA476593E65C245541F61C79192B1569B3B80290A357BDF1D086A4D292AF3A4319EB9CE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MDMP..a..... ........s:f....................................<...............Z9..........`.......8...........T...........P$...}......................................................................................................eJ......d.......GenuineIntel............T............s:f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\Microsoft\Windows\WER\Temp\WERE00E.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):8318
                                                                                                                                                                                                                                        Entropy (8bit):3.698169939590465
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:R6l7wVeJ946y6YGuP6aSx7gmfM4Jdpri89bw8sfYSQm:R6lXJS6y6YGe6aSx7gmfM4J7wPfr
                                                                                                                                                                                                                                        MD5:E9D112B4E5C2B1A67223D6967E71CAD2
                                                                                                                                                                                                                                        SHA1:93542216C36EF981CA6832E336B36A70E4FE1661
                                                                                                                                                                                                                                        SHA-256:70BB82F95C031729C1437D52296D6CE927B2366192AC20B5FEA4E434565EE521
                                                                                                                                                                                                                                        SHA-512:23D5C19F270556FCEBACCC041F3638D1601CC7F34DEB45A5ABB34B54FE030592C6866A8298D37EC01C460E58DFBE4701E0A2860BEB7F2FB87B588A86EC1039F6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.8.0.<./.P.i.

                                                                                                                                                                                                                                        C:\ProgramData\Microsoft\Windows\WER\Temp\WERE08C.tmp.xml

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4652
                                                                                                                                                                                                                                        Entropy (8bit):4.4772865492041545
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:cvIwWl8zsPJg77aI9RWWpW8VYJYm8M4JlAFFII+q8wDOym3Z01Rrd:uIjfxI7v37V9J8NmyAZ0Trd
                                                                                                                                                                                                                                        MD5:AD372A550764D4706E04E975D99D813B
                                                                                                                                                                                                                                        SHA1:CEC5C757D7430B9E2B5F6744C392210F3342215F
                                                                                                                                                                                                                                        SHA-256:3CADB5EAA65C8BFDB9F97446A9196E110545CFE75F789429D5C381F65BF14B48
                                                                                                                                                                                                                                        SHA-512:A14ABE3193F8B0D9EA17F8A0DF5CA740EAFE1EA27547F47BA31416420EBF4F7096D8DBBD3413BC944DB0BDECDC83E1A4B6B91A2E66BCBC87E51828E1D703C444
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="313055" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                                        C:\ProgramData\freebl3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):685392
                                                                                                                                                                                                                                        Entropy (8bit):6.872871740790978
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
                                                                                                                                                                                                                                        MD5:550686C0EE48C386DFCB40199BD076AC
                                                                                                                                                                                                                                        SHA1:EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
                                                                                                                                                                                                                                        SHA-256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
                                                                                                                                                                                                                                        SHA-512:0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\mozglue.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):608080
                                                                                                                                                                                                                                        Entropy (8bit):6.833616094889818
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
                                                                                                                                                                                                                                        MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
                                                                                                                                                                                                                                        SHA1:95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
                                                                                                                                                                                                                                        SHA-256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
                                                                                                                                                                                                                                        SHA-512:FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\msvcp140.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):450024
                                                                                                                                                                                                                                        Entropy (8bit):6.673992339875127
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
                                                                                                                                                                                                                                        MD5:5FF1FCA37C466D6723EC67BE93B51442
                                                                                                                                                                                                                                        SHA1:34CC4E158092083B13D67D6D2BC9E57B798A303B
                                                                                                                                                                                                                                        SHA-256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
                                                                                                                                                                                                                                        SHA-512:4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\nss3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2046288
                                                                                                                                                                                                                                        Entropy (8bit):6.787733948558952
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
                                                                                                                                                                                                                                        MD5:1CC453CDF74F31E4D913FF9C10ACDDE2
                                                                                                                                                                                                                                        SHA1:6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
                                                                                                                                                                                                                                        SHA-256:AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
                                                                                                                                                                                                                                        SHA-512:DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\softokn3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):257872
                                                                                                                                                                                                                                        Entropy (8bit):6.727482641240852
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
                                                                                                                                                                                                                                        MD5:4E52D739C324DB8225BD9AB2695F262F
                                                                                                                                                                                                                                        SHA1:71C3DA43DC5A0D2A1941E874A6D015A071783889
                                                                                                                                                                                                                                        SHA-256:74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
                                                                                                                                                                                                                                        SHA-512:2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\ProgramData\vcruntime140.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):80880
                                                                                                                                                                                                                                        Entropy (8bit):6.920480786566406
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
                                                                                                                                                                                                                                        MD5:A37EE36B536409056A86F50E67777DD7
                                                                                                                                                                                                                                        SHA1:1CAFA159292AA736FC595FC04E16325B27CD6750
                                                                                                                                                                                                                                        SHA-256:8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
                                                                                                                                                                                                                                        SHA-512:3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\Public\Desktop\Google Chrome.lnk

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000071001\jok.exe
                                                                                                                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:13 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2104
                                                                                                                                                                                                                                        Entropy (8bit):3.4654087661193453
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:8SwTd5TvGk0lRYrnvPdAKRkdAGdAKRFdAKR6P:8SwHbH7
                                                                                                                                                                                                                                        MD5:BEC5BB24CBB80F355258971949235C44
                                                                                                                                                                                                                                        SHA1:9C2761F264D6EAF51485579132D2701A6D0B71E3
                                                                                                                                                                                                                                        SHA-256:289ACBF0E980A6845AB4AE87951F999302FB7375BAB95E641891F195C2C24EDA
                                                                                                                                                                                                                                        SHA-512:B6C4428982CC0615B333A7B703B86C855BFC642CC774BC0C26E05BB3BD4B4CB123E4957274714D3B177D4248B5EBCD286B1E72748CB6D9E793BF6503ABB84BD3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:L..................F.@.. ......,....V...W....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IEW.5....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW@2....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.2..Chrome..>......CW.VEW.2....M.....................7...C.h.r.o.m.e.....`.1.....EW.2..APPLIC~1..H......CW.VEW.2..........................7...A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.5.........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

                                                                                                                                                                                                                                        C:\Users\user\1000021002\2c9ff67496.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1166336
                                                                                                                                                                                                                                        Entropy (8bit):7.035555795688903
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:+qDEvCTbMWu7rQYlBQcBiT6rprG8aST2+b+HdiJUX:+TvC/MTQYxsWR7aST2+b+HoJU
                                                                                                                                                                                                                                        MD5:A45EC26929E9563254198D2B394D4D17
                                                                                                                                                                                                                                        SHA1:AE3A96692B8329349A0821C88E0C70BA742A4BBA
                                                                                                                                                                                                                                        SHA-256:DEA0833CAA54B6D05B170F0E0A46B0247D33D47B60F8A5B4BB87877ECAE352A6
                                                                                                                                                                                                                                        SHA-512:D650E3CB07EB009FDD23DD4A9513B17AE208FE6BE2E097FC0CCCFC37FD3C6F29B70E15DCA6330542D627A13CA776165D0C6D9D9807D0E2381875110815777127
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....i:f..........".................w.............@..........................0.......7....@...@.......@.....................d...|....@..xa.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...xa...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\1ZiD49yFoSPKKQmrglTINzlo.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 79%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\1llpE1der8s65YfF1DaRwzoA.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\29IA9rCjPmrMnnZQZ7YKNcOZ.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\2D21U1bRl2sEI2OnuIMYALNl.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 11%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\2MTLbmRYdCbpYlRWWULShPZa.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\3YZhMRbhtqchUxr6HrEmYWxb.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\3bpaooYORdL1zGgZZfaU6raM.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\3bvlPX7g5Zc6pp8TPpEM470u.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 11%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\4PmoraVG5R1jZgxSXUXnrPno.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\4WIaPCqUVwVYRafs2f1atHjf.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\4ptz7FM4kP7qMGFoFqE5j0zm.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\4zlsKqSOTzijQzm8qevqChAD.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\5N2KVotsup59l0rdMarxmZjH.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\604jEG5qQpdnhPVOdLS1sPeh.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 11%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\6xNdov8AZo7X4GIGr08JaGXe.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\87yah1hG3sRWG8d7DMFA6UPI.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\8gEIcaaLXjtHWMkCknRgnRyn.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\8sZNm50KnZ73Ir2IAGAzjiCM.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\91UaPJ59dXTYhY2K658YFFeC.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\AdqitUVCSO3pnZ13PPMmTugt.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\CS3gyNCBkgUy4GD82bQforlP.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\CZ8BPZs8awoPJiACUS73pAe6.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\CwwSkg4Z6r2CyUx7eieftoSL.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 11%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\D6PuoAsNvye4jtgG7lWCsXEx.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 79%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\EmEyDLXTX7wKV3Hm4GA8AbdZ.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\EqMO5smfp2bzSmy94pnHeeak.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\FsKEmkdvDCAc7VY3lRIiRKAL.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\GXqvrU2YdMIpdqoqkBIkuQ4a.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\HUsiXwAPudopBX0gkG8zqZ9K.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 79%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\I4LhcLo5s9gVJdPowLL5oSzp.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\IGVPHrAShfg5S77hqubJkQGT.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 79%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\IwVIt8hVIPrEsgJdmcJDc0cp.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 79%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\J60VIKU1uGOij5ybpvmDPTRI.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\J6EKnVYc7FheOARgvJ4DtZho.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\JfX04QeZvezkOn3eIpEjUqc5.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 79%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\KEohnm8N5FXDryvXGbq4vqXq.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 79%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\KITnOquJmIbAAhc0DU20ke2n.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\KfIHlc6gAJQcL38Vr6ssqJ5m.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\KjpvJ8EHnBGQBp0fiOyr1f1m.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\LdBVJ0t5gC67YMsVTHQfk739.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\LmG3qDHSUq8w4Wsw1PGm8pPm.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\LzRxHxBk5eAHgaCKyeZTvsuN.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\MCN1KYKWa3qY8Q8lKV2maDTO.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\swiy.exe.log

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):42
                                                                                                                                                                                                                                        Entropy (8bit):4.0050635535766075
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:QHXMKa/xwwUy:Q3La/xwQ
                                                                                                                                                                                                                                        MD5:84CFDB4B995B1DBF543B26B86C863ADC
                                                                                                                                                                                                                                        SHA1:D2F47764908BF30036CF8248B9FF5541E2711FA2
                                                                                                                                                                                                                                        SHA-256:D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
                                                                                                                                                                                                                                        SHA-512:485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\alexxxxxxxx[1].exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2831872
                                                                                                                                                                                                                                        Entropy (8bit):7.076550333890677
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:jOvdoJl7MWepyIsE7ddkxuq8rW5vs0VaCQeb5tsQcGo:GYIscWxuq8rUlVaCQo5tsQG
                                                                                                                                                                                                                                        MD5:31841361BE1F3DC6C2CE7756B490BF0F
                                                                                                                                                                                                                                        SHA1:FF2506641A401AC999F5870769F50B7326F7E4EB
                                                                                                                                                                                                                                        SHA-256:222393A4AB4B2AE83CA861FAEE6DF02AC274B2F2CA0BED8DB1783DD61F2F37EE
                                                                                                                                                                                                                                        SHA-512:53D66FA19E8DB360042DADC55CAAA9A1CA30A9D825E23ED2A58F32834691EB2AAAA27A4471E3FC4D13E201ACCC43160436ED0E9939DF1CC227A62A09A2AE0019
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 100%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B............C......C..9...C......R!......R!......C.............R!.....c"......c"......Rich....................PE..L...w.(f...............'..........................@...........................+...........@.................................0.*.P.............................+..I..0m..8...........................Hl..@.............*.0............................text............................... ..`.rdata...M.......N..................@..@.data...............................@....idata..*.....*.......*.............@..@.00cfg........+.......*.............@..@.reloc..qh....+..j....*.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\file300un[1].exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):534152
                                                                                                                                                                                                                                        Entropy (8bit):7.7304359776027685
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:jpDxMM2vWugFMfmKL9ZVvwtgEOy9bxKdyH6WS2Fft:19MMYzftL97sgoKOSU1
                                                                                                                                                                                                                                        MD5:C1D583657C7FE7973F820983FD1ABB81
                                                                                                                                                                                                                                        SHA1:4CFADA887AF87F32224FCA86ED32EDCAC00EDBEC
                                                                                                                                                                                                                                        SHA-256:DF65905B3F10C47B81AB22EBE370BAB5DB1A38D511338E6E8CC1FF7294A61744
                                                                                                                                                                                                                                        SHA-512:2DC55BBF18CA62A8E5834D7341A646D3EA082ECA7E28AD9C75F72E5813EA46CF10AB9FA98D7AB2F2830633F438AA19F2EB4AF768DEE4B7A130F8EEC17936DD88
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 46%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..../............"...0.._............... ....@...... ..............................S.....`.............................................................(............................................................................................ ..H............text...._... ...`.................. ..`.rsrc...(............b..............@..@........................................H..........8....... ..................................................."..(...+*Z..s....%.}....%.}....*"..(...+*Z..s....%.}....%.} ...*~s!...%.}"...%.}#.....$...s%...*~s&...%.}'...%.}(.....)...s*...*"..(...+*Z..s+...%.},...%.}-...*"..(...+*Z..s....%.}/...%.}0...*&...(...+*v..s1...%.}2...%.}3...%.}4...*&...(...+*v..s5...%.}6...%.}7...%.}8...*"..(...+*Z..s9...%.}:...%.};...*"..(...+*Z..s<...%.}=...%.}>...*"..(...+*Z..s?...%.}@...%.}A...*"..(...+*Z..sB...%.}C...%.}D...*"..(...+*Z..sE..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1166336
                                                                                                                                                                                                                                        Entropy (8bit):7.035555795688903
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:+qDEvCTbMWu7rQYlBQcBiT6rprG8aST2+b+HdiJUX:+TvC/MTQYxsWR7aST2+b+HoJU
                                                                                                                                                                                                                                        MD5:A45EC26929E9563254198D2B394D4D17
                                                                                                                                                                                                                                        SHA1:AE3A96692B8329349A0821C88E0C70BA742A4BBA
                                                                                                                                                                                                                                        SHA-256:DEA0833CAA54B6D05B170F0E0A46B0247D33D47B60F8A5B4BB87877ECAE352A6
                                                                                                                                                                                                                                        SHA-512:D650E3CB07EB009FDD23DD4A9513B17AE208FE6BE2E097FC0CCCFC37FD3C6F29B70E15DCA6330542D627A13CA776165D0C6D9D9807D0E2381875110815777127
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....i:f..........".................w.............@..........................0.......7....@...@.......@.....................d...|....@..xa.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...xa...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\NewB[1].exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):428544
                                                                                                                                                                                                                                        Entropy (8bit):6.494348537450964
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:5noAx+FnmuQhimtPURimLqevmipum+K4Y:5+FnmuGtpMLnLYY
                                                                                                                                                                                                                                        MD5:0099A99F5FFB3C3AE78AF0084136FAB3
                                                                                                                                                                                                                                        SHA1:0205A065728A9EC1133E8A372B1E3864DF776E8C
                                                                                                                                                                                                                                        SHA-256:919AE827FF59FCBE3DBAEA9E62855A4D27690818189F696CFB5916A88C823226
                                                                                                                                                                                                                                        SHA-512:5AC4F3265C7DD7D172284FB28C94F8FC6428C27853E70989F4EC4208F9897BE91720E8EEE1906D8E843AB05798F3279A12492A32E8A118F5621AC5E1BE2031B6
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\NewB[1].exe, Author: Joe Security
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 91%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%..........................PE..L.... Me..........................................@.......................................@.................................D...x....p...........................L..P...8...................,...........@............................................text............................... ..`.rdata..............................@..@.data....F... ...4..................@....rsrc........p.......:..............@..@.reloc...L.......N...<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\amert[1].exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1907200
                                                                                                                                                                                                                                        Entropy (8bit):7.950710520033503
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:Uo4WRoi4htfnraPcTSzaMfzqmzb9EkJluWq:UkiruvLTP+Qlun
                                                                                                                                                                                                                                        MD5:F94CAD2EA8087F7452D99C57BF5C935E
                                                                                                                                                                                                                                        SHA1:FA47755DBC5C9DD1F4A7D5E18DE9D7A4178C3E0D
                                                                                                                                                                                                                                        SHA-256:86DAADC6D16A6BE5012B517E4EF49316BAC7EF6AA1C86CFC26CF0719DE9F0F75
                                                                                                                                                                                                                                        SHA-512:BBF608153AAE2C0FA77CA8F66FF16AB03CFAECA321144577C8860EE0A535617A4F5D854A6AAEEDB42CE97275A20817E1889594E7D76C97BADBAA015AB62F99DA
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...o..e..............................K...... ....@...........................L.....h.....@.................................V...j.............................K.............................X.K..................................................... . ............................@....rsrc...............................@....idata ............................@... . +.........................@...tgqtxtnx......1.....................@...ouenqhoa......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\clip64[1].dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):112128
                                                                                                                                                                                                                                        Entropy (8bit):6.400158525810517
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
                                                                                                                                                                                                                                        MD5:726CD06231883A159EC1CE28DD538699
                                                                                                                                                                                                                                        SHA1:404897E6A133D255AD5A9C26AC6414D7134285A2
                                                                                                                                                                                                                                        SHA-256:12FEF2D5995D671EC0E91BDBDC91E2B0D3C90ED3A8B2B13DDAA8AD64727DCD46
                                                                                                                                                                                                                                        SHA-512:9EA82E7CB6C6A58446BD5033855947C3E2D475D2910F2B941235E0B96AA08EEC822D2DD17CC86B2D3FCE930F78B799291992408E309A6C63E3011266810EA83E
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\clip64[1].dll, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\clip64[1].dll, Author: Joe Security
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 82%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L...j..e...........!.....$...........f.......@............................................@......................... ...........P.......................................8...........................(...@............@..L............................text...6#.......$.................. ..`.rdata..4i...@...j...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\jok[1].exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):311296
                                                                                                                                                                                                                                        Entropy (8bit):5.0817932970004
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:uq6EgY6i4rUjhYMLwPcologL/ejZWTACtAti0lcZqf7D34leqiOLibBOp:VqY6inwPDpKZWTA+AplcZqf7DIvL
                                                                                                                                                                                                                                        MD5:8510BCF5BC264C70180ABE78298E4D5B
                                                                                                                                                                                                                                        SHA1:2C3A2A85D129B0D750ED146D1D4E4D6274623E28
                                                                                                                                                                                                                                        SHA-256:096220045877E456EDFEA1ADCD5BF1EFD332665EF073C6D1E9474C84CA5433F6
                                                                                                                                                                                                                                        SHA-512:5FF0A47F9E14E22FC76D41910B2986605376605913173D8AD83D29D85EB79B679459E2723A6AD17BC3C3B8C9B359E2BE7348EE1C21FA2E8CEB7CC9220515258D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\jok[1].exe, Author: Joe Security
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 92%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)v................0................. ... ....@.. ....................... ............@.................................t...O.... ..............................X................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\sarra[1].exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2419200
                                                                                                                                                                                                                                        Entropy (8bit):7.93331187801588
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:RTs9zpYo556eURBCnmK2OJxYud8/puGtMDJ3oLsZYO8J/zpiTB:R49SoqrRBCn1P7Zd8ttMN3oLIYXoTB
                                                                                                                                                                                                                                        MD5:47ABEF561C78932606D35C88D542A1DB
                                                                                                                                                                                                                                        SHA1:EF7729EA96589B7EF5DF4EEDB9A51BAE18712734
                                                                                                                                                                                                                                        SHA-256:342C5AF8D77498B4E29E236891D8B0265A25F1212BD58457E8CBF6AB20C23C39
                                                                                                                                                                                                                                        SHA-512:0BCACF790BE0DADD39179BB3202F01A4599FA8EC2738794E70D7692B77D78ED6E00C468639F39FA69EBDBEC5DF2B012DEA7AEB18976892587BBDFBAA0B23F57C
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 53%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....96f...............'..............]...........@...........................].....d.%...@.................................^p..r.............................\.............................d.\..............................6..@................... . ............................@....rsrc...............................@....idata .....p.......D..............@... ..*..........F..............@...pebjcioa......D..|...H..............@...qliweygd......].......$.............@....taggant.0....].."....$.............@...........................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):685392
                                                                                                                                                                                                                                        Entropy (8bit):6.872871740790978
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
                                                                                                                                                                                                                                        MD5:550686C0EE48C386DFCB40199BD076AC
                                                                                                                                                                                                                                        SHA1:EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
                                                                                                                                                                                                                                        SHA-256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
                                                                                                                                                                                                                                        SHA-512:0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\gold[1].exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):578048
                                                                                                                                                                                                                                        Entropy (8bit):7.272707802677416
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:D/fI5jU8KHNXx/WRjeew+6P5zwMzAbPxlj6M+KjLHo:D3IYNXxya9+TMzMTj6rKjb
                                                                                                                                                                                                                                        MD5:F15A9CFA3726845017A7F91ABE0A14F7
                                                                                                                                                                                                                                        SHA1:5540AE40231FE4BF97E59540033B679DDA22F134
                                                                                                                                                                                                                                        SHA-256:2DEC75328413D4C278C119DB42920FB183A88A5398D56ECC80C8CC74FBA13071
                                                                                                                                                                                                                                        SHA-512:1C2AF9608736AD6A02D093F769FE5EC5A06CB395A639E021D4EE3F6C46CEBC8C101E7DB1064984F801AD3BEE65D81B95FE6E2E60C0EC949BB172BA9C455B9869
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 88%
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(tY.F'Y.F'Y.F'..E&U.F'..C&.F'..B&L.F'..B&K.F'..E&M.F'..G&\.F'Y.G'..F'..C&..F'..C&X.F'..D&X.F'RichY.F'................PE..L.....4f...............'.............a.......0....@..........................?............@..................................0..................................l......................................@............0..<............................text............................... ..`.DAX.........0......................@..@.data...T...........................@....Left...............................@....reloc..l...........................@..B.INV.........0......................@...........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):608080
                                                                                                                                                                                                                                        Entropy (8bit):6.833616094889818
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
                                                                                                                                                                                                                                        MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
                                                                                                                                                                                                                                        SHA1:95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
                                                                                                                                                                                                                                        SHA-256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
                                                                                                                                                                                                                                        SHA-512:FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):450024
                                                                                                                                                                                                                                        Entropy (8bit):6.673992339875127
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
                                                                                                                                                                                                                                        MD5:5FF1FCA37C466D6723EC67BE93B51442
                                                                                                                                                                                                                                        SHA1:34CC4E158092083B13D67D6D2BC9E57B798A303B
                                                                                                                                                                                                                                        SHA-256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
                                                                                                                                                                                                                                        SHA-512:4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2046288
                                                                                                                                                                                                                                        Entropy (8bit):6.787733948558952
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
                                                                                                                                                                                                                                        MD5:1CC453CDF74F31E4D913FF9C10ACDDE2
                                                                                                                                                                                                                                        SHA1:6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
                                                                                                                                                                                                                                        SHA-256:AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
                                                                                                                                                                                                                                        SHA-512:DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2204176
                                                                                                                                                                                                                                        Entropy (8bit):7.946698135836806
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:YF4+SacvZxqngqv+OIsAsaj46MBt3mGDDKHbxG2/MMF+9:YWvabnIlnMBtVqbx5NO
                                                                                                                                                                                                                                        MD5:9B38B95FC36FD9B330018EC18E7DEB9D
                                                                                                                                                                                                                                        SHA1:AF345696F24DB54679D45AAC9D9642D7F51355E8
                                                                                                                                                                                                                                        SHA-256:50666D01B555E2376B9CB9415309DCEAFCD7CE1F7C6B3DDCC66CFBC13B21B0C7
                                                                                                                                                                                                                                        SHA-512:AD0CD27DB2667A42A20751C0427EFF9DBFD4E3C1B2236781A90A99C5B60CFBFB045B40E43224EA68A9B805B654EE394FD40BB07200A625070DE813ACF1DC76B4
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....96f...............'............X`P...........@...........................g......c"...@..................................Q.......p.......................pg..............................`...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@... .........r..................@..@ X....p...L...D..............@..B.vm_sec..@.......@..................@....idata.......P......................@....tls.........`...........................rsrc........p......................@..@.themida. 5..@......................`....boot........`P.....................`..`.reloc.......pg.......!.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):257872
                                                                                                                                                                                                                                        Entropy (8bit):6.727482641240852
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
                                                                                                                                                                                                                                        MD5:4E52D739C324DB8225BD9AB2695F262F
                                                                                                                                                                                                                                        SHA1:71C3DA43DC5A0D2A1941E874A6D015A071783889
                                                                                                                                                                                                                                        SHA-256:74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
                                                                                                                                                                                                                                        SHA-512:2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\swiy[1].exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):162304
                                                                                                                                                                                                                                        Entropy (8bit):7.964021035934757
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:v5JKjGc9pOW1Bg7ayW1QSZP5+fZ1mlUQj2s:hgGGpZQao+P5KboXj2
                                                                                                                                                                                                                                        MD5:317465164F61FE462864A65B732CCC13
                                                                                                                                                                                                                                        SHA1:5B78C41AD423766E9AADAE91F902D14A922C8666
                                                                                                                                                                                                                                        SHA-256:95674CB006BFCA36CD0E0F9B80EF0ED240C64F2EE955D9DD4AF8102A0C4D9806
                                                                                                                                                                                                                                        SHA-512:9BC4846A92B7B25E973B42C2CD4895DD15132D0FA1D9EE62E8D7E3679E8BB3B75AE9FB5C6FA165AF0F77EAF3E3F75A4D7F60057A0CB22693FC80D89390D09046
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C29f.................p.............. ........@.. ....................................`.....................................O.......@...........................T................................................ ............... ..H............text....o... ...p.................. ..`.rsrc...@............r..............@..@.reloc...............x..............@..B........................H..........................................................................]*....0............i. .......... .............+C.....-!....d....(......(....&.........+.......(...........o......X.. ....2.....+<..... ........ ..............XX.. ....]...................X.. ....2........8.......8......X ....].....X ....]...........&............o....r...p(....s.........+...r...po.......X......2...o.....16.........o..........X ....]..........%q........a........X......i?P......X.....?:.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):80880
                                                                                                                                                                                                                                        Entropy (8bit):6.920480786566406
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
                                                                                                                                                                                                                                        MD5:A37EE36B536409056A86F50E67777DD7
                                                                                                                                                                                                                                        SHA1:1CAFA159292AA736FC595FC04E16325B27CD6750
                                                                                                                                                                                                                                        SHA-256:8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
                                                                                                                                                                                                                                        SHA-512:3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\cred64[1].dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1285632
                                                                                                                                                                                                                                        Entropy (8bit):6.460494158653329
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
                                                                                                                                                                                                                                        MD5:15A42D3E4579DA615A384C717AB2109B
                                                                                                                                                                                                                                        SHA1:22AEEDEB2307B1370CDAB70D6A6B6D2C13AD2301
                                                                                                                                                                                                                                        SHA-256:3C97BB410E49B11AF8116FEB7240B7101E1967CAE7538418C45C3D2E072E8103
                                                                                                                                                                                                                                        SHA-512:1EB7F126DCCC88A2479E3818C36120F5AF3CAA0D632B9EA803485EE6531D6E2A1FD0805B1C4364983D280DF23EA5CA3AD4A5FCA558AC436EFAE36AF9B795C444
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\cred64[1].dll, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^.._...^.._...^.._2..^W._..^W._...^W._...^.._...^...^C..^.._...^.._...^..X^...^.._...^Rich...^........................PE..d...i..e.........." .........R......h........................................P............`......................................... ...X...x........ .......`..(............0..........p........................... ................................................text............................... ..`.rdata..............................@..@.data...L........D..................@....pdata..(....`......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\install[1].exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4448942
                                                                                                                                                                                                                                        Entropy (8bit):7.996740744908945
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:98304:zgwR5qybOM3rY1buPd0+01mQ5YBGUYDU4a6FXg+d70MYVSuEQQpnlJYtDf+8:zgDyaM3qbA0+07YBeDa6a++b5Evn4tF
                                                                                                                                                                                                                                        MD5:0F52E5E68FE33694D488BFE7A1A71529
                                                                                                                                                                                                                                        SHA1:11D7005BD72CB3FD46F24917BF3FC5F3203F361F
                                                                                                                                                                                                                                        SHA-256:EFD29C35766C607AA15D1CB83DEC625739791B1616AD37D5B47E78CDB8A42CA8
                                                                                                                                                                                                                                        SHA-512:238FBB1C04EEF2F2005CB7ABF0223E3CD062D9D2840966292E19DCAA495609E134A0BDC35389AE9925ECFC787A13772D3AC7B29058579F702BC849DD0343C400
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L......P.....................\....../.............@..........................P......3-......................................t........0..................................................................................l............................text.............................. ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc........0......................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.c...P....Y.nj'.S....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.f...Y.r8..j...t.A...t$..D....V....s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.d.....3.9F.Y~.9F

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\swiiiii[1].exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):329352
                                                                                                                                                                                                                                        Entropy (8bit):7.976897467568528
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:DFZcMaQk5oqtag00+wX3bSJxuI2Hc8PlsLNuPhRF1Ym:DFZg5Ztj00+03mJxmc8PfPwm
                                                                                                                                                                                                                                        MD5:1C7D0F34BB1D85B5D2C01367CC8F62EF
                                                                                                                                                                                                                                        SHA1:33AEDADB5361F1646CFFD68791D72BA5F1424114
                                                                                                                                                                                                                                        SHA-256:E9E09C5E5D03D21FCA820BD9B0A0EA7B86AB9E85CDC9996F8F1DC822B0CC801C
                                                                                                                                                                                                                                        SHA-512:53BF85D2B004F69BBBF7B6DC78E5F021ABA71B6F814101C55D3BF76E6D058A973BC58270B6B621B2100C6E02D382F568D1E96024464E8EA81E6DB8CCD948679D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]h.f................................. ........@.. ....................... .......b....`.................................L...O.......:................N........................................................... ............... ..H............text........ ...................... ..`.rsrc...:...........................@..@.reloc..............................@..B........................H........................................................................0..........r...p.*..(....*..0..........rg..p.*..(....*...]*.0..\.........i.s........+...o.......X.... ....2..o.......o........8.........-X....d....(......(....&s..........o......o.....1......o...........o....r...po.....3....+.s.........o.......o.......o.......o.......o.......o.......Lo.......o.......o...........o........o.....Yo.........+........(...........o....+....2...X.. ....?........+A..... ........

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:modified
                                                                                                                                                                                                                                        Size (bytes):26604
                                                                                                                                                                                                                                        Entropy (8bit):5.05566078212972
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:MSF6V3IpNBQkj2Nh4iUxGOPhfDwK6hXtHWrxMtAHkLH3MFNefyvCYo8YR:tF6V3CNBQkj2Nh4iUxGOpUKyXtWrxMtD
                                                                                                                                                                                                                                        MD5:4006065A6C506B3AE1EA1D6DBF476A7F
                                                                                                                                                                                                                                        SHA1:BE3A530DEFE631812F08CFE8ADA45B47384A270B
                                                                                                                                                                                                                                        SHA-256:88F575A6BAEB8008EF9B2D74D972F03DA701E478C92CC99D55346C993CA21909
                                                                                                                                                                                                                                        SHA-512:55B023AB4CE11616A34AC66E2A2F8553FC9EF2541834925FF8ACCE3FDB7C750FEEBD771A3D723751460CBCB866E3E8374FCD8A792E965C52EDA0941F87188CAC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:PSMODULECACHE.(...mM.}.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1........Set-DAEntryPointTableItem...."...Enable-DAManualEntryPointSelection....#...Set-DAClientExperienceConfiguration........Get-DAEntryPointTableItem........Remove-DAEntryPointTableItem....%...Reset-DAClientExperienceConfiguration........Reset-DAEntryPointTableItem....#...Get-DAClientExperienceConfiguration........New-DAEntryPointTableItem....#...Disable-DAManualEntryPointSelection........Rename-DAEntryPointTableItem.........e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScr

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1504
                                                                                                                                                                                                                                        Entropy (8bit):5.274978709903425
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:3ZZrSKco4KmBs4RPT6BmFoUvjKzu1o+m9qr9t7J0gt/NKmNUNEr8H0UMem:XrSU4y4RQmFoUL5a+m9qr9tK8NfUNEIa
                                                                                                                                                                                                                                        MD5:02428B15EF7C2F0BC41AAC18E5C1A47D
                                                                                                                                                                                                                                        SHA1:4E31939B08826865B502FA04A2E4B1E82E5EA782
                                                                                                                                                                                                                                        SHA-256:8E4708286289F6AACFFC54EBB21689E69C835E912DCB0FD9E74925DFED2BF6CE
                                                                                                                                                                                                                                        SHA-512:C2A431269A43DC84647AAA32B010B54FBBE21101B3DDCD88A7B31014BFA10F7498F65AEDF1EE96CB7FDD2B2345E5991B71076BB3E76C1A32C84E419C33D8FA3C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:@...e...........4....................................@..........@...............|.jdY\.H.s9.!..|4.......System.IO.Compression...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.<...............i..VdqF...|...........System.Configuration4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\NAo5jaAAmqipcIgVfrpEqrOC.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\NAw5Utgp8P611rdec0BR0MlI.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\NE6WkYn9fBQoC9a4gd2yFZXX.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Nx2ualF4WR83o8BLpmD9zVrW.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\OFqYXukHEjQzmQ3ijziOsyC5.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\PbrRyuOT2DJaFlbAzGY6neq7.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\R7igej85hEl8p5QzHqqsVcc4.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2204176
                                                                                                                                                                                                                                        Entropy (8bit):7.946698135836806
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:YF4+SacvZxqngqv+OIsAsaj46MBt3mGDDKHbxG2/MMF+9:YWvabnIlnMBtVqbx5NO
                                                                                                                                                                                                                                        MD5:9B38B95FC36FD9B330018EC18E7DEB9D
                                                                                                                                                                                                                                        SHA1:AF345696F24DB54679D45AAC9D9642D7F51355E8
                                                                                                                                                                                                                                        SHA-256:50666D01B555E2376B9CB9415309DCEAFCD7CE1F7C6B3DDCC66CFBC13B21B0C7
                                                                                                                                                                                                                                        SHA-512:AD0CD27DB2667A42A20751C0427EFF9DBFD4E3C1B2236781A90A99C5B60CFBFB045B40E43224EA68A9B805B654EE394FD40BB07200A625070DE813ACF1DC76B4
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....96f...............'............X`P...........@...........................g......c"...@..................................Q.......p.......................pg..............................`...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@... .........r..................@..@ X....p...L...D..............@..B.vm_sec..@.......@..................@....idata.......P......................@....tls.........`...........................rsrc........p......................@..@.themida. 5..@......................`....boot........`P.....................`..`.reloc.......pg.......!.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\TEpqQjIAfTfCTbePKUGsV0Gk.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Te8IoKHiu7i6R94P1wuixO8g.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000019001\amert.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1907200
                                                                                                                                                                                                                                        Entropy (8bit):7.950710520033503
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:Uo4WRoi4htfnraPcTSzaMfzqmzb9EkJluWq:UkiruvLTP+Qlun
                                                                                                                                                                                                                                        MD5:F94CAD2EA8087F7452D99C57BF5C935E
                                                                                                                                                                                                                                        SHA1:FA47755DBC5C9DD1F4A7D5E18DE9D7A4178C3E0D
                                                                                                                                                                                                                                        SHA-256:86DAADC6D16A6BE5012B517E4EF49316BAC7EF6AA1C86CFC26CF0719DE9F0F75
                                                                                                                                                                                                                                        SHA-512:BBF608153AAE2C0FA77CA8F66FF16AB03CFAECA321144577C8860EE0A535617A4F5D854A6AAEEDB42CE97275A20817E1889594E7D76C97BADBAA015AB62F99DA
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...o..e..............................K...... ....@...........................L.....h.....@.................................V...j.............................K.............................X.K..................................................... . ............................@....rsrc...............................@....idata ............................@... . +.........................@...tgqtxtnx......1.....................@...ouenqhoa......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1000019001\amert.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1907200
                                                                                                                                                                                                                                        Entropy (8bit):7.950710520033503
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:Uo4WRoi4htfnraPcTSzaMfzqmzb9EkJluWq:UkiruvLTP+Qlun
                                                                                                                                                                                                                                        MD5:F94CAD2EA8087F7452D99C57BF5C935E
                                                                                                                                                                                                                                        SHA1:FA47755DBC5C9DD1F4A7D5E18DE9D7A4178C3E0D
                                                                                                                                                                                                                                        SHA-256:86DAADC6D16A6BE5012B517E4EF49316BAC7EF6AA1C86CFC26CF0719DE9F0F75
                                                                                                                                                                                                                                        SHA-512:BBF608153AAE2C0FA77CA8F66FF16AB03CFAECA321144577C8860EE0A535617A4F5D854A6AAEEDB42CE97275A20817E1889594E7D76C97BADBAA015AB62F99DA
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...o..e..............................K...... ....@...........................L.....h.....@.................................V...j.............................K.............................X.K..................................................... . ............................@....rsrc...............................@....idata ............................@... . +.........................@...tgqtxtnx......1.....................@...ouenqhoa......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2204176
                                                                                                                                                                                                                                        Entropy (8bit):7.946698135836806
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:YF4+SacvZxqngqv+OIsAsaj46MBt3mGDDKHbxG2/MMF+9:YWvabnIlnMBtVqbx5NO
                                                                                                                                                                                                                                        MD5:9B38B95FC36FD9B330018EC18E7DEB9D
                                                                                                                                                                                                                                        SHA1:AF345696F24DB54679D45AAC9D9642D7F51355E8
                                                                                                                                                                                                                                        SHA-256:50666D01B555E2376B9CB9415309DCEAFCD7CE1F7C6B3DDCC66CFBC13B21B0C7
                                                                                                                                                                                                                                        SHA-512:AD0CD27DB2667A42A20751C0427EFF9DBFD4E3C1B2236781A90A99C5B60CFBFB045B40E43224EA68A9B805B654EE394FD40BB07200A625070DE813ACF1DC76B4
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....96f...............'............X`P...........@...........................g......c"...@..................................Q.......p.......................pg..............................`...............................6..@................... ........................... ..` 2~..........................@..@ 0I...P......................@... .........r..................@..@ X....p...L...D..............@..B.vm_sec..@.......@..................@....idata.......P......................@....tls.........`...........................rsrc........p......................@..@.themida. 5..@......................`....boot........`P.....................`..`.reloc.......pg.......!.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):329352
                                                                                                                                                                                                                                        Entropy (8bit):7.976897467568528
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:DFZcMaQk5oqtag00+wX3bSJxuI2Hc8PlsLNuPhRF1Ym:DFZg5Ztj00+03mJxmc8PfPwm
                                                                                                                                                                                                                                        MD5:1C7D0F34BB1D85B5D2C01367CC8F62EF
                                                                                                                                                                                                                                        SHA1:33AEDADB5361F1646CFFD68791D72BA5F1424114
                                                                                                                                                                                                                                        SHA-256:E9E09C5E5D03D21FCA820BD9B0A0EA7B86AB9E85CDC9996F8F1DC822B0CC801C
                                                                                                                                                                                                                                        SHA-512:53BF85D2B004F69BBBF7B6DC78E5F021ABA71B6F814101C55D3BF76E6D058A973BC58270B6B621B2100C6E02D382F568D1E96024464E8EA81E6DB8CCD948679D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]h.f................................. ........@.. ....................... .......b....`.................................L...O.......:................N........................................................... ............... ..H............text........ ...................... ..`.rsrc...:...........................@..@.reloc..............................@..B........................H........................................................................0..........r...p.*..(....*..0..........rg..p.*..(....*...]*.0..\.........i.s........+...o.......X.... ....2..o.......o........8.........-X....d....(......(....&s..........o......o.....1......o...........o....r...po.....3....+.s.........o.......o.......o.......o.......o.......o.......Lo.......o.......o...........o........o.....Yo.........+........(...........o....+....2...X.. ....?........+A..... ........

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1000071001\jok.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):311296
                                                                                                                                                                                                                                        Entropy (8bit):5.0817932970004
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:uq6EgY6i4rUjhYMLwPcologL/ejZWTACtAti0lcZqf7D34leqiOLibBOp:VqY6inwPDpKZWTA+AplcZqf7DIvL
                                                                                                                                                                                                                                        MD5:8510BCF5BC264C70180ABE78298E4D5B
                                                                                                                                                                                                                                        SHA1:2C3A2A85D129B0D750ED146D1D4E4D6274623E28
                                                                                                                                                                                                                                        SHA-256:096220045877E456EDFEA1ADCD5BF1EFD332665EF073C6D1E9474C84CA5433F6
                                                                                                                                                                                                                                        SHA-512:5FF0A47F9E14E22FC76D41910B2986605376605913173D8AD83D29D85EB79B679459E2723A6AD17BC3C3B8C9B359E2BE7348EE1C21FA2E8CEB7CC9220515258D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)v................0................. ... ....@.. ....................... ............@.................................t...O.... ..............................X................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):162304
                                                                                                                                                                                                                                        Entropy (8bit):7.964021035934757
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:v5JKjGc9pOW1Bg7ayW1QSZP5+fZ1mlUQj2s:hgGGpZQao+P5KboXj2
                                                                                                                                                                                                                                        MD5:317465164F61FE462864A65B732CCC13
                                                                                                                                                                                                                                        SHA1:5B78C41AD423766E9AADAE91F902D14A922C8666
                                                                                                                                                                                                                                        SHA-256:95674CB006BFCA36CD0E0F9B80EF0ED240C64F2EE955D9DD4AF8102A0C4D9806
                                                                                                                                                                                                                                        SHA-512:9BC4846A92B7B25E973B42C2CD4895DD15132D0FA1D9EE62E8D7E3679E8BB3B75AE9FB5C6FA165AF0F77EAF3E3F75A4D7F60057A0CB22693FC80D89390D09046
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C29f.................p.............. ........@.. ....................................`.....................................O.......@...........................T................................................ ............... ..H............text....o... ...p.................. ..`.rsrc...@............r..............@..@.reloc...............x..............@..B........................H..........................................................................]*....0............i. .......... .............+C.....-!....d....(......(....&.........+.......(...........o......X.. ....2.....+<..... ........ ..............XX.. ....]...................X.. ....2........8.......8......X ....].....X ....]...........&............o....r...p(....s.........+...r...po.......X......2...o.....16.........o..........X ....]..........%q........a........X......i?P......X.....?:.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):534152
                                                                                                                                                                                                                                        Entropy (8bit):7.7304359776027685
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:jpDxMM2vWugFMfmKL9ZVvwtgEOy9bxKdyH6WS2Fft:19MMYzftL97sgoKOSU1
                                                                                                                                                                                                                                        MD5:C1D583657C7FE7973F820983FD1ABB81
                                                                                                                                                                                                                                        SHA1:4CFADA887AF87F32224FCA86ED32EDCAC00EDBEC
                                                                                                                                                                                                                                        SHA-256:DF65905B3F10C47B81AB22EBE370BAB5DB1A38D511338E6E8CC1FF7294A61744
                                                                                                                                                                                                                                        SHA-512:2DC55BBF18CA62A8E5834D7341A646D3EA082ECA7E28AD9C75F72E5813EA46CF10AB9FA98D7AB2F2830633F438AA19F2EB4AF768DEE4B7A130F8EEC17936DD88
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..../............"...0.._............... ....@...... ..............................S.....`.............................................................(............................................................................................ ..H............text...._... ...`.................. ..`.rsrc...(............b..............@..@........................................H..........8....... ..................................................."..(...+*Z..s....%.}....%.}....*"..(...+*Z..s....%.}....%.} ...*~s!...%.}"...%.}#.....$...s%...*~s&...%.}'...%.}(.....)...s*...*"..(...+*Z..s+...%.},...%.}-...*"..(...+*Z..s....%.}/...%.}0...*&...(...+*v..s1...%.}2...%.}3...%.}4...*&...(...+*v..s5...%.}6...%.}7...%.}8...*"..(...+*Z..s9...%.}:...%.};...*"..(...+*Z..s<...%.}=...%.}>...*"..(...+*Z..s?...%.}@...%.}A...*"..(...+*Z..sB...%.}C...%.}D...*"..(...+*Z..sE..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1000079001\gold.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):578048
                                                                                                                                                                                                                                        Entropy (8bit):7.272707802677416
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:D/fI5jU8KHNXx/WRjeew+6P5zwMzAbPxlj6M+KjLHo:D3IYNXxya9+TMzMTj6rKjb
                                                                                                                                                                                                                                        MD5:F15A9CFA3726845017A7F91ABE0A14F7
                                                                                                                                                                                                                                        SHA1:5540AE40231FE4BF97E59540033B679DDA22F134
                                                                                                                                                                                                                                        SHA-256:2DEC75328413D4C278C119DB42920FB183A88A5398D56ECC80C8CC74FBA13071
                                                                                                                                                                                                                                        SHA-512:1C2AF9608736AD6A02D093F769FE5EC5A06CB395A639E021D4EE3F6C46CEBC8C101E7DB1064984F801AD3BEE65D81B95FE6E2E60C0EC949BB172BA9C455B9869
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(tY.F'Y.F'Y.F'..E&U.F'..C&.F'..B&L.F'..B&K.F'..E&M.F'..G&\.F'Y.G'..F'..C&..F'..C&X.F'..D&X.F'RichY.F'................PE..L.....4f...............'.............a.......0....@..........................?............@..................................0..................................l......................................@............0..<............................text............................... ..`.DAX.........0......................@..@.data...T...........................@....Left...............................@....reloc..l...........................@..B.INV.........0......................@...........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1000080001\alexxxxxxxx.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2831872
                                                                                                                                                                                                                                        Entropy (8bit):7.076550333890677
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:jOvdoJl7MWepyIsE7ddkxuq8rW5vs0VaCQeb5tsQcGo:GYIscWxuq8rUlVaCQo5tsQG
                                                                                                                                                                                                                                        MD5:31841361BE1F3DC6C2CE7756B490BF0F
                                                                                                                                                                                                                                        SHA1:FF2506641A401AC999F5870769F50B7326F7E4EB
                                                                                                                                                                                                                                        SHA-256:222393A4AB4B2AE83CA861FAEE6DF02AC274B2F2CA0BED8DB1783DD61F2F37EE
                                                                                                                                                                                                                                        SHA-512:53D66FA19E8DB360042DADC55CAAA9A1CA30A9D825E23ED2A58F32834691EB2AAAA27A4471E3FC4D13E201ACCC43160436ED0E9939DF1CC227A62A09A2AE0019
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B............C......C..9...C......R!......R!......C.............R!.....c"......c"......Rich....................PE..L...w.(f...............'..........................@...........................+...........@.................................0.*.P.............................+..I..0m..8...........................Hl..@.............*.0............................text............................... ..`.rdata...M.......N..................@..@.data...............................@....idata..*.....*.......*.............@..@.00cfg........+.......*.............@..@.reloc..qh....+..j....*.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1000081001\install.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4448942
                                                                                                                                                                                                                                        Entropy (8bit):7.996740744908945
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:98304:zgwR5qybOM3rY1buPd0+01mQ5YBGUYDU4a6FXg+d70MYVSuEQQpnlJYtDf+8:zgDyaM3qbA0+07YBeDa6a++b5Evn4tF
                                                                                                                                                                                                                                        MD5:0F52E5E68FE33694D488BFE7A1A71529
                                                                                                                                                                                                                                        SHA1:11D7005BD72CB3FD46F24917BF3FC5F3203F361F
                                                                                                                                                                                                                                        SHA-256:EFD29C35766C607AA15D1CB83DEC625739791B1616AD37D5B47E78CDB8A42CA8
                                                                                                                                                                                                                                        SHA-512:238FBB1C04EEF2F2005CB7ABF0223E3CD062D9D2840966292E19DCAA495609E134A0BDC35389AE9925ECFC787A13772D3AC7B29058579F702BC849DD0343C400
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L......P.....................\....../.............@..........................P......3-......................................t........0..................................................................................l............................text.............................. ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc........0......................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.c...P....Y.nj'.S....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.f...Y.r8..j...t.A...t$..D....V....s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.d.....3.9F.Y~.9F

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1000088001\NewB.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):428544
                                                                                                                                                                                                                                        Entropy (8bit):6.494348537450964
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:5noAx+FnmuQhimtPURimLqevmipum+K4Y:5+FnmuGtpMLnLYY
                                                                                                                                                                                                                                        MD5:0099A99F5FFB3C3AE78AF0084136FAB3
                                                                                                                                                                                                                                        SHA1:0205A065728A9EC1133E8A372B1E3864DF776E8C
                                                                                                                                                                                                                                        SHA-256:919AE827FF59FCBE3DBAEA9E62855A4D27690818189F696CFB5916A88C823226
                                                                                                                                                                                                                                        SHA-512:5AC4F3265C7DD7D172284FB28C94F8FC6428C27853E70989F4EC4208F9897BE91720E8EEE1906D8E843AB05798F3279A12492A32E8A118F5621AC5E1BE2031B6
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\1000088001\NewB.exe, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%..........................PE..L.... Me..........................................@.......................................@.................................D...x....p...........................L..P...8...................,...........@............................................text............................... ..`.rdata..............................@..@.data....F... ...4..................@....rsrc........p.......:..............@..@.reloc...L.......N...<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\fjL0EcgV6Y.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1804304
                                                                                                                                                                                                                                        Entropy (8bit):7.951520514641467
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:haJmLsU7YRCWfNHICNUMjSd2HZmSTI3G/kPdLmas2:haJksZyCiMnk2cVq4
                                                                                                                                                                                                                                        MD5:6BCAB686349807F131A92C8FE7A4D736
                                                                                                                                                                                                                                        SHA1:487846C6D51F8DF894BB174542A81FD0EB25E1AE
                                                                                                                                                                                                                                        SHA-256:CCABD5BC8499C485E7ABAB1825F67A753A8CCFC822037F2368E3C6FA5F570926
                                                                                                                                                                                                                                        SHA-512:94E16B6336A1205CF624F8FCDBB2E32A2E85BE93A483D87369E3CD85B12A31F31A908C730709F40A91D0AE6A173554C66229BB44D4AC2295C29073741CE9014A
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...yO&f............................X`<...........@...........................T.....)&....@..........................................0........................T.............................. ...................................................... J........,.................. ..` N........V...0..............@..@ .E... ......................@... .....p......................@..@ .K.......0..................@..B.vm_sec..@.......@..................@....idata..............................@....tls......... ...........................rsrc........0......................@..@.themida. 5..@......................`....boot....|...`<..|..................`..`.reloc........T........................@........................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe:Zone.Identifier

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\fjL0EcgV6Y.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:modified
                                                                                                                                                                                                                                        Size (bytes):26
                                                                                                                                                                                                                                        Entropy (8bit):3.95006375643621
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                                                        MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\CaDLjLgaJOb2EJDbtX6Wfco.zip

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):3713
                                                                                                                                                                                                                                        Entropy (8bit):7.901636657129721
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:w1aOVoqxCZoPBBpiU7SlCw5CaJqGZpTs3KJnP:kaOVNxXB+tlCwns6JP
                                                                                                                                                                                                                                        MD5:DE81A773519414FFDE70B7268C8B118A
                                                                                                                                                                                                                                        SHA1:523395431C30E387C42B00973A83A3A14A993FBF
                                                                                                                                                                                                                                        SHA-256:8C36AB625F844F2170D5715C97EEC9CCAD06406FB86858086C52EB7E18A46741
                                                                                                                                                                                                                                        SHA-512:6C15471AC98F0E204E957ADB11F6425F56756831EF49DE009BA9A333215827C06345FC5390554866E986D496BC1726AD739C019E3751385B9BE20790B3BBE194
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\CaDLjLgaJOb2EJDbtX6Wfco.zip, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:PK........4..X.._.l....$......information.txt.ZYo.J.~....4/../.P@..[.....w....&f......S......j.>|u..,......g...E..0.Q....K....C.L.4.Q.c.$I.....3.......Z..m.%..L.T..Tb>a..O..^<)H.`...[&...q......",?.`.O.P..Y@{.dB.........u......B...MK..F.A.c.!.[.........o#....3.....a.....J.H...a..jn...y...K...~.7.>..Z..{D...$r.....5..R.G0..i<K@!%.s..% 3i:&...... ..3U....0o............3.....?K....%f...H........%4........U.5..Z.Aol0Hj..q.....o<....Co.Y..&.....q...;s.>U_..Z.....>a.....+..8p.jK-7X..S..o.eDx..M.R.R.JS.8...y....Q..l.ze...2........$..1.)U...u~B.j.%BdY.7.P,K..3#.....H.I...r.Y...N.%.k..z...Y.V...H.3v-).l..$..r1....)N./.J.1.K7N...K..k..q.O./.5...\.A.8....\D.w.N2.... .)DN..h.2.2..t&.b3.H.>..Z..E..EN.$v.."...b....D:w.>.......F..R.....ZA.d|G..V....^ .@\p.da.&..9.Rp..;.p....T.~..$..e.+....";..q..^..kj..].......P.3V...B..w(g.6a..........F..%+.o2X.%.A.qX.U=.Z............$E.!.3..@R.G..s..X?...._D.X...S..IQt.dD.>+q... R....:..G.........b>.;%.A....l3~..aN.01..C

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\FBI40obsDIWEYEPEV328oLc.zip

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):3715
                                                                                                                                                                                                                                        Entropy (8bit):7.899230226389778
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:98OT2aiHqeY/fGYQeyHr4Wow2RkFe8UTQdoObGyTsqALRUFTFBrBH7CsjfdsA6Py:wlKNXk+IfhdoODTsjdsjfuA66e3KJL
                                                                                                                                                                                                                                        MD5:4FCFF76571A097FCDF8E7D11CD2D1CA5
                                                                                                                                                                                                                                        SHA1:439826A0BF06600A2642151BB985A83B69D68039
                                                                                                                                                                                                                                        SHA-256:958F04A8D8A8C79F87D8F7D5E123DFE5944937FB66F12193CBECBCD63A647853
                                                                                                                                                                                                                                        SHA-512:B3751DADD63D8D91F9739F86F855DB2EA11F50FD9CE066C751980B788F0E09180950C1D01F594731AF0999159DF244E3AD358F8862349F44C15566329DCFC0B7
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\FBI40obsDIWEYEPEV328oLc.zip, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:PK........4..XG..Rn....%......information.txt.ZYs..}w...".;.5.jQI...c6..L.<...2Z@.....)..n,nt....:..yr.E.R..%+.....F...........3...8.R.<I.*A...g,.. ~....h..,..`.........P~ZZ..IA2.KM].2y|hM2....Y*.........O...'M&.8.O'....^g..q.n.5y...4.lD.D:F.2...i...Y.?.....4X1.h....2.....2..c.o....@..~..T-..N.....,.6R..5%.{<.8......2K....RalT.Z.2||..$......>=H..Lu79=>,....&..z^..Yzb......g...d.B....y|...6Mh$.M...cE...k6.uZ...`........M7.z,.#..^.[..&.....q..V...C....zZ.fd_.0...s..c...........).....Dx....R.Q...R...E....q.dl.ze...2........$..1.).....~B.nL$BdY.o..,?[.gF....4H.I...j.Y...^...k..y._..s.(.C'.jf.ZR.E.6.I....b...1.8...+....8.N./......Y>I....g+.........7......../\.A.S..)...e..2V.L..f1.(|.....r...0H.h..X....4R...).._>rso...DH-.r.n4k%...../.[....z...q.!......@J......eJ..2Y..!..~#.I...Gw.W...r.ErgzU+...e*t...^..rZd.<.\....C9..C/._d.....4...-yQ}...-y....j...f...xX..x'.......dw..I9..Z.e..r..2...!B..D..z.N..;&#..Y...m..r..&...=z.z..G.. ....)!..~..g....s...

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\TmpE3C7.tmp

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000071001\jok.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2662
                                                                                                                                                                                                                                        Entropy (8bit):7.8230547059446645
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
                                                                                                                                                                                                                                        MD5:1420D30F964EAC2C85B2CCFE968EEBCE
                                                                                                                                                                                                                                        SHA1:BDF9A6876578A3E38079C4F8CF5D6C79687AD750
                                                                                                                                                                                                                                        SHA-256:F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
                                                                                                                                                                                                                                        SHA-512:6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:0..b...0.."..*.H..............0...0.....*.H..............0...0.....*.H............0...0...*.H.......0...p.,|.(.............mW.....$|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%..*.X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...|B.d..kr.=G.g.v..f.d.C.?..*.0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\TmpE3E7.tmp

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000071001\jok.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2662
                                                                                                                                                                                                                                        Entropy (8bit):7.8230547059446645
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
                                                                                                                                                                                                                                        MD5:1420D30F964EAC2C85B2CCFE968EEBCE
                                                                                                                                                                                                                                        SHA1:BDF9A6876578A3E38079C4F8CF5D6C79687AD750
                                                                                                                                                                                                                                        SHA-256:F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
                                                                                                                                                                                                                                        SHA-512:6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:0..b...0.."..*.H..............0...0.....*.H..............0...0.....*.H............0...0...*.H.......0...p.,|.(.............mW.....$|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%..*.X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...|B.d..kr.=G.g.v..f.d.C.?..*.0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\VuTSwQVdPxyUu9EXsE6w3ql.zip

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4389
                                                                                                                                                                                                                                        Entropy (8bit):7.852518313791285
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:aZV//Q1vcq8Lv5co2bxpIrr8n92piXdU65tGNUeJtF/VWsV2od1NMy3KJc:aZVXK8LvaEdQpGT7VJd1Ky6Jc
                                                                                                                                                                                                                                        MD5:4B4023C9ABAC17C3BA05F4753284985E
                                                                                                                                                                                                                                        SHA1:B2B406FAE0DB9493C1B9C20480F60B6097C070AD
                                                                                                                                                                                                                                        SHA-256:1E2DC8ABA6583FB62C9F0021F30E6F4F445DB369573CD1D6A8682FB837EE9CBD
                                                                                                                                                                                                                                        SHA-512:BFF818D6CC8D52AC58C1559A3CDD7D06311BD33D69E741A287ACBD362BD8A7779461EF733870A1BC919B7B0DAAB6A2F67988BBA5760CB22FE3EE33432742941F
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\VuTSwQVdPxyUu9EXsE6w3ql.zip, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:PK........6..X................Cookies\..PK........6..XA.`%............Cookies\Chrome_Default.txt....@.........i.&h.Cn..L...\.FA@.~..v7..O...%!es.f..../S..a...@.,ek.%.H......</<2..,...I..w......1q.f.F+PiM.=h.5..2....0....O..u_.~}Z.UM........y...Rj..4H..D...xLY@....[.d.c&......G_............j%q%....Y.|.....P...u..u..85/..Z`...-..c...^A8n...Y.3......j.G!....c.....AM@!._W.yQbs.@.....h.y.-......|J..i...r....c....M...E...GS...C....X..C.U..v.%......C,.L0,......5.=....6.....PK........6..Xpgd....c%......information.txt.ZYo.J.~...`i^.5..kq.... ..b..{..]../`.u4.}.eLB.UWZ-..Wg?.N.y...,Y......4..0x.`I~|x|...}..;*..$.....z.}...mZ+7...S...O.J.'.B.ia.'...,4ua...>J..5..T..'.,...J.4.hO.L(q.....=>.MR....\h..9.ii.. .t.0dt+..0..Ty.mD.22}....m.7...C.....$..R.8~.3...`.....f..B..~.....D..T.f.^,.Z.Sy..Y..)1.KH-..Q.5.w.h./.C..,.Tq....aH?.$t\..>KOL.7..C.,]>H@....#..y|...f..H.>....T.......#.AR./.s.X..x.h.i.z.L#.5....[f..K.......NO......Y-Xzn..~..7.....K;..J......4tS..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_Files_\IPKGELNTQY.xlsx

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1026
                                                                                                                                                                                                                                        Entropy (8bit):4.695505889681456
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
                                                                                                                                                                                                                                        MD5:3E1BF32E65136B415337727A75BB2991
                                                                                                                                                                                                                                        SHA1:4754D2DD51AEC8E287F0F298F5A81349578DEB56
                                                                                                                                                                                                                                        SHA-256:448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
                                                                                                                                                                                                                                        SHA-512:16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_Files_\MXPXCVPDVN.xlsx

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1026
                                                                                                                                                                                                                                        Entropy (8bit):4.698669844484375
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:7mMbmx9UKbA2JHc6cqYGtPrmwXr33hecYrnpTGwrhq0Lf6iNXQp:JI68rJcqjPSwXzRecYhGKq0LLG
                                                                                                                                                                                                                                        MD5:4FCF725C73B93BE52C2E1CD48AC3A562
                                                                                                                                                                                                                                        SHA1:98118BDED7CC2397C19310A914C6CA6B39CC47DE
                                                                                                                                                                                                                                        SHA-256:3803B68C31F1D6091C8D35F7B737B363C99ABED15B65899869E2A5AFA443D2C4
                                                                                                                                                                                                                                        SHA-512:8EDB10C8C81284109073EAABDB337F2AF5428AC5A50DE4999B61792D434D099124DF2DB5B2F58E9FC6335EA2E6F474291F8726DEF293A409418CDE6E0D5D7CFC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MXPXCVPDVNZDMRYXKAXPKZSKXQENMVJGASOKSKKVKMVTFWCKJVQUEHFJLYGAGVTAPSEFWLYDESGESNCQQMFQIJOIYCFNJODSXZOERROXNDWXBZRWZFOKQBPLORLXBDLECIGMCKVUGLWKNMZJBHPGARIQDCSYHCPUKBGABSYSPDCWIMLINBEYVYXKDRVQIRPITEAVGQTKEJGNRGJGNMXLAZZZEOVLCHVHUAHQLECFOLMZPDMGFZOZZRCUGUGQXZRQEEYVPMGAXSRCPXPOCBVPESPOAHTWHHDKCHMXTJCJJDRFYUOIUWGYDNCJXDYQFYCADMQIYTSLSIQVEMFCENTOHNQNWXMKIUOZDFCOFDXWRGCINHQCHYKQMLGTDJSTFEPKLURPPUWEFYLYEFPSNQGBKUZJQDAVMAFGFXHFNGMNUPXAYGABBOYSAPGCMGQZYDGMRINVJWRFASDKOFXOQBOCWTMIFSMCIGFJLECWNXSPKYYMZPZTTKDCIUUBZTJKBGNEDOBUUIKPGSXPUUDSIAYBARDMCGXUVFSTYNWEUHFOSOADWNJSVGVNYVPTFIEGPCWGLEJGVLKBVQHFEPYYRMGWPMKQWLBOAFFRZQRDMFIHCLMXYKGCSNXZKWIKKIILSRZRKNKBMQKPDNBOSZDCMCNAMVOVGTUYRVJHPAMTCIPJHQZLFPQNHPQQTDAETXQMKGTZQPDKQISDDHIQFGGWJPCMAAAGGRYLKNAQHJDFVXQSDDSPCOTQDHQLRMFKVLQAFIBPIEJVVBHAMXWNJDJUFWZAUYOGKLIJAKPXHFCOGJJVGZXSWYIBAKNZMMSVHMHLNHNJCCWYZMEJWSAERLVHQEHUTACSGGGRMLAWNQTJDBBGLANCZUNRXUOYFLZHFFWFLDWPBOZWIRWKAIWLBOQNNKCSLPLMPBIDNPIJQEDKYXMBPUFPZCWHQURUYJBENNRMTLHPICTOSJUUPWITJRCCXDXEHQQYLVPFNZKWXNGEGYNB

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_Files_\SQRKHNBNYN.docx

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1026
                                                                                                                                                                                                                                        Entropy (8bit):4.699088014379539
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:iGmuvXb+mVV5Ule86OuFXvk64KaOMJQaJO7tZAWPN4rOnsK:/muvL+mP5Ule86OuraOMJZOHADqf
                                                                                                                                                                                                                                        MD5:BF469DD8C21F5160EACD49BB59E9A370
                                                                                                                                                                                                                                        SHA1:2CE4942C6CD2E22A644BAAFAED41DF9D0773477F
                                                                                                                                                                                                                                        SHA-256:9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
                                                                                                                                                                                                                                        SHA-512:FBBB805B4C65902C67F2F432BA20FFF689FABDB3652702FA176369107F688C43923C9D729095F313425847E14B138E61117ED6C03E582F82B6426BBC2C481380
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQRKHNBNYNETDCILWIKLNRYHJZUPCYVTJJKABYYNVEJZBFJGIUZEFUHCOZZISQELZULMAPFIBUSVGGSXSVZRNJXFVUEIKBQNARELKJEJZTEBGXIFTBGDXBSYFJKFICMLOMHZZSIJMPIXZMQULHAZWNOCSCLWTNJMCGVQAOPYTZVRLCKSUPSMWVOFCPJAONGQBPLMQUTZSFYRIBDZWBXIEDJISMCTGTYKEIXWVDVOGMFUNRJDNEGJLVWNACBBGIIRTAHGUMSLSIZNGTRAUGMZTVGLIAKLLKJGKBMXIFPOYCQXJZKJHTLNZGDCLMXTYOBGFAPOQCJGRAKORKGGWPBOJLOZATKDZYFDSONUZOGBFRDBUKZTVYZGXDEWUOXNWHMOIBVOWNWFGBHSDTQQKXWZEHQLAYIXOVZEEZNESKKWITYPIDCMFHTWVHMHFCGNEBNVBSSQHMRSWLHVMAZERIUFTRXEVZHKRXWOMGETJJFBRLFIBRGLAQKLDFZEGHLZSVAMXMNCCUROXGQOMDQJSKUNOGLGYYTVABESIDHASDRACLOFEWGPYLEORXSYDRDGPGOXHIAISBZBDRNVQJXXIBNBXMDSKXPBSCGKGPASGNOIDKIBFJWUIRQHZLXZQVHUEHMHTRDWKGJVQHWFQEBJIBQLDWQHOQLXSPFPLWPYZROYDAQOOOYKTPVFQXLMLRDYSVXVAWCEGVSHGDVSHONQUAVCBBHJRTIJAYXUILHNGHIXFJPJFAUDIJFORYJZHNAXLWYBLWKCVJLUJIGBYGSEWFJFIROQQXBVEJEPGVYKSDGTPKJAXDLAEHUXWDHSNXZPAKHXDOWTIFIVFZHYQJCDKOBOMCFVMEKARJULRZEOXVQKSLPWYLMLCYLKXCIELPAZNPRENTCWPNMFETAJHSENFDLPGHKVHIIHECDTQGWZMNTMEHNJFXFUGFJMWUXXGOIHOBSONRLSITUXOCRFNCIJNPHZABGDPAFATRMRCPXROMUN

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_Files_\SQRKHNBNYN.xlsx

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1026
                                                                                                                                                                                                                                        Entropy (8bit):4.699088014379539
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:iGmuvXb+mVV5Ule86OuFXvk64KaOMJQaJO7tZAWPN4rOnsK:/muvL+mP5Ule86OuraOMJZOHADqf
                                                                                                                                                                                                                                        MD5:BF469DD8C21F5160EACD49BB59E9A370
                                                                                                                                                                                                                                        SHA1:2CE4942C6CD2E22A644BAAFAED41DF9D0773477F
                                                                                                                                                                                                                                        SHA-256:9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
                                                                                                                                                                                                                                        SHA-512:FBBB805B4C65902C67F2F432BA20FFF689FABDB3652702FA176369107F688C43923C9D729095F313425847E14B138E61117ED6C03E582F82B6426BBC2C481380
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQRKHNBNYNETDCILWIKLNRYHJZUPCYVTJJKABYYNVEJZBFJGIUZEFUHCOZZISQELZULMAPFIBUSVGGSXSVZRNJXFVUEIKBQNARELKJEJZTEBGXIFTBGDXBSYFJKFICMLOMHZZSIJMPIXZMQULHAZWNOCSCLWTNJMCGVQAOPYTZVRLCKSUPSMWVOFCPJAONGQBPLMQUTZSFYRIBDZWBXIEDJISMCTGTYKEIXWVDVOGMFUNRJDNEGJLVWNACBBGIIRTAHGUMSLSIZNGTRAUGMZTVGLIAKLLKJGKBMXIFPOYCQXJZKJHTLNZGDCLMXTYOBGFAPOQCJGRAKORKGGWPBOJLOZATKDZYFDSONUZOGBFRDBUKZTVYZGXDEWUOXNWHMOIBVOWNWFGBHSDTQQKXWZEHQLAYIXOVZEEZNESKKWITYPIDCMFHTWVHMHFCGNEBNVBSSQHMRSWLHVMAZERIUFTRXEVZHKRXWOMGETJJFBRLFIBRGLAQKLDFZEGHLZSVAMXMNCCUROXGQOMDQJSKUNOGLGYYTVABESIDHASDRACLOFEWGPYLEORXSYDRDGPGOXHIAISBZBDRNVQJXXIBNBXMDSKXPBSCGKGPASGNOIDKIBFJWUIRQHZLXZQVHUEHMHTRDWKGJVQHWFQEBJIBQLDWQHOQLXSPFPLWPYZROYDAQOOOYKTPVFQXLMLRDYSVXVAWCEGVSHGDVSHONQUAVCBBHJRTIJAYXUILHNGHIXFJPJFAUDIJFORYJZHNAXLWYBLWKCVJLUJIGBYGSEWFJFIROQQXBVEJEPGVYKSDGTPKJAXDLAEHUXWDHSNXZPAKHXDOWTIFIVFZHYQJCDKOBOMCFVMEKARJULRZEOXVQKSLPWYLMLCYLKXCIELPAZNPRENTCWPNMFETAJHSENFDLPGHKVHIIHECDTQGWZMNTMEHNJFXFUGFJMWUXXGOIHOBSONRLSITUXOCRFNCIJNPHZABGDPAFATRMRCPXROMUN

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_Files_\UOOJJOZIRH.docx

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1026
                                                                                                                                                                                                                                        Entropy (8bit):4.694311754777018
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
                                                                                                                                                                                                                                        MD5:61908250A5348CC047FF15260F730C2B
                                                                                                                                                                                                                                        SHA1:CBCF34156EAE25B328A926E21008598EE8D1CBDE
                                                                                                                                                                                                                                        SHA-256:8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
                                                                                                                                                                                                                                        SHA-512:BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_Files_\VAMYDFPUND.docx

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1026
                                                                                                                                                                                                                                        Entropy (8bit):4.690028473124583
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:nCtOJ8AJzDzL/RXD03mp5reBXnqW8rdYu942ZCpjtJHU2coh:nsnA9/Z03y5qXnD0Yz0qjtJpN
                                                                                                                                                                                                                                        MD5:1E5D6B27E451F2406E5ED97F51985EE1
                                                                                                                                                                                                                                        SHA1:EDE59763DC7E1275594BDBB4EF90F9FEE78E946C
                                                                                                                                                                                                                                        SHA-256:A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
                                                                                                                                                                                                                                        SHA-512:619426DCC7B7C18488EC96D5474A5AA62EE4B1E7B52D8550B6A875AF0A19E02772D30142D9DC6986750732671605C7FF31E1F919CC6D121531ECBF0AE092E215
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:VAMYDFPUNDEKDDABFYGQUEJPDEJQRXUZJGWCCCFXBISLBAZPZFZUOPASIBSPZLUDDUPRUHUUIJHOSYOAZNPTVHZSOVZRGZOUKAQEHTNLFNGLYDYUCGZPLLLOEHMTCCHZKQTFZGYFXUPESPRXRPJCGBDDSERLKFESFYUBNGVYLYUPKGUHNHSJITKDYFMCKPMQIQVZAFMCKDCYROFZHMGJMQRWYUHYHVRTNVUYOJXTDHGZTNEIQMQCBZXDPFJFNGRNBVMQWFGMLOWQCFSJCOQJGHEUOCLNTWHNHAGOTODKZYNINGMKGKTSEOLBKYRISYDHZOZINVXDDFVINOGNYWBEAYTTXSMSWAEGHZLSECWGHVUJJVTTQREREZKVNURFBXKMFFSJVVWOEKHLPTCOWUJHWSDFUKDNLAGSWYUGJMRJXXQRDDRLFRUUNRAXNLOUYXFWKVJGUQJJHPLTQELSOSFVIKIJHQPVLNQGQRDFLHUOUWYTAHHQSFZQBHLQJWUJVJPUBUAQTFOTVGLOZARCSHXCGYQYIDNDEHNFGLALSEIYWKOMVZTQBJZGRBJPSSWZPZKRLWDCYXTKIVIEXXRVZGNCFGSOUZLWFLDVXTEBFKTOHHOOJYSVZPFZXBJVQSOAXJEZIKYMAJHZMJPCAITWVFULTXNZLTXOUQONILVMPIEJGACXWGOEWJOJBLQJHQVHEYUQGLOZPDZOSSPVSZDXLGREZBQIVSASMXXLOQBKYWGPWRRHSSMYHGWBDFPDMXUISJUJUHAMPPRVABJXFEHOJLFPPRVMCBCSXCBNPGOOXIZIQFZDERGWQTALQWJYKPHMFIFYATLSCGMSHBWQYFHEGZQGQPMOIIHVVZQXVAUPPNJCVRKBVFXELRZEQZPLXOQQSXNGDZEGAJZDGSCYSLPQBSDTSQNIRNOZGTIBFJTEPZSUWIUBLEIVPBBHHLLIQQIUIIUARIYFPPNOAZPLXJGSPZJIXJTYLKJEEICOIZEUUYWP

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5cmcx21g.zpw.ps1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_km12qqvk.nkt.psm1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2jfdpyq.lma.ps1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oc4saqum.gef.psm1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p2ugnd0w.e1r.psm1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_puxxd42g.os4.psm1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tzbroxh2.4qt.ps1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zckvi1fc.cua.ps1

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\bz4iHvznQtQ52p38FhmsRD6.zip

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4339
                                                                                                                                                                                                                                        Entropy (8bit):7.847212534963198
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:aZV//Q1vcLTU/n1BiOO8p7IcC1zXEiCspXcdRmhqSu15kkOug3KJMz:aZVXrT41jN9daXRCsW+uwkOF6JMz
                                                                                                                                                                                                                                        MD5:4839F6674DE5370B14AF297C40B5DAD5
                                                                                                                                                                                                                                        SHA1:CD1AB6A831423AB52FF6DADD20F54E3E2847153A
                                                                                                                                                                                                                                        SHA-256:EA82432970F0562E0282960B85DA67355398C87CD34E8462A42A99C7EE45C688
                                                                                                                                                                                                                                        SHA-512:616A6871863B4A6718DBAF9A5474B63681C27F25E8F7D49FEB29F53A77DC2058907404EED65CB0779CC2D2DFFCC49EC7196D3DB5BA31710985F2AB9EA4547857
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\bz4iHvznQtQ52p38FhmsRD6.zip, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:PK........6..X................Cookies\..PK........6..XA.`%............Cookies\Chrome_Default.txt....@.........i.&h.Cn..L...\.FA@.~..v7..O...%!es.f..../S..a...@.,ek.%.H......</<2..,...I..w......1q.f.F+PiM.=h.5..2....0....O..u_.~}Z.UM........y...Rj..4H..D...xLY@....[.d.c&......G_............j%q%....Y.|.....P...u..u..85/..Z`...-..c...^A8n...Y.3......j.G!....c.....AM@!._W.yQbs.@.....h.y.-......|J..i...r....c....M...E...GS...C....X..C.U..v.%......C,.L0,......5.=....6.....PK........6..XOm.x..._%......information.txt.Z.s.L..OU..........@.........*.E..85..4.....T..........9......aL....g........gi..R...$U..3B.../.?.-{...Q{.t.0YP..V...U(?-lg. .......<>.G)...B....D.m=.@.f..I..%K.......I.^..n-4y...ek.9. .t.0dt;.....T}.=....i.bj..wy.e&X.[.my......2.@..~[.Rm.r...=..I.m....rJ"..7.x.Mh.F.I.|..BJ..%.......g....._R...Y*..&....).(.p.z^..Yzb......g..E..dF...D........'4.:......U.5.......d.T......M7.z,.}...>..@M>1-.......?.T}}|x...........<7^K?F..PGzs....?....V..O...

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\rage131MP.tmp

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13
                                                                                                                                                                                                                                        Entropy (8bit):2.045841640885174
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:LjHU:vU
                                                                                                                                                                                                                                        MD5:28FF3F62DF28D461A9488651B1DE1D9B
                                                                                                                                                                                                                                        SHA1:192BA553332069FE59D87EE52DC846BF479F2700
                                                                                                                                                                                                                                        SHA-256:E6EEFA76EFD6788BAD0B516C32CB85359E5817A3CBA4263A31860BAEB949D260
                                                                                                                                                                                                                                        SHA-512:1EF03AB81384A53147CF6220110B34FD246D42D6AA90732620237C3E059BD89B53EA737CD255A576CED93C673895C8E62C88D8CA616674E5CC9207FAAFB0223E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:1715113100571

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\rwhVS5Gl_u4JEiZA0FdJsuV.zip

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):3713
                                                                                                                                                                                                                                        Entropy (8bit):7.898977270425516
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:ZDXqhu71ICKGPZeuogoNg+jT/xAz5q1Pqz4JqxZ3KJa:tqhEeChZnvqgqyq1PK4JqZ6Ja
                                                                                                                                                                                                                                        MD5:32174A0DEFFB1267A7B4382C35980498
                                                                                                                                                                                                                                        SHA1:7E0DD6EFBE0AB6E28B3706986CC32E7E71A2D90A
                                                                                                                                                                                                                                        SHA-256:44293B82B3A9D867009C547C1D19CFC10A02BE55ED6545954CEC8B72D5C248D0
                                                                                                                                                                                                                                        SHA-512:48826A00B4EEB92F2AEE185FC0565724B549DBBEE16AAD395BBC707B27D4D98D1B7572355B120297460A39D1C4354071B235FDE6EF2817006B0451DF894685D5
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\rwhVS5Gl_u4JEiZA0FdJsuV.zip, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:PK........5..X.!c5l....%......information.txt.ZYo.L.....`in..Mx]..v..-.....=.....^.6.h......O..Z..N...S...,Y.....&4..0x.`I~|x|...}.F;*u.$.....z.}...cZ+7....S...O.J.'.B.ia.'...,4ua...1N..k"d...O.X....>i..4.P..:A....:M..ts......Ad#. .1...N.LV.R...8f......E.....`.m......K.1....J.H...a..jn.....7...=....*.smo......,.....%.......1..s<.O.K..{:S.MN...!.*..q=/..,=1C.....t. .Y2.P.s$........%4.......U.3..Z.Aol0Hj..q.....o<....Co.Y..&.....q...;.L:.......EhF......,=7^I...P[j.......?..QF.'...,...4{.....>...{8.UA..W6...(s..`.8.Yx.AB._..R5..Q.7...X"D...bI.e..zfD1a5...#..aP.<K.....wm.VS..C~.:...q.$R.]K.(..&I.c.\..13fx...K..p.....$..!...q....A.}..(.`...n..%.........0.d..S.4..L..........Va|Q.r......5..X..@#.......+7...QA..(s.F.V....."...;8........Y...pq.......>\..( .u...<I.7b...0}tgz... w\$w.W...Z.B....@/....U..P.....M.z..".E? ,...wl....m.B.s.VCU..p.....w..I.qH.Lv'0......\.:(.,s}...*.&B..CwR..1....J.?o;...4..N.....c.8.t.....N.aP..g8._?e.S?L.(..`

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):98304
                                                                                                                                                                                                                                        Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                        MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                        SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                        SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                        SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\1Zt6Vtq4atKrWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5242880
                                                                                                                                                                                                                                        Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                                                        MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                                                        SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                                                        SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                                                        SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\3o0U3Y6f7Z4hCookies

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20480
                                                                                                                                                                                                                                        Entropy (8bit):0.8508558324143882
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
                                                                                                                                                                                                                                        MD5:933D6D14518371B212F36C3835794D75
                                                                                                                                                                                                                                        SHA1:92D056D912B3C0260D379330D3CC0359B57A322B
                                                                                                                                                                                                                                        SHA-256:55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
                                                                                                                                                                                                                                        SHA-512:EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\8mwMOLIyldSdCookies

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20480
                                                                                                                                                                                                                                        Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                        MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                        SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                        SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                        SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5242880
                                                                                                                                                                                                                                        Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                                                        MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                                                        SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                                                        SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                                                        SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\JdzncWsW96t0Login Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):51200
                                                                                                                                                                                                                                        Entropy (8bit):0.8745947603342119
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
                                                                                                                                                                                                                                        MD5:378391FDB591852E472D99DC4BF837DA
                                                                                                                                                                                                                                        SHA1:10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
                                                                                                                                                                                                                                        SHA-256:513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
                                                                                                                                                                                                                                        SHA-512:F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\KjFCSe74s0gMHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):155648
                                                                                                                                                                                                                                        Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                        MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                        SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                        SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                        SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\L44nKtTL0XwIWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\MttvWFsifJehLogin Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\NYnliHFnDsQHWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\Tvp5CEtqTNikHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):155648
                                                                                                                                                                                                                                        Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                        MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                        SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                        SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                        SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\cBDPfuqRpfBgWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\nYUV8TiYk0LOHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159744
                                                                                                                                                                                                                                        Entropy (8bit):0.7371047619842778
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:w/ODWBqrBIWBsSsKJqlOuejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8EMrZ:wWWSDtH+bF+UI3iN0RSV0k3qLyj9aPs
                                                                                                                                                                                                                                        MD5:084CB3A21F0698D09C3BDAD96B6CB9F6
                                                                                                                                                                                                                                        SHA1:97BBC0FFF24257E7DD97C3B17855C5FF045F55F3
                                                                                                                                                                                                                                        SHA-256:879A9938774337E579153498D5356B9655D0F14CB17A6618F6AB5820BAF4C8BC
                                                                                                                                                                                                                                        SHA-512:6FD39E30241B925A2037B2A5F665C4075048F50F7DC2EBCA2C5B53AE781386C4C8F9AA42D3FFF516A52B80F485F2B52F022C7F33F52390639506D37215CE29CA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\sjLdLumdRhbPLogin Data For Account

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\uCy5t0F9NWVvHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159744
                                                                                                                                                                                                                                        Entropy (8bit):0.7371047619842778
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:w/ODWBqrBIWBsSsKJqlOuejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8EMrZ:wWWSDtH+bF+UI3iN0RSV0k3qLyj9aPs
                                                                                                                                                                                                                                        MD5:084CB3A21F0698D09C3BDAD96B6CB9F6
                                                                                                                                                                                                                                        SHA1:97BBC0FFF24257E7DD97C3B17855C5FF045F55F3
                                                                                                                                                                                                                                        SHA-256:879A9938774337E579153498D5356B9655D0F14CB17A6618F6AB5820BAF4C8BC
                                                                                                                                                                                                                                        SHA-512:6FD39E30241B925A2037B2A5F665C4075048F50F7DC2EBCA2C5B53AE781386C4C8F9AA42D3FFF516A52B80F485F2B52F022C7F33F52390639506D37215CE29CA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\w4ME5aRQcD1IWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span4kWsXJ0P2aEE\xaQptqfwBI5aWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):98304
                                                                                                                                                                                                                                        Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                        MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                        SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                        SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                        SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\10Nem9zYG5q2Cookies

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20480
                                                                                                                                                                                                                                        Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                        MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                        SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                        SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                        SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\10Nem9zYG5q2Web Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5242880
                                                                                                                                                                                                                                        Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                                                        MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                                                        SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                                                        SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                                                        SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\6kZvk6lVaLhvCookies

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20480
                                                                                                                                                                                                                                        Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                        MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                        SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                        SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                        SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\6kZvk6lVaLhvWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\AqFLo41ySP0QHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159744
                                                                                                                                                                                                                                        Entropy (8bit):0.7371047619842778
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:w/ODWBqrBIWBsSsKJqlOuejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8EMrZ:wWWSDtH+bF+UI3iN0RSV0k3qLyj9aPs
                                                                                                                                                                                                                                        MD5:084CB3A21F0698D09C3BDAD96B6CB9F6
                                                                                                                                                                                                                                        SHA1:97BBC0FFF24257E7DD97C3B17855C5FF045F55F3
                                                                                                                                                                                                                                        SHA-256:879A9938774337E579153498D5356B9655D0F14CB17A6618F6AB5820BAF4C8BC
                                                                                                                                                                                                                                        SHA-512:6FD39E30241B925A2037B2A5F665C4075048F50F7DC2EBCA2C5B53AE781386C4C8F9AA42D3FFF516A52B80F485F2B52F022C7F33F52390639506D37215CE29CA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\CFFDGMqyhK1uWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\CaDLjLgaJOb2History

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):155648
                                                                                                                                                                                                                                        Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                        MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                        SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                        SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                        SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5242880
                                                                                                                                                                                                                                        Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                                                        MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                                                        SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                                                        SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                                                        SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\EJDbtX6WfcodWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\IJ07wsYwZGQtHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159744
                                                                                                                                                                                                                                        Entropy (8bit):0.7371047619842778
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:w/ODWBqrBIWBsSsKJqlOuejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8EMrZ:wWWSDtH+bF+UI3iN0RSV0k3qLyj9aPs
                                                                                                                                                                                                                                        MD5:084CB3A21F0698D09C3BDAD96B6CB9F6
                                                                                                                                                                                                                                        SHA1:97BBC0FFF24257E7DD97C3B17855C5FF045F55F3
                                                                                                                                                                                                                                        SHA-256:879A9938774337E579153498D5356B9655D0F14CB17A6618F6AB5820BAF4C8BC
                                                                                                                                                                                                                                        SHA-512:6FD39E30241B925A2037B2A5F665C4075048F50F7DC2EBCA2C5B53AE781386C4C8F9AA42D3FFF516A52B80F485F2B52F022C7F33F52390639506D37215CE29CA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\IJ07wsYwZGQtLogin Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):51200
                                                                                                                                                                                                                                        Entropy (8bit):0.8745947603342119
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
                                                                                                                                                                                                                                        MD5:378391FDB591852E472D99DC4BF837DA
                                                                                                                                                                                                                                        SHA1:10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
                                                                                                                                                                                                                                        SHA-256:513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
                                                                                                                                                                                                                                        SHA-512:F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\QAXyFHuIe8RWHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):155648
                                                                                                                                                                                                                                        Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                        MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                        SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                        SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                        SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\QgIpTRJsPcAeCookies

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20480
                                                                                                                                                                                                                                        Entropy (8bit):0.8508558324143882
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
                                                                                                                                                                                                                                        MD5:933D6D14518371B212F36C3835794D75
                                                                                                                                                                                                                                        SHA1:92D056D912B3C0260D379330D3CC0359B57A322B
                                                                                                                                                                                                                                        SHA-256:55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
                                                                                                                                                                                                                                        SHA-512:EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\S_I6tUNNxXOyLogin Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):51200
                                                                                                                                                                                                                                        Entropy (8bit):0.8745947603342119
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
                                                                                                                                                                                                                                        MD5:378391FDB591852E472D99DC4BF837DA
                                                                                                                                                                                                                                        SHA1:10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
                                                                                                                                                                                                                                        SHA-256:513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
                                                                                                                                                                                                                                        SHA-512:F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\S_I6tUNNxXOyWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\dBXNsr7xDzjwLogin Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\gt9hQkopMxDaWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\nctShpJGh9xJLogin Data For Account

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\sSfpgjHUDzopWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\tAWKOwAzZPv_History

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):155648
                                                                                                                                                                                                                                        Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                        MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                        SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                        SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                        SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\vsjnhMgIdRVoWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spanG4UJIdbg9Er2\yPtFTSQiSjpCHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):155648
                                                                                                                                                                                                                                        Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                        MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                        SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                        SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                        SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):98304
                                                                                                                                                                                                                                        Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                        MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                        SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                        SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                        SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5242880
                                                                                                                                                                                                                                        Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                                                        MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                                                        SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                                                        SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                                                        SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\4tPBRlkS92w_Cookies

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20480
                                                                                                                                                                                                                                        Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                        MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                        SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                        SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                        SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\D4VlgTzMpMSOLogin Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5242880
                                                                                                                                                                                                                                        Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                                                        MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                                                        SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                                                        SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                                                        SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\GULoaWJI8YPxHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):155648
                                                                                                                                                                                                                                        Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                        MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                        SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                        SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                        SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\I26D4vqemitOHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159744
                                                                                                                                                                                                                                        Entropy (8bit):0.7371047619842778
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:w/ODWBqrBIWBsSsKJqlOuejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8EMrZ:wWWSDtH+bF+UI3iN0RSV0k3qLyj9aPs
                                                                                                                                                                                                                                        MD5:084CB3A21F0698D09C3BDAD96B6CB9F6
                                                                                                                                                                                                                                        SHA1:97BBC0FFF24257E7DD97C3B17855C5FF045F55F3
                                                                                                                                                                                                                                        SHA-256:879A9938774337E579153498D5356B9655D0F14CB17A6618F6AB5820BAF4C8BC
                                                                                                                                                                                                                                        SHA-512:6FD39E30241B925A2037B2A5F665C4075048F50F7DC2EBCA2C5B53AE781386C4C8F9AA42D3FFF516A52B80F485F2B52F022C7F33F52390639506D37215CE29CA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\Jabe_gTrrUlgWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\N6P8aHqRzZ74Login Data For Account

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\P3aHD51pRPgDWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\TJ131iUHw6CBWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\Vg67ec6KFe7NHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):155648
                                                                                                                                                                                                                                        Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                        MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                        SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                        SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                        SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\amBZfeJLrcmJHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159744
                                                                                                                                                                                                                                        Entropy (8bit):0.7371047619842778
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:w/ODWBqrBIWBsSsKJqlOuejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8EMrZ:wWWSDtH+bF+UI3iN0RSV0k3qLyj9aPs
                                                                                                                                                                                                                                        MD5:084CB3A21F0698D09C3BDAD96B6CB9F6
                                                                                                                                                                                                                                        SHA1:97BBC0FFF24257E7DD97C3B17855C5FF045F55F3
                                                                                                                                                                                                                                        SHA-256:879A9938774337E579153498D5356B9655D0F14CB17A6618F6AB5820BAF4C8BC
                                                                                                                                                                                                                                        SHA-512:6FD39E30241B925A2037B2A5F665C4075048F50F7DC2EBCA2C5B53AE781386C4C8F9AA42D3FFF516A52B80F485F2B52F022C7F33F52390639506D37215CE29CA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\lGbsK425qRNbLogin Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):51200
                                                                                                                                                                                                                                        Entropy (8bit):0.8745947603342119
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
                                                                                                                                                                                                                                        MD5:378391FDB591852E472D99DC4BF837DA
                                                                                                                                                                                                                                        SHA1:10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
                                                                                                                                                                                                                                        SHA-256:513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
                                                                                                                                                                                                                                        SHA-512:F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\n6w8RhDBLFK8Web Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\o7GI7x7gRIpwWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\span_fq5qzDvdkwv\zni4tw4czbUvWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):98304
                                                                                                                                                                                                                                        Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                        MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                        SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                        SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                        SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5242880
                                                                                                                                                                                                                                        Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                                                        MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                                                        SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                                                        SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                                                        SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\7S7rSDyTdRToCookies

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20480
                                                                                                                                                                                                                                        Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                        MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                        SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                        SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                        SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\8pxUJBDbf1lQWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\9g0e55w8v9uRHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):155648
                                                                                                                                                                                                                                        Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                        MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                        SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                        SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                        SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\AKJZWdZ6WaJSWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5242880
                                                                                                                                                                                                                                        Entropy (8bit):0.0357803477377646
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
                                                                                                                                                                                                                                        MD5:76D181A334D47872CD2E37135CC83F95
                                                                                                                                                                                                                                        SHA1:B563370B023073CE6E0F63671AA4AF169ABBF4E1
                                                                                                                                                                                                                                        SHA-256:52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
                                                                                                                                                                                                                                        SHA-512:23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\J2a_529xT2bULogin Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):51200
                                                                                                                                                                                                                                        Entropy (8bit):0.8745947603342119
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
                                                                                                                                                                                                                                        MD5:378391FDB591852E472D99DC4BF837DA
                                                                                                                                                                                                                                        SHA1:10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
                                                                                                                                                                                                                                        SHA-256:513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
                                                                                                                                                                                                                                        SHA-512:F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\PePzYCQGiRJOWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\SU3_v7QMmNVPWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\WoWJC2eqUYJDHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159744
                                                                                                                                                                                                                                        Entropy (8bit):0.7371047619842778
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:w/ODWBqrBIWBsSsKJqlOuejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8EMrZ:wWWSDtH+bF+UI3iN0RSV0k3qLyj9aPs
                                                                                                                                                                                                                                        MD5:084CB3A21F0698D09C3BDAD96B6CB9F6
                                                                                                                                                                                                                                        SHA1:97BBC0FFF24257E7DD97C3B17855C5FF045F55F3
                                                                                                                                                                                                                                        SHA-256:879A9938774337E579153498D5356B9655D0F14CB17A6618F6AB5820BAF4C8BC
                                                                                                                                                                                                                                        SHA-512:6FD39E30241B925A2037B2A5F665C4075048F50F7DC2EBCA2C5B53AE781386C4C8F9AA42D3FFF516A52B80F485F2B52F022C7F33F52390639506D37215CE29CA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\WqS84J335HYhHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):155648
                                                                                                                                                                                                                                        Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                        MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                        SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                        SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                        SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\XkGwE30i6TwrWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.136471148832945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
                                                                                                                                                                                                                                        MD5:37B1FC046E4B29468721F797A2BB968D
                                                                                                                                                                                                                                        SHA1:50055EF1C50E4C1A7CCF7D00620E95128E4C448B
                                                                                                                                                                                                                                        SHA-256:7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
                                                                                                                                                                                                                                        SHA-512:1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\p7fv7bhH0M8uHistory

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159744
                                                                                                                                                                                                                                        Entropy (8bit):0.7371047619842778
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:w/ODWBqrBIWBsSsKJqlOuejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8EMrZ:wWWSDtH+bF+UI3iN0RSV0k3qLyj9aPs
                                                                                                                                                                                                                                        MD5:084CB3A21F0698D09C3BDAD96B6CB9F6
                                                                                                                                                                                                                                        SHA1:97BBC0FFF24257E7DD97C3B17855C5FF045F55F3
                                                                                                                                                                                                                                        SHA-256:879A9938774337E579153498D5356B9655D0F14CB17A6618F6AB5820BAF4C8BC
                                                                                                                                                                                                                                        SHA-512:6FD39E30241B925A2037B2A5F665C4075048F50F7DC2EBCA2C5B53AE781386C4C8F9AA42D3FFF516A52B80F485F2B52F022C7F33F52390639506D37215CE29CA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\sHhRtbWALieDLogin Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\xla4LIc1h4euWeb Data

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                        Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                                        MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                                        SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                                        SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                                        SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\spand4uN7oJQNMQw\y70hmJdIDBZHLogin Data For Account

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\trixy4kWsXJ0P2aEE\Cookies\Chrome_Default.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (369), with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):530
                                                                                                                                                                                                                                        Entropy (8bit):6.005544722730675
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12:c7F2v4kMx/6UsMbf4/LJPhvkRj6a9kuEYTCRopYxOOVtouEYv:SCJyHXbfQJPh8RdkYiFoYv
                                                                                                                                                                                                                                        MD5:987FB1A1830B0EB5C0D306F8A2DE9981
                                                                                                                                                                                                                                        SHA1:8374E6320AD99C3FF177A9889F1AB75448F6EB19
                                                                                                                                                                                                                                        SHA-256:5EF24A6CE57CA3048431555909EC23CD5494DA76845F84271946442249DDA891
                                                                                                                                                                                                                                        SHA-512:9E2A48264084B79051FC275DD7780A5552B56220459A1CDDBE6F6A307FE0E5759AE20BC243D085D9734153879AC4E66233AB83F92551DD8092EABF85B16F2D15
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:.google.com.TRUE./.TRUE.1712298002.NID.ENC893*_djEwx6CLkXLg8AuSZWCgylmAsMNnd1LSfbcL+IfCgMvX/m5IrzdSwxt6X6n5S6C7wCoUoWvuixZpzrMizGZc5ohIpmsvlOrGTOhFkQ4+lCF6fVH0QNPBBb27o2nXM8em7EAYS1bYZC2LV04SqpgyxJmdfFA7UyWUoK8kFZQDRl0vdOzWdvAoumw2skuCCtJC2oG3z3OYbLTLDbM7wYvVmfDeqtnZRihAAt+ptqI6cfY1a+KO9XP+4XkDSXW7JhsexYHBqzSSBmUisGZ7f9E=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=*...google.com.FALSE./.TRUE.1699078840.1P_JAR.ENC893*_djEwZKzV9KAslchfQWnVTck71JHMVRC24lvAWgdl5WpYIXlINsbQSVWzkKU=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=*..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\trixy4kWsXJ0P2aEE\information.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):9567
                                                                                                                                                                                                                                        Entropy (8bit):5.5852464390543215
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:xRgVA84IUlzhF4Ppx1UDWAiL4i22ceMyda4gGPuZ4GhlREptCdnTuc3K25mrB40c:kA/IU1hF4Ppx1UDWAiL4i22ceMyda4g3
                                                                                                                                                                                                                                        MD5:1CB635D3C8950810FCA608105E738D6E
                                                                                                                                                                                                                                        SHA1:5249988322BBDF29EF9ABB9959302055B156C05A
                                                                                                                                                                                                                                        SHA-256:1E3D7241D097824FF25BA95E2AC9B23931410C4C975C69A31A2F28004A50C8EF
                                                                                                                                                                                                                                        SHA-512:D8876E1D247354CDEA69F55593F269EC469D50D0E249FD44A0289607A45649E8764FEB5785CF5CB494405EDAA20F38A149D6CA0053536AD5B72D23366288838D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:Build: combo..Version: 2.0....Date: Tue May 7 20:33:44 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: ff19ab80b3f0ac823d3632394342ab8c....Path: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy4kWsXJ0P2aEE....IP: 156.146.37.102..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 445817 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 7/5/2024 20:33:44..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [328]..csrss.exe [412]..wininit.exe [488]..csrss.exe [496]..winlogon.exe [560]..services.exe [632]..lsass.exe [652]..svchost.exe [752]..fontd

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\trixy4kWsXJ0P2aEE\passwords.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4897
                                                                                                                                                                                                                                        Entropy (8bit):2.518316437186352
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                                                                                        MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                                                                                        SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                                                                                        SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                                                                                        SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\trixyG4UJIdbg9Er2\Cookies\Chrome_Default.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (369), with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):530
                                                                                                                                                                                                                                        Entropy (8bit):6.005544722730675
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12:c7F2v4kMx/6UsMbf4/LJPhvkRj6a9kuEYTCRopYxOOVtouEYv:SCJyHXbfQJPh8RdkYiFoYv
                                                                                                                                                                                                                                        MD5:987FB1A1830B0EB5C0D306F8A2DE9981
                                                                                                                                                                                                                                        SHA1:8374E6320AD99C3FF177A9889F1AB75448F6EB19
                                                                                                                                                                                                                                        SHA-256:5EF24A6CE57CA3048431555909EC23CD5494DA76845F84271946442249DDA891
                                                                                                                                                                                                                                        SHA-512:9E2A48264084B79051FC275DD7780A5552B56220459A1CDDBE6F6A307FE0E5759AE20BC243D085D9734153879AC4E66233AB83F92551DD8092EABF85B16F2D15
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:.google.com.TRUE./.TRUE.1712298002.NID.ENC893*_djEwx6CLkXLg8AuSZWCgylmAsMNnd1LSfbcL+IfCgMvX/m5IrzdSwxt6X6n5S6C7wCoUoWvuixZpzrMizGZc5ohIpmsvlOrGTOhFkQ4+lCF6fVH0QNPBBb27o2nXM8em7EAYS1bYZC2LV04SqpgyxJmdfFA7UyWUoK8kFZQDRl0vdOzWdvAoumw2skuCCtJC2oG3z3OYbLTLDbM7wYvVmfDeqtnZRihAAt+ptqI6cfY1a+KO9XP+4XkDSXW7JhsexYHBqzSSBmUisGZ7f9E=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=*...google.com.FALSE./.TRUE.1699078840.1P_JAR.ENC893*_djEwZKzV9KAslchfQWnVTck71JHMVRC24lvAWgdl5WpYIXlINsbQSVWzkKU=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=*..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\trixyG4UJIdbg9Er2\information.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):9571
                                                                                                                                                                                                                                        Entropy (8bit):5.595501886082363
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:xhVb84IUlzhF4Ppx1UDWAiL4i22ceMyda4gGPuZ4GhlREptCdnTuc3K25mrB404O:hb/IU1hF4Ppx1UDWAiL4i22ceMyda4ge
                                                                                                                                                                                                                                        MD5:A1513967B82A3127F60FCD329D264F80
                                                                                                                                                                                                                                        SHA1:32A42C04F68B79FBC2954D9870E46056F0027450
                                                                                                                                                                                                                                        SHA-256:F69095D91FB1D73A1F5CB3717CFB07F4680D8A6C09B692F256B634A80A225B95
                                                                                                                                                                                                                                        SHA-512:75E3DB47825D1628B8F6223A317D434D3D960F28B56D19E8BF8F4ADADD2BE5624FE91A290903494AF5968C1674171D9F606ACFA4307BD4D4D67A9B2C051E3B13
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:Build: combo..Version: 2.0....Date: Tue May 7 20:33:43 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: ff19ab80b3f0ac823d3632394342ab8c....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyG4UJIdbg9Er2....IP: 156.146.37.102..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 445817 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 7/5/2024 20:33:43..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [328]..csrss.exe [412]..wininit.exe [488]..csrss.exe [496]..winlogon.exe [560]..services.exe [632]..lsass.exe [652]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvh

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\trixyG4UJIdbg9Er2\passwords.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4897
                                                                                                                                                                                                                                        Entropy (8bit):2.518316437186352
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                                                                                        MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                                                                                        SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                                                                                        SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                                                                                        SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\trixy_fq5qzDvdkwv\information.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):9484
                                                                                                                                                                                                                                        Entropy (8bit):5.595327480139644
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:x0VR84IUlzhF4Ppx1UDWAiL4i22ceMyda4gGPuZ4GhlREptCdnTuc3K25mrB404l:eR/IU1hF4Ppx1UDWAiL4i22ceMyda4g1
                                                                                                                                                                                                                                        MD5:CEC4545C0411D0367A0C53A5D3739AE8
                                                                                                                                                                                                                                        SHA1:17559918A499B2A882E6149E75453EC4767E57D6
                                                                                                                                                                                                                                        SHA-256:5AD1CD35DA769E22B84849FBE3EAAE82A52D4FEE65D0B2E43A0D382EDC96D7C4
                                                                                                                                                                                                                                        SHA-512:2B355E77A951831B4B8A13CFE6BFB8BAF2D12FEF0F45A6074B8F8772AEFF9708DED1F6F07E03642FCEBA418B06E37C800ABDE617F456314108523CD7CAE47DFF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:Build: combo..Version: 2.0....Date: Tue May 7 20:33:41 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: ff19ab80b3f0ac823d3632394342ab8c....Path: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy_fq5qzDvdkwv....IP: 156.146.37.102..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 445817 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 7/5/2024 20:33:41..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [328]..csrss.exe [412]..wininit.exe [488]..csrss.exe [496]..winlogon.exe [560]..services.exe [632]..lsass.exe [652]..svchost.exe [752]..fontdrvhost.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\trixy_fq5qzDvdkwv\passwords.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4897
                                                                                                                                                                                                                                        Entropy (8bit):2.518316437186352
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                                                                                        MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                                                                                        SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                                                                                        SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                                                                                        SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\trixyd4uN7oJQNMQw\information.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):9491
                                                                                                                                                                                                                                        Entropy (8bit):5.594522813611472
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:xDVE84IUlzhF4Ppx1UDWAiL4i22ceMyda4gGPuZ4GhlREptCdnTuc3K25mrB404l:LE/IU1hF4Ppx1UDWAiL4i22ceMyda4g1
                                                                                                                                                                                                                                        MD5:A5FE1D677D7634A6FF16977B0903227C
                                                                                                                                                                                                                                        SHA1:5007EC932DA78E1ED53BD16EFDD2417E6777E083
                                                                                                                                                                                                                                        SHA-256:18F3C64D25D269CB421377E5824A8E31A0D9F25C29CB05EC5D493414B97215B7
                                                                                                                                                                                                                                        SHA-512:A4347108407079AD6F5FDDE0F0A7E0F2CE7534D40EA1B769C7F0EEDD49D1B4229EAB4634CE33FA365EA8CB047BFAA3B9348C960FB3F735E5BE99FD41DA4A3AB9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:Build: combo..Version: 2.0....Date: Tue May 7 20:33:40 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: ff19ab80b3f0ac823d3632394342ab8c....Path: C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyd4uN7oJQNMQw....IP: 156.146.37.102..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 445817 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 7/5/2024 20:33:40..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [328]..csrss.exe [412]..wininit.exe [488]..csrss.exe [496]..winlogon.exe [560]..services.exe [632]..lsass.exe [652]..svchost.exe [752]..fontd

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\trixyd4uN7oJQNMQw\passwords.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4897
                                                                                                                                                                                                                                        Entropy (8bit):2.518316437186352
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                                                                                        MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                                                                                        SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                                                                                        SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                                                                                        SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\US6SMVSChPuNg0C79rqEySgv.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\UrMKiBsPUmHBdjATiF2xGFWW.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\XBajRwldCSS42gwh4zu9f3ce.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Y0ZKJ4dRBRkIRESl8nT570lZ.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\YdDMLcotJvPaOVEHpalanl1d.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Yg9IAPVdFD93gbLGPdcvbgw2.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Zy6qmavCIexKIuB9nNrNHs9p.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\ar5KINQCCayk0Kw6DN1FAVFx.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\bVARrzkwQmnP1mnoffZ1HExy.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\bfSaxNj6PaRbQoH1x6AgorQM.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\bsl30mcD1mRV5YLU9isxcsMk.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\cqEYVGnsRBmElwXA0pViDIv4.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\eNB1RX0hn7cF5yIvRdwV0Sdv.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\f3qMySWuesp6iqsnQUyX8UG1.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\fRiNFTEVJnpONJofzyWKlqwW.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\fybzTZ3WiLAPEZj0fVOx3M0F.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\gsF9GZceaIYWveF9Wn0mXwbt.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\hQa9fYPzQBrGD6byFRloLN5U.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\iftEMaYodvzM2QCJfFMzhqiG.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\k4a17b3U4KeqWyuMzrdWzqyt.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\la4RG5LhUShae5ag2mFmRdea.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\nRXc5v7fBpZ3Rt6WXas92N9q.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\p7KXtY1OslUIeP9Ce7HA7pcJ.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\tRGz8YUeJOvAWwmplTaCNv1T.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\vwsgN3REbITHxJG5vlKYY3Vx.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\yNQkYyPgov8fX5k7nVDGzk6w.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\ybCY5oONgBmPsQ2TsLXObZGj.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\yqUOk3nzvlJdWid9vqJoE5bL.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\z2u4DwiwBezR2xi11GPVbROw.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\zhcyBjWDtf9NR8VTfZLAmUWa.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000071001\jok.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:modified
                                                                                                                                                                                                                                        Size (bytes):2251
                                                                                                                                                                                                                                        Entropy (8bit):0.0
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3::
                                                                                                                                                                                                                                        MD5:0158FE9CEAD91D1B027B795984737614
                                                                                                                                                                                                                                        SHA1:B41A11F909A7BDF1115088790A5680AC4E23031B
                                                                                                                                                                                                                                        SHA-256:513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
                                                                                                                                                                                                                                        SHA-512:C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2nCXxdPnLk5JcX0DaVpRhjv8.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):5.022297355843829
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5pBzDQCsdUOSvAdAl:fE1N723v4nSYdm
                                                                                                                                                                                                                                        MD5:A8CD13960DBE73F0C2C6E09ACECA29A8
                                                                                                                                                                                                                                        SHA1:B4B831D3E330A9A87C345CDABFEC70692B596D7E
                                                                                                                                                                                                                                        SHA-256:A3E9EF827F0FCDB5F792C15503D394AC3EEF2EE02138021D62550B85A4AD90A8
                                                                                                                                                                                                                                        SHA-512:039BE9E831A55832D5EA4E66AA8486EED0F9BE7AF70D5599BF255A1EA1CB3708D770943DF4779E38DC1720C4AD80930D935B2D3F8FD068F605BE9ECE11DC5CEA
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\LdBVJ0t5gC67YMsVTHQfk739.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4jfLDdZXDrYucdBARadSTAAL.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.949226176276607
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J51HcQKkEf+HFn:fE1N723NcNwF
                                                                                                                                                                                                                                        MD5:46B753D5AB45F3764EFA34E949E4561C
                                                                                                                                                                                                                                        SHA1:4E80EF77258B01DCB83D621BE45C2680775EDCFA
                                                                                                                                                                                                                                        SHA-256:3F58E8CCCF02D2560EC765AE2AF66DECC6A4D1D31445584E2EE419D16C70ED37
                                                                                                                                                                                                                                        SHA-512:09FD0941ABF8FE834E55D571FD6478D3BA9A7932317DCB11647764508528637561935DC0C09DCDB3EEEEF2A8F946EF1B4E26D8A4DE279109002760861EDC1D9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\PbrRyuOT2DJaFlbAzGY6neq7.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54jPFh9oLJVW9bkfFqvuPgKg.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.833274571476652
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5pf3dvnriANtF:fE1N723x3ce
                                                                                                                                                                                                                                        MD5:83D205BC65C41C8A542138DF547492A6
                                                                                                                                                                                                                                        SHA1:1068F08D954F736D1EC0C2C6B9107F9F7BFABACE
                                                                                                                                                                                                                                        SHA-256:907C2A3CD4E5963D0324EFAA69082B88442C99CA1472D1B1649EF44E90BBE578
                                                                                                                                                                                                                                        SHA-512:799B855CB35AC317CD6EB69A05C6BD3BD8153EEFA636C99A202825756163D391C6434923B7061D9C1CCEBDBE1B147298B14A0168AE8333121619F1E600EBC409
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\LzRxHxBk5eAHgaCKyeZTvsuN.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5plmIsCmu1c3pDoA2jFr0W4n.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.917994925228177
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5jOIchmPAZUgL4iF:fE1N723Tu
                                                                                                                                                                                                                                        MD5:D42DFCD0D69834FF31F9197B92969BE4
                                                                                                                                                                                                                                        SHA1:992E8E645DA2208C36A78A15ED452559DBD500EA
                                                                                                                                                                                                                                        SHA-256:9CBD3D011701B259E00A9BCD5F29F3663E9C4D1D262DAC3FF12E41E384BEE3A6
                                                                                                                                                                                                                                        SHA-512:242A9B28CBB2DEB7994E7B7AEC016C231C6846C93A80AA5CBA0D2DBC80D2FCB95F66F35150D22D468BBC49D8BBD73C8C73150F1105DFF015EAE75DBC38E8DCC4
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\FsKEmkdvDCAc7VY3lRIiRKAL.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5sXlOTcmnXvKeyfdiBhcw4ND.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):5.001328258561511
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5qtgeIh+Jln:fE1N723qSeIhi
                                                                                                                                                                                                                                        MD5:D11B94F476C78377BC65F26824D112FF
                                                                                                                                                                                                                                        SHA1:F339CC581B63C3D0D7A01550C1FC8FC3E1E93CDC
                                                                                                                                                                                                                                        SHA-256:18CC12D9B3124BABE8CD48ABA0CEFD21B49853529B650124AAB4120C240278BF
                                                                                                                                                                                                                                        SHA-512:05D2401BC645A215EFCACD91014CB3FF0F7D52412B2F1E027C2A46A2E3139B42A47A7E7AE8A9799A6E00AF389B968D416EF50490F5784935CFCDCE6E4261E75D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\OFqYXukHEjQzmQ3ijziOsyC5.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62G1Wdx3GqQR8gREza0Qjrhd.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.9352881543647955
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5RVLROYxijKjUVtg0s:fE1N723zLoYxjQvs
                                                                                                                                                                                                                                        MD5:BB5F3A7328013131A5AC42DC8FCC4418
                                                                                                                                                                                                                                        SHA1:44DD74FB558DFD9616B842D60902F1592EE70D1F
                                                                                                                                                                                                                                        SHA-256:2411D7B569EF790819C89A6154B3101BE73154F476E1C2E2604FA116BD745D1B
                                                                                                                                                                                                                                        SHA-512:4A47247C62C484B1F0C95AED1B1C8BB21691AC3217CC817139CAC84983315EBDE462DA2F48A26E5CFB64E7905ACB699CCF4E18F33902F3B75A015BB5E815C242
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\4ptz7FM4kP7qMGFoFqE5j0zm.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6GqiHIfrVXBSZnggvuCnsYvX.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.877764412002625
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5uQeUS/iwFkAln:fE1N723uejwFJl
                                                                                                                                                                                                                                        MD5:A9C251888090D633965147B145E83C26
                                                                                                                                                                                                                                        SHA1:A971EB4D9463B4EBD1543A250065C31C1F77F9EA
                                                                                                                                                                                                                                        SHA-256:ED233DD7B121A7FC64256886FBB35AEEA3B99ACAE8236BB075E4C55CF1D9DAE1
                                                                                                                                                                                                                                        SHA-512:41DBBF8FC3A0B5C65B4423D8B084599795F4B9B0C9866ECBBB986124A4FC51BD67722AFA963118B0CF637839C0B40DFE579304BA00289397475F323396B08BDE
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\KITnOquJmIbAAhc0DU20ke2n.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6imaeIZVrnGARWYKvSqZT3zH.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.9352881543647955
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5mxM876IkiF:fE1N723mxM82dm
                                                                                                                                                                                                                                        MD5:2AFFE45F0796BDF6C58269EFF721775D
                                                                                                                                                                                                                                        SHA1:1C12596FBA45B8E25EA24A38D1062B34D0E660AF
                                                                                                                                                                                                                                        SHA-256:870DB69CB63208C39581C233452A5E1A895FB68364E157208340E855BC4CE4F6
                                                                                                                                                                                                                                        SHA-512:5211269DBF3C14296FDE0AA1BA0916C016524556ADCE3AB14EE0B2F0DFD70AFB68393B79202B9B9882DFBA77361D94A9C5A785EECA65F7EFAA3181C975650A6E
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\CS3gyNCBkgUy4GD82bQforlP.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7DW6Gc6MAdQrxCFHJUHs17zd.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.829017536942528
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5WHJfomX9n:fE1N723WpfhX9
                                                                                                                                                                                                                                        MD5:A8F8D53E02CDE9440E449B1772596573
                                                                                                                                                                                                                                        SHA1:DF1A100938CCCF41B079855706186780E0854CD2
                                                                                                                                                                                                                                        SHA-256:D29D85AC602166DCE303D35E919C2DE915AAC257D852D8F4515E600F3153DA51
                                                                                                                                                                                                                                        SHA-512:08028EC1B6A8B02293AFEEF4D284B9ECB678DB7A121B82FADA9A7DED7378A110CADA0068967D6DEC5EE3992F1EDE5DFC4585AB227883324EE2B8888C2958CF10
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\3bpaooYORdL1zGgZZfaU6raM.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7xqIRWplklsXiVj9AJQsuokd.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.7550041267072105
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5VSu+s4ATAsn:fE1N723j+KTAs
                                                                                                                                                                                                                                        MD5:D0340C37DC85C39B427F2C78434D42D3
                                                                                                                                                                                                                                        SHA1:BD8459DE4B62148BE9251AE24F72C9AE8B00EB46
                                                                                                                                                                                                                                        SHA-256:42161B19B0672AD5F422A95D4C4CD1A17C3F41CC9965944CBEAFBE115E2838AB
                                                                                                                                                                                                                                        SHA-512:F907F8CACE65716ED273CA5A18701FF8A0C6F81F30FD3E8ED6B842C70682D8872A23234272B1411AEE2B3BF6BF65334247AC08F0C93FB7E4391BFC7252DD0A74
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\p7KXtY1OslUIeP9Ce7HA7pcJ.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9XRyJ5AMIyBRzhQ2TMbTCcnl.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.9616789117243805
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5dScuy+Vs:fE1N723JuXs
                                                                                                                                                                                                                                        MD5:CE3F83D4BFA0BCA6B02E1F6FFA13B480
                                                                                                                                                                                                                                        SHA1:709E7CE754DC1AD65843114E6E222454926DDDE2
                                                                                                                                                                                                                                        SHA-256:C62E088511723D6F7ABFB9C3A29C7A5B84F98857C54FEB3CA209446B3605CFC4
                                                                                                                                                                                                                                        SHA-512:1C48ACEB1987778BC72C59A82C47C2D74D953F926069187F8145EA2DACDA75A22305CF7F479607551046AECBFB327CF2341702BE24231BD5DF55910DACBCE8C4
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\87yah1hG3sRWG8d7DMFA6UPI.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\D5b1TWIrVUYsAwT3lLhmzDTv.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):5.039590584980448
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5siz1lk2vRLAdAln:fE1N723siZlXtAs
                                                                                                                                                                                                                                        MD5:280A19C8A926AD9A3737FA4EF6A8F823
                                                                                                                                                                                                                                        SHA1:B372EB00DB20840A24C80D1A4134FFF02E2086E4
                                                                                                                                                                                                                                        SHA-256:4186AAAE2F8D3AA45879B6BAF24C281E0C28438B0F42A286869591EB09AECBE2
                                                                                                                                                                                                                                        SHA-512:615597974F5B196F1E689A5A7813FB61A35A8F4E31407A9D91A66176319295427FE15288FA3AE8AB8B691C20F3F143744A25F0B37B2E025E40591EF2F10253CF
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\IGVPHrAShfg5S77hqubJkQGT.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DTIhxF5q0Qg6L1VWLqKGtCG4.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.938420966714554
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5vh1/MfO8sfiFn:fE1N723Z1SsfiF
                                                                                                                                                                                                                                        MD5:7DF4216F622646B1DDE85383B9001688
                                                                                                                                                                                                                                        SHA1:CD56938B8498519424FD2ECB74AFC61389457858
                                                                                                                                                                                                                                        SHA-256:947C8CE47D8C65AF5A4F62922790F09E8703BE4BAABFDC6C75D83AD149DF5344
                                                                                                                                                                                                                                        SHA-512:C2B39D0D0D0CEC05ACFE8758D4CBA624614890C746BA28223F17A8938D94E63490F71726C80B319A5ADD7655866741B5BA4364564F4BF0460BAC0392C5DF3EAA
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\JfX04QeZvezkOn3eIpEjUqc5.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EEuXRjfzeiH8g0YM0L56zBMH.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.963065932142574
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5U/MhGShJWl:fE1N723UQJWl
                                                                                                                                                                                                                                        MD5:1F9672B28E39E2222ACE40CBFA94F921
                                                                                                                                                                                                                                        SHA1:17418E6EE3951E8A5F191C33FF971C3AD62A6219
                                                                                                                                                                                                                                        SHA-256:EA42D331C79FE952EC4DC52050343F498A2BEB8CCEDD4C92BDC11F6AD36AD9CD
                                                                                                                                                                                                                                        SHA-512:2659ECD07142EACE6392811FE0690B62CD8838892DBEFE81E0AFBF4ED66E68EA2263F1AA34196C2D8410C296345A1AEAD3395B64119AE0778EEFD0BB76AD9413
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\1ZiD49yFoSPKKQmrglTINzlo.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EaH3os3XyhQRwzfrIoMsgfOT.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.7895905849804485
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5sHqgIG5FWs:fE1N723snIG5Ms
                                                                                                                                                                                                                                        MD5:80CE89B8C8523364D411018A27FC7FCA
                                                                                                                                                                                                                                        SHA1:3D92B801150D9F3D463A86F047D8959759E04A18
                                                                                                                                                                                                                                        SHA-256:45542FC6C05279EBCA4B9F8F1745CE92F074F2AC8CF42938CABEB4AEFAEA4760
                                                                                                                                                                                                                                        SHA-512:08C3F1E22F01B2C499D2A518BD5F8C49F4D592E3C53BCD994D249D7A0670E045E4AA79CF9B8A3D9BCB5240AA0DD18DF47A9557504CBFCDF7F600CE579D9E51E7
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\IwVIt8hVIPrEsgJdmcJDc0cp.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F82kF5QJtwswX0bD7pirl83T.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.963065932142573
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5cp6fVByvadiF:fE1N723cp696F
                                                                                                                                                                                                                                        MD5:B87392FE3C462647E2ED788009D59CB6
                                                                                                                                                                                                                                        SHA1:9D6065FD3450859BB3CEA93B826691CD0800AEA6
                                                                                                                                                                                                                                        SHA-256:365EB8E9A5CB0983626D376C2E35D5FBFEFC71D9EC041EEBF5CDE66D9EF5C156
                                                                                                                                                                                                                                        SHA-512:E1B11CD574212750F965EF3D7F8B874E30F2E98E3389B5AFA835EAD189F0AC3C1A803D23A607047B758DB071D91B04EA0902F281E12CD3CD751AEEB634E86C24
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\yqUOk3nzvlJdWid9vqJoE5bL.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FOHad4INGlVgGUzrXOJHgTLE.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.841470272390302
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5HXvppw0/YAl:fE1N723RUm
                                                                                                                                                                                                                                        MD5:3BAB8F0B2EC1F6F03AECCBF792A88625
                                                                                                                                                                                                                                        SHA1:319E0C3F9F3B6C323B125CFEDE205D6517C04E31
                                                                                                                                                                                                                                        SHA-256:3B6720629773976F7E473B207135348327D7F8C1CDDF14E18D2D2FE5EB4C8027
                                                                                                                                                                                                                                        SHA-512:EB1549309FB34CDE093C701ACA67EB1296953CC9A13C38C22B68235199182C824E725FD7988A532E5A539F6E527EA78F30FB56435A2261CE7CCEADABB1995E4E
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\bsl30mcD1mRV5YLU9isxcsMk.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FUeo6cPMtQcyTnVLTt6Jjsg6.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):5.016653300891513
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5Ar5csBF:fE1N723Amsz
                                                                                                                                                                                                                                        MD5:7248099855A6D15EA6763027F9D1D889
                                                                                                                                                                                                                                        SHA1:2CE5D8C41D3304C2A78CB5C9C373893FA4597FBF
                                                                                                                                                                                                                                        SHA-256:2970B26F469D9630430D1E134326ECC083C56FEFAD0209461D474CC5EBD14AD6
                                                                                                                                                                                                                                        SHA-512:31751231E067546952470780A099F44B80513E7AB82556F400E0E6249475EB469D0C26E99DD78CFF9AB3B86485A497F8A4C81711B1C1FCB2F19CAB5204BBF92B
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\eNB1RX0hn7cF5yIvRdwV0Sdv.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FYpNAXn4iUQjB76qpm9rHvvP.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.912932036664285
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5i05NjsAg:fE1N723iWsd
                                                                                                                                                                                                                                        MD5:E3CF3AE7427D2EF75F25D90BC688AAF1
                                                                                                                                                                                                                                        SHA1:C0CD73CC7FBFA75F1D810B69212D06A2BECAE0CD
                                                                                                                                                                                                                                        SHA-256:2BE1DC4C81A2525589BA5497CD04D5709E53766ABCB54DA5F1F739CA8A9D3E68
                                                                                                                                                                                                                                        SHA-512:9556A96371E19A6C458F5E33E46D5B9B42A5BACD8ABBFCB7A2C0A114086CE77774A9244D9B84790403FC66766DEFDC1097261ADB506B401BC744CCE0E2093682
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\GXqvrU2YdMIpdqoqkBIkuQ4a.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GVnNMQ4xWRaJB6uq68mTJkZN.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.8888301270322065
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5gxBfEeTJHF:fE1N723gxBf3F
                                                                                                                                                                                                                                        MD5:528F1E1861999625F2D64469F9C392FF
                                                                                                                                                                                                                                        SHA1:1A8678EDCDC14C5C7EC83408AFDD89B4D1C2B7A7
                                                                                                                                                                                                                                        SHA-256:F65C16497E9B1B027D1348A71610F9FD9148B0A666FE2343908BDF9B38974653
                                                                                                                                                                                                                                        SHA-512:C38970361B09DE895185579AB9EB805C543C8F05163BD228E0297E5FB78F4FC3C9A3ACCA9AA26C0D7960CD5AC32FC9186CF13B2D343B6739909161A95826249F
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\EqMO5smfp2bzSmy94pnHeeak.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HPpcD7tAr9JffyluVr9Dqnzg.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.763558599134236
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5dCZNoAepsn:fE1N723yN1ey
                                                                                                                                                                                                                                        MD5:07C40A54D5630D3AF48E3BC5AC1A9328
                                                                                                                                                                                                                                        SHA1:14386ED44CCFDD8B7BD31DD8026938D8118C00B7
                                                                                                                                                                                                                                        SHA-256:C3E18C67405B5CF3D804814BDE578A4E514E204EF1AD5927A745C36521361142
                                                                                                                                                                                                                                        SHA-512:9AE259C3A5CEBB89F31502114D693E37C04E1BBB22A13C888958313D3166C3545BE66204DB439159A5AF2915A13B5030102745EFBB727B4D2A387547A9D64633
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\8gEIcaaLXjtHWMkCknRgnRyn.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IjO2xpTHgE815NSQlystxL8c.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.688964022510495
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5JERVnEAkxvF:fE1N723ak1F
                                                                                                                                                                                                                                        MD5:ADF8CD23729D29F59D8421E9370A0D78
                                                                                                                                                                                                                                        SHA1:224EE74BEB85E5DA02A94A9B3A8F4DE07C494C55
                                                                                                                                                                                                                                        SHA-256:A3F87919BD4409819FDB0E2B842B189FBC84AAE46944BD64B5C0A692ECC6B719
                                                                                                                                                                                                                                        SHA-512:D97C363994BE960A4390431861849283BC29E4D9E46FED6050F1F4727B9DEB2B7FAFAA46D89D945B5F0C86FD390993EED3A875AAF989FCF7F534A26DB4630420
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\la4RG5LhUShae5ag2mFmRdea.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IrkwNHffMo4Eka7tqdiM1FpJ.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.761590412327622
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5mn/a7ggSX0l:fE1N723m/a7ggc6
                                                                                                                                                                                                                                        MD5:5554B1FA040EF39EDBDD5AD333FF8059
                                                                                                                                                                                                                                        SHA1:283A59881372CF0C181677FE1CC685D4BF7697E9
                                                                                                                                                                                                                                        SHA-256:E0396B1BBCE3D46AE5A948C0B697C1E1B9AB112EE31D8DFBA789C6835346D5C8
                                                                                                                                                                                                                                        SHA-512:7085C19BC3DD258C343F46E53EEB74CE9C6F43CB0A8540A2A9B860A94429501E2EB81640513C7F23E172DBC51E6CC56AAB48970BF58A04EA7A482424FECD5490
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\CZ8BPZs8awoPJiACUS73pAe6.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JWTZFaAwxnpP4x7n3ZxQtmcV.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.978972140860999
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5WHoCQOzLv:fE1N723WIWLv
                                                                                                                                                                                                                                        MD5:A14F5FCD41FE17B856B5B92C41FAC914
                                                                                                                                                                                                                                        SHA1:1DE17FE2273575C16E910243B10F1BEBC827C2A9
                                                                                                                                                                                                                                        SHA-256:26640EA49948DBF7EDD3239DD99B34508935870A776F16CF75442B86202B9240
                                                                                                                                                                                                                                        SHA-512:36F5B2DC01DECDAA33AB8156F5BA4F23C33863CC8599BADC053C324B10C9CCF87143A9E4D0D218C44E06B17E04D48E8DCCBA6CBE4706DC68471F9082D4B3D987
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\3bvlPX7g5Zc6pp8TPpEM470u.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K7A3wvEg38KHuYPHbeRkE6OY.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.849986634224847
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5RysZVEDWXKCl:fE1N7231ZVEDWXKCl
                                                                                                                                                                                                                                        MD5:4E98C179405D0909D2B6190AD0C398CF
                                                                                                                                                                                                                                        SHA1:EA2E8CE8F9BE76931723A9E22427BBDCEBBF456B
                                                                                                                                                                                                                                        SHA-256:AF1ED288D1CA8FFE71C6E7BFA3799F334B7D754796B6BA94997E2EB754EAC690
                                                                                                                                                                                                                                        SHA-512:6D97F097F234461F37977D901A843B9C6E1A9C117EFEE28F3856830EF1E5084847DD8F1F918B63C6D037F52B238D1BE911B9EACEB751D6B222DECC763F7001AE
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\4WIaPCqUVwVYRafs2f1atHjf.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KmRS6Y6tZZ9BPfv48PJiBemY.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.905542189780403
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5xgVOlH5CHF:fE1N723bIF
                                                                                                                                                                                                                                        MD5:D4C58C0888DD3D77E41824F58BD2A26A
                                                                                                                                                                                                                                        SHA1:98E2F3994B12AF4F009F03456F0C11A60C7E58C1
                                                                                                                                                                                                                                        SHA-256:A67D6931E4887AEFF878E1D86A106454ECB3E25DD4D7665F332D5B594D371BB3
                                                                                                                                                                                                                                        SHA-512:05A32CA6AB070045544AF9BCB85C0ABB16B7DBE4DA13ED67CBE484046ACEC11D0FCA369E4F2FF2067753BC4D9C0B76D69FC2AE28377B6484B838FEE9048CF12E
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\TEpqQjIAfTfCTbePKUGsV0Gk.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KvisCbG5r0sGPjOu6iOuXUA7.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.952581383501414
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5uBu2LckHIBLACln:fE1N723uBu2h1Cl
                                                                                                                                                                                                                                        MD5:8F6D70D11E64B8E13257A3C6D87FC319
                                                                                                                                                                                                                                        SHA1:8A563DC599C8F919FA05FE3E0C120FF29C373826
                                                                                                                                                                                                                                        SHA-256:FC35F8413FB9A6F77ABA30D8119BEB937EE8CF01742C37918C91FBFA0D027100
                                                                                                                                                                                                                                        SHA-512:C6CA889DACF7838C8762000A43643D5BEB1DE136A3B9BDCBB92CF7E2C7C54AD1C20FC7A8D8AF00E176EDE894A1CCCB41A6B1B2A153107FE210F7EF90494A97F7
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\KEohnm8N5FXDryvXGbq4vqXq.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LsPvdG3dCcHmKoaWKVaA23HW.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.893670620721051
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5R3zyT7CccJln:fE1N723RzAlY
                                                                                                                                                                                                                                        MD5:E4D2E4F2FC13BF13C02384889FF89C7F
                                                                                                                                                                                                                                        SHA1:73A18EB4C10E03C121514093D9819003DD9EC197
                                                                                                                                                                                                                                        SHA-256:477D7A45E21C7EDF1A568050F359322A5411CF2F2E7F9187FBC4513939DFBBD0
                                                                                                                                                                                                                                        SHA-512:0829637570A4E80DF2A07AC061D0AA0CAA39FF1AAFC70A020E6438CA25819A36A325D105238BA7D825F060FC43C6F391B2A1718D42008917A79263D220FDCE12
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\tRGz8YUeJOvAWwmplTaCNv1T.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RV9AxJTOIoBEpSVL349oMZiu.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.867861029749887
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5WuvGNwdXheOrVFn:fE1N723WdKV
                                                                                                                                                                                                                                        MD5:9E15BE81344C0D53948D0A1B95CD1832
                                                                                                                                                                                                                                        SHA1:FBF184ABAE01FB7105214252CDAD32361774A45D
                                                                                                                                                                                                                                        SHA-256:25F2DBA3F2BA4C8FEE2B60B096C2617F5B41F781CD60C68AA54FFCF4482F8E39
                                                                                                                                                                                                                                        SHA-512:43EFFCFE1639B570E292B6295D208E62A9FB0E23865CF5D25750BAC03F58D93DDBE1630A7D59609294A0CBB95A7AD5962573D4BA51E3B4701EDC715C1B29CE29
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\3YZhMRbhtqchUxr6HrEmYWxb.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STCrhsi84NOAwKBL55hj4E9M.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.8309857237491425
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5Hq85ZV+X0oLACHFn:fE1N723Z5r+CEF
                                                                                                                                                                                                                                        MD5:8979E598AF340DD06E05662C3C4EDD1C
                                                                                                                                                                                                                                        SHA1:919ACC9EAEFAC38BE6C3035D506C110D058288D5
                                                                                                                                                                                                                                        SHA-256:5D1BE616B6DEAF06FD593FFC3E5B6B59F516E398225CF3234C007E63D9F66415
                                                                                                                                                                                                                                        SHA-512:434B0A8420B3BD876B648F37A1A0673259DB4962A5E87A2CAFFF0E43488B264E527EF46D5A77BB0E22914FC4A281591A72619236386A8B708DB96DEC928B82F9
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\bfSaxNj6PaRbQoH1x6AgorQM.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SoHZgMdmi98eGRLir19wIU3i.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.989456689502158
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5csCIWuxWw/iPL:fE1N723csCIWuz/sL
                                                                                                                                                                                                                                        MD5:240FBACBCF40CB7855C927B73CCD6860
                                                                                                                                                                                                                                        SHA1:03BED5E769692D853FEED2A773D595083E7C6AD5
                                                                                                                                                                                                                                        SHA-256:77DF1729CD1EE0E8B964BE1B91973D41B6BB7EBFCA813DEF33F7A6C1E3EA9E2D
                                                                                                                                                                                                                                        SHA-512:0C31C9748233FB74D61B13637975940229B40DEC23A469801FE99B3584B718DA67DCB78E3558BF402C9A092F204C464A08BE11965F42975D1EE99299A4808AD9
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\ybCY5oONgBmPsQ2TsLXObZGj.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SrXTpI9TA9I1c40N4WaBDHUx.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.949226176276606
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J59nEyKSmCkmn:fE1N723F5DmCkm
                                                                                                                                                                                                                                        MD5:45650298CC0B591389948F3927F22713
                                                                                                                                                                                                                                        SHA1:D268D45B601A92BA46CAEB3536C21127F960AB8F
                                                                                                                                                                                                                                        SHA-256:F28925E0ABFE3DA2EC7A4FA5908A2B9415051CFA57207E92E9F0B85D5FC680B7
                                                                                                                                                                                                                                        SHA-512:A64741C57069BF0F71222575983819478F314B0B1C763BB2D505827A2D76B557AE710426F5A1AB63713958493E2F6F90580659BA1D76AEB73556EAB7D4F48EAC
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\XBajRwldCSS42gwh4zu9f3ce.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UXpk6OrC4BILh0oiUWoQz54b.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.824177043253685
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5XT5p/8gr2AHFn:fE1N723jyAl
                                                                                                                                                                                                                                        MD5:D63C1C8B0D6D75B2B493866C5C8A8B09
                                                                                                                                                                                                                                        SHA1:00755827AA3AFAEB1C497B75F9035BEBAEB22AAC
                                                                                                                                                                                                                                        SHA-256:5440F0724C4B80D4F4AE826F2381BD0C30169BE4E990DF86C4A2B568959DF536
                                                                                                                                                                                                                                        SHA-512:74BE3744028F936122743B734D443A6AFBB2397FE032BFE25E8A920A28195F76F3B02707723B84779B055C0779F1F5C5CEB638BF2AD0F64BB81D27ED631F8F5D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\2D21U1bRl2sEI2OnuIMYALNl.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WH9sbyUogprfrhqfOzjOuvhY.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):5.025430168193587
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J58WPTLWPdAl:fE1N7238WPH2Al
                                                                                                                                                                                                                                        MD5:69C482C997ED1392AB28C42CDAD177C1
                                                                                                                                                                                                                                        SHA1:F336E20ADBFC6764579859655FC1FF24DB498810
                                                                                                                                                                                                                                        SHA-256:8774ACC6D00380D2E95777B2AF517F353C92C2C0D333863E8024568F08507F89
                                                                                                                                                                                                                                        SHA-512:B68492D205BAF2DFCB4A255759B527271A7930ECBE500A2935F1F9B9834554ECB147E6A146B886DCBB7BABD770394190E2F2E127DF5F04BF9442EF96DBF13524
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\Y0ZKJ4dRBRkIRESl8nT570lZ.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XAclRwykwhW5w1I14vXutIP8.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.885154258886507
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5k+znVL/NiIx9Adm:fE1N723k+DrH
                                                                                                                                                                                                                                        MD5:C5BD85B22C5748DC090F01BB39A49319
                                                                                                                                                                                                                                        SHA1:9B95374243A8671B0A74BB02E977B040C0A369E8
                                                                                                                                                                                                                                        SHA-256:5AF83F018042742A40739A01305D8326F15052D4E870D34EE515257ABB1CB289
                                                                                                                                                                                                                                        SHA-512:ED3E7EC60CC7E031A3FBB0205E6088A8D6F24BDF8271B54FD12B1B74B7DBAD040D99D93707829055D56BE144E175F9B34A95525A40FB93C251FD73247AFB9D3F
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\AdqitUVCSO3pnZ13PPMmTugt.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XEOnGkLosqdtoEbIuQ6cBGC6.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.855408294302113
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5Tp8hnxuvn:fE1N723N8hxE
                                                                                                                                                                                                                                        MD5:861F12D97C4D07D79FAF17A8790C8A40
                                                                                                                                                                                                                                        SHA1:9E0AB2B2AC517C3C2B3238169FA6DF7CE99A6E7B
                                                                                                                                                                                                                                        SHA-256:19D1FD4762F6A2182168D812EE4FD93FF0888D6B575E8BCB55A8E6859F279CE0
                                                                                                                                                                                                                                        SHA-512:7E7C339392A7F11251AEA74D71A286AEEB2BBBDD36DF680EE1B741CE91ADA4AB7798CCF349A84E7B822047871CC987C99E46F1D66845C9106F944BDD2D2D4633
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\6xNdov8AZo7X4GIGr08JaGXe.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y1TuohWqsbj6qW86KEnlWYJT.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.912932036664285
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5MNtR3GIJF:fE1N723MNX3JF
                                                                                                                                                                                                                                        MD5:71A70FFE4D2F4BF6FEB28C79C13928A6
                                                                                                                                                                                                                                        SHA1:F7DD8300A99FDE06C9ADD506B885324B48776416
                                                                                                                                                                                                                                        SHA-256:1D7178A7DD01CE9E49AFBD72C2E9FE7BC16C346BE32E0F9B35BC39B3FFD3964A
                                                                                                                                                                                                                                        SHA-512:4B3B3F7338B017D23890ED2CBCCC01222ED27799D91C3F9A5FDB03E847095DC82507ACBCBCBE166F654D3E094D23E7A194F7FD8BB1DF910216556877A9A6D560
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\iftEMaYodvzM2QCJfFMzhqiG.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y29RiGWpm89ujqyBR956QKV7.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.8590841624478145
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5hTSs7D61WCdLn:fE1N723F57eL
                                                                                                                                                                                                                                        MD5:676779DFF62B0418EDEB533AA564DB01
                                                                                                                                                                                                                                        SHA1:051B08574AEA8BC2FBF90557BD770D3A88CAEE62
                                                                                                                                                                                                                                        SHA-256:A87ED96ADCB8ECD1738892A3A0A25059DF2E0C429A3635438EF90A9186506B5D
                                                                                                                                                                                                                                        SHA-512:1FB38EEAB3AC6ABA3BFFAD8BE63A3640F2EEEDA46663670D05F968A805D7365E3328096D61D16C10973888E0818F6878C375BC32553EBC087E0DE9A1DB8A05F8
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\D6PuoAsNvye4jtgG7lWCsXEx.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YopaqCHxlkH079wqgDq82QyC.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.895057641139243
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5fXvUfXd3ra4v:fE1N723/ovv
                                                                                                                                                                                                                                        MD5:5E51D0437419923EE0CC896A4CF6F731
                                                                                                                                                                                                                                        SHA1:8DDFE1E3AD4376D2F91078CBF63146B3F9825A08
                                                                                                                                                                                                                                        SHA-256:065A796E30C91F806FA714E620A65C1C7F04D31A1682E34738E562EB246E089B
                                                                                                                                                                                                                                        SHA-512:122360914ABB55D7529684CE8FE21D823CA0D1B0C47AE3EC8F8BDBCD060F42F40FE5D6773C2C91FA60B8A2CFF8C9EF3E6B95547471F34D92F29A068F7C66ED03
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\z2u4DwiwBezR2xi11GPVbROw.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZUVBQJWmw30MkYm7XlKt7AGj.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.902447488023124
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5XLQm1ay81ML:fE1N723n4j1ML
                                                                                                                                                                                                                                        MD5:9B3A50172245A29DAD26703343BA1F8E
                                                                                                                                                                                                                                        SHA1:CD5800998558AA93E673E6E57124F5EB476E55F8
                                                                                                                                                                                                                                        SHA-256:1FCFAEEDC311D3025B34476B52CA4BBD0E44321F62A9D0B8F8775517560867DD
                                                                                                                                                                                                                                        SHA-512:36D025C428887EE91E65EB5A742088E6600DD91B6AD843A68ABADBC86D59ADBC9082A107BC0DEE207455DE10B71749DC4955D790D8E25439FE78132ACD42EF90
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\2MTLbmRYdCbpYlRWWULShPZa.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bHMeT4pgXesEvyW5uPXeXrhV.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.799852738746559
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5UHVRBO2eKkL4mn:fE1N723UHVRBOfKCv
                                                                                                                                                                                                                                        MD5:BA24BBF429555F3BA25D1B95FBE27EAF
                                                                                                                                                                                                                                        SHA1:E94031E42146DB423F515D41563E7752D48FB3AF
                                                                                                                                                                                                                                        SHA-256:F7A5F161A941B21B50633917EC2D8B2D3FA1ACABA57FD971E0D81C80AB04491F
                                                                                                                                                                                                                                        SHA-512:B8EE69C560214A020FDADFAF36098AD85C64BA9C4DE1A5F31257D7EFD3683D5DC2E5250F5277A4F519BD1991E39627D40FD2C63CD3235BD18B82D26C98BC04CA
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\1llpE1der8s65YfF1DaRwzoA.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c34MmnctgAY66QOjPh1MsOwS.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.8727015234387325
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5DWxc6zWLyWl:fE1N723JpWg
                                                                                                                                                                                                                                        MD5:52F666D8BE8F36FAA16F22E389FC0204
                                                                                                                                                                                                                                        SHA1:682C87B9B083C024B0CCDD860F5B2E0ECA47454B
                                                                                                                                                                                                                                        SHA-256:5CBB299F5794EACDD63A5E67C41E9BC6EC72800CF5EBD45795F1C3E37F199750
                                                                                                                                                                                                                                        SHA-512:99EABBDBF49DE2EBB7256BEF873C02A79E90406F5105BE1A7AAE7DDDA919E44A3E96D2827D4F864D96633178D8CAFBAE520ABA19B9FA03A4EFE11DDD64A1F389
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\f3qMySWuesp6iqsnQUyX8UG1.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c71unQMWeg7PYGrwROGwHtyF.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.916026738421562
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5vTbgSovzVCl:fE1N723Lb9o5Cl
                                                                                                                                                                                                                                        MD5:F55F55D782AC13BC0CC035518AF27C94
                                                                                                                                                                                                                                        SHA1:9C0A354D7295529023B98E40031776789A19D1E9
                                                                                                                                                                                                                                        SHA-256:CF737704B19933D894B0367DF7ED8DB247F56B3794878DBE51059434C3CA8E35
                                                                                                                                                                                                                                        SHA-512:CB4E411D0BCD8288313438D62D32E8939A67831325245C07EAF565035EF4489FF58AC920E6A8508EB098854E2C4C11FE53D5FA9FB4081337625F08697EDC655E
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\J6EKnVYc7FheOARgvJ4DtZho.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cWf68SrrVhigcjAkioMoDc9M.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):5.001328258561511
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5twW8Sk1TVndN0Cl:fE1N723VSX0s
                                                                                                                                                                                                                                        MD5:3AEE2777A488C7ECFB00F45F035B69EF
                                                                                                                                                                                                                                        SHA1:DCC70DE71C610F260E987509FF1DDBFF7C7BF507
                                                                                                                                                                                                                                        SHA-256:235416380B05DCD362E5439FA0402098AC54AB6AB043D865390896D4E70552B1
                                                                                                                                                                                                                                        SHA-512:396E7860A467A3202F11DC796DA8675CDA9F3C793F202F3AB263C405EAD2587622357FEDBFE6CCE8C1AEE94136D3C7EC2DECA3DDA0848F41CE09D066ABABDE8F
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\HUsiXwAPudopBX0gkG8zqZ9K.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ceU4OQADnN3GJaQwan1vgjT9.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.890217147450398
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5wv9jYVF:fE1N723wvpYVF
                                                                                                                                                                                                                                        MD5:A3B861B1AA24908E6A35A20CE72D8531
                                                                                                                                                                                                                                        SHA1:D658B09EC44D816BDABDA2280DE71CCD757470B2
                                                                                                                                                                                                                                        SHA-256:DCEB273ECDB829039F1514ED23F8DB2F5C6D1987FE1BF781C3A425CDBAB5CBC4
                                                                                                                                                                                                                                        SHA-512:2EEA6C1F1DFF37E9AA8605DD9962703806A172F5A192DB111182F7DA23629190E36FD4E9FCEB60A0ED8970EDEF79B81C3BA6FA6B47ED66F0A3866089858324BC
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\UrMKiBsPUmHBdjATiF2xGFWW.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dnmqTLPgvl17VM6aTOSeVWAl.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):5.046399265475906
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5gW9vsQl:fE1N723gCsK
                                                                                                                                                                                                                                        MD5:C2DA858DF32DEA1D6CCAE5D3AE18A95D
                                                                                                                                                                                                                                        SHA1:B0D74010112741942BA5964FE8A8B6B0E9A70B04
                                                                                                                                                                                                                                        SHA-256:7D8EDC0B9B3E528967C6982557E3083B2C9A177040A6BA83C3B808BBCE28D2C4
                                                                                                                                                                                                                                        SHA-512:028FF02EFE34B5E3688A03E4C4256B2C09A0A025A0FF37290F7D625045F8B013511052B1D98B036E570607AE4645C35F54D29882C63F5999AEBE68656E383D35
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\EmEyDLXTX7wKV3Hm4GA8AbdZ.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\egIuyYL0XWot1sQ1CKEo0yi2.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):5.024043147775394
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5r1TL0HERCMD8EF:fE1N723JH0HERCMD8s
                                                                                                                                                                                                                                        MD5:9973035A94514004CE1FC6DF40653E8C
                                                                                                                                                                                                                                        SHA1:322E6360AF22BFBE1349BBC32D9D69804D1BDB72
                                                                                                                                                                                                                                        SHA-256:A60E2C27A844C4F203EFF0751A0EB1E68CA939AADB153D21AC816EF03446AE21
                                                                                                                                                                                                                                        SHA-512:05D63DE10A907441A9597C7F092109F033CC30F0C3433CF7A9C145E2B132DE176D4B40083EB7EDAD18A39591DB9790E02C0EE19C31E005F13A269333D663AF13
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\NE6WkYn9fBQoC9a4gd2yFZXX.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gAslh7vC2xygVyjix2LVTyPC.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.877764412002625
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5RfJ+O0fR2/bAl:fE1N7235Ja2/bm
                                                                                                                                                                                                                                        MD5:36D37F096ED4AAE1BC386B6DDDC39127
                                                                                                                                                                                                                                        SHA1:11F0A2C30A4989A07C17797A5B7A4BAB44C210FE
                                                                                                                                                                                                                                        SHA-256:B0DE848616126001FC7661A36DB8CD97CAF1756CCF30B5FA318AFBB5B7513F7B
                                                                                                                                                                                                                                        SHA-512:DF005D8243FA82CE9299184A7C1384C49E2624B881CEF7E9EE1CE18F919C1EFC990F53435440F2DBFF9CE8352031EFD01C3AE2651C28EA05BBD79746167D0AE6
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\4zlsKqSOTzijQzm8qevqChAD.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gTBwdxjcV58Ds0EuIxEHQuyT.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.87973259880924
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5pISEbKuLNl:fE1N72325l
                                                                                                                                                                                                                                        MD5:B9F4DB284A760635551F071AA27539CE
                                                                                                                                                                                                                                        SHA1:B33A0AC170EFDBD6B7FD063DC2E8F0684D45D898
                                                                                                                                                                                                                                        SHA-256:701F28EBF182268B639DD1D19A16950D467BB265E2E00B541AB67A9F4B7C581D
                                                                                                                                                                                                                                        SHA-512:9E6CAA28AC5E8CDF766FD480B77F51933660ECA0440C2ECBCC8FCF1B9742F92CC53FFF5F763EB8CE025C8293345491BB9BCE6F0433C76B7EFCE7865F00350B5F
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\LmG3qDHSUq8w4Wsw1PGm8pPm.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h7tMLzMWAx4CTbi9OWkNEVuS.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.869248050168081
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5EAuvmVrU8xn:fE1N723ELUB
                                                                                                                                                                                                                                        MD5:334F38B2C7F9F2CCBF1E68B00045BDDD
                                                                                                                                                                                                                                        SHA1:3ACDF5C3F6C41A6CA34EDFABED2388FC26BCF811
                                                                                                                                                                                                                                        SHA-256:776F7B97883F1C52F74D3E729E0B080B36A1E810E5CBD5F312DE6A0F59E2EBCE
                                                                                                                                                                                                                                        SHA-512:9BE9E1492A0FC8A5BCDAFCCC10023FDD76534C135A74950DFE070D383503C8CD596BEA2157755E83F19CCB5402511B0E5607AB93D6F76133808839194BAB0FBB
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\ar5KINQCCayk0Kw6DN1FAVFx.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hLGrDTl5wAe0ZCERmdwmmvPw.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.870955731507165
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5r0TB5V6AHF:fE1N723MB5V6AHF
                                                                                                                                                                                                                                        MD5:D158C14895BB2B5F27578EB18A34D0E8
                                                                                                                                                                                                                                        SHA1:CD328615C64B06BEB4700ED211F6D62425847475
                                                                                                                                                                                                                                        SHA-256:E00D7134144D489FBC711924AA73AEE79CADEE67AD27DFD920EFC9F2EF42635B
                                                                                                                                                                                                                                        SHA-512:0C6D483D5775FBD310EB9A319644799CC8C87CAF2B0A347F36DC523A71183F0EC8B3A9995728595ECBAA445E0ABC67C27B41351DC03F7E911E3773D8C31404F7
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\NAw5Utgp8P611rdec0BR0MlI.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hvqSJt3tl4h6cFLkNI7pBJj3.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.961097745335958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5TVpnQUi1z6plkiF:fE1N723ZXi1Wvkm
                                                                                                                                                                                                                                        MD5:7161D83A21F862C9AA5D6A344336A9EB
                                                                                                                                                                                                                                        SHA1:5C04F91D33020F4D56F7E227EBDC78F57E8DF816
                                                                                                                                                                                                                                        SHA-256:9394CBD6B5CAD87860D7C18096B8B259C6F33E1DA0837789CE853B995E4EEEB6
                                                                                                                                                                                                                                        SHA-512:21BCD628E505E296F961AC72D39C63B50A27FCD9DCC4767D46745895C2DABE2D384E21FCFA565CA4D8528FA3AF87A63AB5B33DFBE68E9ED6E63048F23743F4A8
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\604jEG5qQpdnhPVOdLS1sPeh.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jM4p86qq1bs1OanP3F710dRm.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.7550041267072105
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5mSVHolWAl:fE1N723mSoF
                                                                                                                                                                                                                                        MD5:00DE4CF25F31DC66C56F5BE741D6A216
                                                                                                                                                                                                                                        SHA1:B0FB7D767EEC74B47FB3F4CF07339FAE44DE0CDF
                                                                                                                                                                                                                                        SHA-256:FA20FF45CF552A67EC60EBC437FEC754905A11C2A4AF60CEEE0A83BF42B0458E
                                                                                                                                                                                                                                        SHA-512:E61E21A142ACE08C0BD3BE9906DE871E6A191F5EEBC034B09CE717CA19D7E61DC1349317432F4C5D4DF7617A9B59A9803CBC592E960D0300744429E221CBD0D6
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\CwwSkg4Z6r2CyUx7eieftoSL.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jzizZsyjVCfkdBoHaY04ImfY.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):5.035914716834748
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5cr0gCIkpzAJF:fE1N723c+5AJF
                                                                                                                                                                                                                                        MD5:2A0B9C825FA61FB0957C37F6ECDF98C8
                                                                                                                                                                                                                                        SHA1:931C684901D66496150DD934896D147A024A8AA5
                                                                                                                                                                                                                                        SHA-256:99CF82971F8B5ABBDFA8A44A964CF6E4152CECB43C9C55CD808E3B52C8B7059F
                                                                                                                                                                                                                                        SHA-512:D98FE9F760A6CB373DB3366E5580DCF605C25DD4459343585398F8DA304693272EE8D9FC98E03AA273585E9A1D9F210CC992C1C2FBFDCB3C0626A0D4D316E51F
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\yNQkYyPgov8fX5k7nVDGzk6w.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiP2ZriYOwMApD298FYD4Lwu.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.877764412002625
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J53SclQNM5Ct:fE1N723LKie
                                                                                                                                                                                                                                        MD5:1C0FB2507BE35AC925B95DD3FFCF6931
                                                                                                                                                                                                                                        SHA1:4EF1E4E9AF3EDC2F706A527A6B1A484BE0E42984
                                                                                                                                                                                                                                        SHA-256:E6193F5B97B2DF8EB34BD6EB39FD09CEF555CE6C52160CD13876DF2AFF7B9993
                                                                                                                                                                                                                                        SHA-512:5F6047DCD246AE508ED85E7D05C35E715742463A232A55947D7872D18DE672506181296AB64D80937A7E7775DD90068B539EC49728E716C1AC8585CD39AB424E
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\R7igej85hEl8p5QzHqqsVcc4.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\knu0oyMuRWGGQcesFzGIw2Wt.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.8159813423400335
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5CWj7FjTLY3:fE1N723CWvJc3
                                                                                                                                                                                                                                        MD5:9FEFE54E516160EDC0519E30121AB5AE
                                                                                                                                                                                                                                        SHA1:1DF9E613212578812A1C57F04E90C378277BDB78
                                                                                                                                                                                                                                        SHA-256:19D28D403B8348B936435EE9EACC859EAFE7882AA11F5143241FE61BE151E717
                                                                                                                                                                                                                                        SHA-512:39F0EC0ED498A4DC842670D7B7B1E2894D51AA31D0DAA14C72D53815FFC74A6EACB6EA2A65540BF79AC9EAD0C934A8D43D2DCBB73DD85B17733DE9A227D007E6
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\gsF9GZceaIYWveF9Wn0mXwbt.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m7rmoohzeMWquAaKzkk44dVj.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.980359161279193
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5DhFQSDcyOyJl:fE1N723d+qZL
                                                                                                                                                                                                                                        MD5:3D5B58B6EB4CDB6FE12F4E6CD63E8F7B
                                                                                                                                                                                                                                        SHA1:2E96FA14865C7E03222B96486282C3D9B29DA472
                                                                                                                                                                                                                                        SHA-256:B90460DFCA48E3B9A9F125067D7F82FEA94BB06E44F275590DB072DA5BBB08D6
                                                                                                                                                                                                                                        SHA-512:56A8409473D7301AE4A88030C79E3F7872E466DB24858AE5854353BF0292043F48757D5CA0CD25BA14FC65EA2E193F01A773289E9EABFE9F64C20F7DE87532EE
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\fRiNFTEVJnpONJofzyWKlqwW.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n4riRFZEfbyVOzVYofZBOrtB.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.9438045161993385
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5xAds1DAUoBvn:fE1N7233WBv
                                                                                                                                                                                                                                        MD5:0414299D1FF13E76B472A256292A02E9
                                                                                                                                                                                                                                        SHA1:46893B04EE6C8F6DAED687A12ACB92CA2A66FC0C
                                                                                                                                                                                                                                        SHA-256:C6F44CA0E2C3E3C18BA4D59D2BD026EEBB23D0B5EB2C3061A3FAEC45B6FDCF47
                                                                                                                                                                                                                                        SHA-512:3B6A594AF09ADB701EBB456E27B067EA1310687B2555B2ACBFB652B97C990B3FC7B3CFDE7144AA39C3789ECE25273DE76154B4EA5478DD9F611FAAA69F4C2506
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\Te8IoKHiu7i6R94P1wuixO8g.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nA8bY9X2FgzDvoAfS8gVQ1wr.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.938741627635446
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5cOXuIwQsn:fE1N723cPII
                                                                                                                                                                                                                                        MD5:1ACB9E903AFAA3F5B73C481C24FE358B
                                                                                                                                                                                                                                        SHA1:40C54574A348475B59D1CEE1C1CEAE51DC25581B
                                                                                                                                                                                                                                        SHA-256:3F19D77B8869725C062486D98EFA97E65036CE171A22E8176A25210317DDEE22
                                                                                                                                                                                                                                        SHA-512:C96AE637BB32BD53E17EF943AB1540E265B5E02314AD2C314A4F8A38903D2D22F83DEF9D504D123AD862D7D20E7040D2B1984492C48FC9436AC9F4238A02DF77
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\91UaPJ59dXTYhY2K658YFFeC.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\o20nv1tLMaTOCdndUzZLyXfK.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.956257251647115
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5HIhUF0Y6VF:fE1N723hwVF
                                                                                                                                                                                                                                        MD5:32CE5209A72322B89D97B1AE597EBBFD
                                                                                                                                                                                                                                        SHA1:D7FE83370C658BDAE40F6F3FE5960F84783C3CC4
                                                                                                                                                                                                                                        SHA-256:FB7405EFB81E79AF0C2BD58D50F3A2C9776B77F7F4209D79BEA5B91C70B4D3C3
                                                                                                                                                                                                                                        SHA-512:7C4299AB2D1D0C7AEE6C4443347A1077FEF819E4A960A2B3142BC8E43924CD727F9C657B6140C426129C91FBD56B3208A82F6F3F26B11566156C0EAB3A80D006
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\bVARrzkwQmnP1mnoffZ1HExy.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oo2nklTvOQFEbMqjuAmf1Hnt.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.923416585305444
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5rVvjUDWf:fE1N723ZvjH
                                                                                                                                                                                                                                        MD5:BE9DE3CD01E825EDCF9AA31969C935BD
                                                                                                                                                                                                                                        SHA1:8B0D1D5D4BA72AAD1EABC8BD708067CEEDA8B669
                                                                                                                                                                                                                                        SHA-256:CDE3256AD03DCBA3283B4C34C5C84C21DF967A4C90977FE72A9D756463634B4F
                                                                                                                                                                                                                                        SHA-512:CC3BF3B29DFD14EC152BA7A6071E52CB5431582551176B8DF0178D4EEBFE1B87C3B37FFB46AF3EC265E06DCC362EDB65412B0A136A45B353228FB2FED67403E8
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\Nx2ualF4WR83o8BLpmD9zVrW.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pG2TxiBh4zhTCyAEyXazkYkx.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.895638807527665
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5XcsVXmaXY0diF:fE1N723tV2aXc
                                                                                                                                                                                                                                        MD5:42296D5530F0C7876804C121F525A4EB
                                                                                                                                                                                                                                        SHA1:5E1038AD910997316755311558ED18827C001988
                                                                                                                                                                                                                                        SHA-256:8FFEDFC4EBAB15D93ADA88AE9C92F7CF803CD430093E84E72597F6A8D8982B10
                                                                                                                                                                                                                                        SHA-512:E2C05F61F7DAD388100FBDB4C981FE27E68FE2EA942486A4B48D57E51E56E92A9F6F306EEAFBE44D271D2F28379962FCC85119500AB63AF0166AED662786F4EE
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\29IA9rCjPmrMnnZQZ7YKNcOZ.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pe45LiQAO3PHwvHnhaBGnATu.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.917994925228177
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J58fs8HCHMyOCln:fE1N7238fs8ni
                                                                                                                                                                                                                                        MD5:F5764880D35DB248C3FC213FB9913292
                                                                                                                                                                                                                                        SHA1:EB57BE44A471DFDCAF087E2380A34E40C9BF7807
                                                                                                                                                                                                                                        SHA-256:DD3154345CDDEF239A3DA9BBAC6282EE60BF0F8163985FC98405D8D2CC16AE54
                                                                                                                                                                                                                                        SHA-512:890CD0E193AE3F61AA1EADBD941EFD171AA307BF3C3A9D82B8AEC20C25D5266687C331B80A9F19141D999D959C37C052A6F5BE903EE4D1A275D050ACE774C476
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\Yg9IAPVdFD93gbLGPdcvbgw2.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q2MHhQs8ujbyxQ9nIy0rUSZ9.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.9457727030059555
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5dWjtVWSWwFHfuACHFn:fE1N7235SLFHkF
                                                                                                                                                                                                                                        MD5:4E64A1014C8B4048E39E9424F87A6F88
                                                                                                                                                                                                                                        SHA1:07404D4FA1795710942FC7C58B0373927D571F2D
                                                                                                                                                                                                                                        SHA-256:82BBE6473AD51ED4888B67934696B83D5C82D348B8CA7F1A0CB56DC002E9E376
                                                                                                                                                                                                                                        SHA-512:E1C351FCD7CD6ABFB5B4815985C12FD444512F72FBD248C688E89C5B4A21CECA4BC3F20A72860ECFCAF96288ADA0F64072043DB1E5F79C6226A2CA71629585C5
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\8sZNm50KnZ73Ir2IAGAzjiCM.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q9pKFX60prYFxYuSKChGpHnm.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):5.101954821031462
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5vTVEsqOs1x3+HF:fE1N723LV9oOHF
                                                                                                                                                                                                                                        MD5:01E7174EFBCA5B2EAEC9F5EF7D91A7C6
                                                                                                                                                                                                                                        SHA1:027EA84BB8F4D1186D3BD36D7E9FE30A36FF5952
                                                                                                                                                                                                                                        SHA-256:38E659BDFED18D7AC948747346F7E4A7A56182D6F159F66E56D346405DB8F9A0
                                                                                                                                                                                                                                        SHA-512:B336FB23800A8FC39C02DD77B12B8F72C167B22913C28BFA3F775229D39EF24638889C6A1C9E26A98E48CE316F07820F3105942363B30406C488F1A26AF50CB3
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\J60VIKU1uGOij5ybpvmDPTRI.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qD3SrN8S7WnRLCMKBnzLsK1O.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.942096834860254
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5omIuGnpqJFn:fE1N723omI5gF
                                                                                                                                                                                                                                        MD5:F088DD235850CB605EFDEB37B624EC6E
                                                                                                                                                                                                                                        SHA1:049BF27CE02DC39E0D94CE995A17E8D4E7C7338A
                                                                                                                                                                                                                                        SHA-256:D30CE51BE80E16C97B9FA3B5974D8CF25A94ABE75882E4CDB616E3831BCC6414
                                                                                                                                                                                                                                        SHA-512:7C2CAD019C6E665D677BF85CA10E226C46A429F6163D6CC404B1F4F2281F069115A4E4D6FD45493F93EB678288F8BA60CB57FB89E546245CD3F7425183E0E05F
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\MCN1KYKWa3qY8Q8lKV2maDTO.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rqQPiQHZVdsiyiCJe2b49hD1.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.817727134271598
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5R1EziO29uQVF:fE1N723T8bQVF
                                                                                                                                                                                                                                        MD5:2C97C48A2A7DBFCE0D8B8E745D28EBC3
                                                                                                                                                                                                                                        SHA1:157F99DC5CBED5AFC6AFE91CEAA17D5EC29F4614
                                                                                                                                                                                                                                        SHA-256:7F8333A9597F528AA708A61DDED81FCA37C8AC8C34A2F12D473ED6164062DE7D
                                                                                                                                                                                                                                        SHA-512:6E3528E6629278F5F0BA6792DBF6B98CAF603EBE0900E53AA0511FE0758BD3C5D46DCFCA662A6875BFDD26D05855CBECC9D04E45DC8A129BE128C863D8073DE9
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\4PmoraVG5R1jZgxSXUXnrPno.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sq2vrp3GOThXviJiP5PWUXgP.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.7629774327458145
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J58C5zgBLJ3dAl:fE1N7238Ct2m
                                                                                                                                                                                                                                        MD5:7DE4B92FBEBC9285725FA82E533B10D5
                                                                                                                                                                                                                                        SHA1:BFEE802189F690DDB4AD9F136321C6106934028B
                                                                                                                                                                                                                                        SHA-256:222A8CE06FCBFE1719F4DB6ED2D3B7B00126BB146ACC69D67D07D4DDA329338C
                                                                                                                                                                                                                                        SHA-512:AFF9C4E605FBE19DECE56C47759FE0BA7CBF65C103AB9867F260A2F63BF4D05CE2CE9552856EF8D2DED358DA766B64A1535AC8841BDAB456FA5FFE4565A9220C
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\YdDMLcotJvPaOVEHpalanl1d.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t5H58EEc8NvQUOi24FS2QU9Z.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.838115065165496
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5/JXAssQcfXrtbV0diF:fE1N723yCApxL
                                                                                                                                                                                                                                        MD5:F3619DCAA8978CD9E45C5129524D83E7
                                                                                                                                                                                                                                        SHA1:60CD01CF198C24097ABFA2502A3D1EBFE0797151
                                                                                                                                                                                                                                        SHA-256:ABCB925141272549666ADCEB1BFA6B851D00562C8122DCF07D3C6B03E96DBF8A
                                                                                                                                                                                                                                        SHA-512:E7C8535A082A778F102A56361E23B6A541D019F6B07355E2FD80424962787A411A08A538ABE69960834C42D7A8F9CE6F8A31978F7B36E51BC46BFC3EA6A30AF9
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\Zy6qmavCIexKIuB9nNrNHs9p.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\te7OtjZEJK2Mk7mXcL1FVp1t.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.886861940225591
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5OiHW0hfNRLv:fE1N723Ok1RL
                                                                                                                                                                                                                                        MD5:81B549AEEFBE6DBE68BC11B728836030
                                                                                                                                                                                                                                        SHA1:C620C29546FFFD71325D2EDEE59EEB6487DDB104
                                                                                                                                                                                                                                        SHA-256:555B192A6C51BA3C54D911966320FA2EEEDD035A80598A1B687A02C69B097EF7
                                                                                                                                                                                                                                        SHA-512:FA4EAFEEC52A84DC48DC739EBC8D54C6EFD1C0B42110FDA1070D6A101EC806087A02A0C4B06A20BE941B3AF160CE3C0CAB4353F4D834D81BCCF068C839121077
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\k4a17b3U4KeqWyuMzrdWzqyt.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ukSLyv62ACmzThXwhB3niDP7.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.923416585305444
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5LNGGwIpLNln:fE1N723hGGNpL
                                                                                                                                                                                                                                        MD5:F1917318637448140F0346215994E9C2
                                                                                                                                                                                                                                        SHA1:84908CCF7FC1F64927186B2296AE4E3D268D7E45
                                                                                                                                                                                                                                        SHA-256:AC7CFD1501F18500B8F0B6FC64C0F53097C2A3815A32BD7E5BBA78F3A019D2B0
                                                                                                                                                                                                                                        SHA-512:7566C5F4790BEDB4F1A2C66810F145998C278992FCE84ADBD5344BD4506104017475ECBD151758E362E49DBBD779DF21BDD67A30D39C87840537149229F147F4
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\nRXc5v7fBpZ3Rt6WXas92N9q.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwiFh4sCwLoSouuc0prFCqtK.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.935288154364796
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5w2u613mSjg/EF:fE1N723w2uNxs
                                                                                                                                                                                                                                        MD5:019683466FB2526BAF20320172BFD465
                                                                                                                                                                                                                                        SHA1:CBFDCA7551BB6F19AFC632B74435C77F7C5A5B4A
                                                                                                                                                                                                                                        SHA-256:055A3F6C11A229C0EF1711BF360F26EBC305A37E9F8A5EC18A857D7AA5CA268A
                                                                                                                                                                                                                                        SHA-512:214CE0EEC3B761E96FA20484F738302693182EC9042F79D8D3AF08CDB4B2FE00932B3DC947AB8A8DB2727C96CA83A130C3F0A84E33FE18C10832B7996E678CEF
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\US6SMVSChPuNg0C79rqEySgv.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vAI2Xs35kAr2PgQ3tHk3TkCy.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.935288154364796
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5GUQQcGVZpd0s:fE1N723GUQm/Os
                                                                                                                                                                                                                                        MD5:279E52DAA1FD4D66A6CFA16E7910FDA1
                                                                                                                                                                                                                                        SHA1:6D165E59AD1CAE43E7455DC69584E1B4000E628E
                                                                                                                                                                                                                                        SHA-256:9C61CD3B6B3D04E40D6EA4066A18CC8F259374146B8ED9E7CE0D7E27DB350103
                                                                                                                                                                                                                                        SHA-512:8B2D3CC303F4C90AA8CA8707D609E96CA7E7E5A1E0CA56D724DEAEFAE6ED520DA85F06C9848090146F5D73232BC72F2751F8EF3DE8EAFDE0F9A9DFB99EF171DA
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\cqEYVGnsRBmElwXA0pViDIv4.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vqU1ZUdZjjkc4TpP3qVRVTsG.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.9616789117243805
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5fkRD83jpB2HF:fE1N723ADigF
                                                                                                                                                                                                                                        MD5:8B9B89D26329F8F1A25CBA8E63D1A839
                                                                                                                                                                                                                                        SHA1:19D0195A60A2FAC53853BF8EB2B44757D774E548
                                                                                                                                                                                                                                        SHA-256:038143AD269BFECC1F2B7C83A3231D24ED3CA8CE70A81EEBE1490C8569CF4EB8
                                                                                                                                                                                                                                        SHA-512:B97681C514C88FB690E55340A0FF695E8B7178492A58F0F3BD6D4C9AAC4B5F99C242DBABCDB7009F543E706C3E374A5054C0170828761AA8386C6163662FB167
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\zhcyBjWDtf9NR8VTfZLAmUWa.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xVyc1vIYuCdL1tewhYCziFVg.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.866474009331696
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5QrXuml6cbXzGhn:fE1N723QDMczzGh
                                                                                                                                                                                                                                        MD5:0B1F6E10445CEA365B20216D7C9F360A
                                                                                                                                                                                                                                        SHA1:5657291598C4335B06E3623604BDFAE4BFACC687
                                                                                                                                                                                                                                        SHA-256:85D81AB0B0A8BC6A28F22AF82EC3195B41F187787349B18283B1C12BC3452B07
                                                                                                                                                                                                                                        SHA-512:3ECC416D381331BA02EFA085315F2AC1053EFB215DDBC8732F1FC44144EB0174191AEBC9830935B4B5F1F71ECF0C9CE7600A91C76BA22EEC6674159ADCEB7E56
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\5N2KVotsup59l0rdMarxmZjH.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xwizdCQzMqPRubh3w9ge1vnD.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.878345578391047
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5uDXCkv/mDyII0CHF:fE1N723urnv/mVEF
                                                                                                                                                                                                                                        MD5:B97ADA83E39E2FBFE52F6E0CBA924BCB
                                                                                                                                                                                                                                        SHA1:27AC90ACD9DBDFB3D3A79D74EF55D30C69ACDA7B
                                                                                                                                                                                                                                        SHA-256:80C93B1E199CEC0F0FC8AB6FC15B58ACEB97AF458DE1A6E3E1350D05C74BF5F3
                                                                                                                                                                                                                                        SHA-512:A0E2D0BFEAAB86B144324ECF31E48551B7A5536AD2A53110E1F23FA18ED1EE1FE863F952EED5F66435611E38CEAEB8026336E7D5A3835F5816C8C89699D654F0
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\KfIHlc6gAJQcL38Vr6ssqJ5m.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yFtZUbxQWpIY2HaeXL30Ywxf.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):5.029106036339287
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5D8eSqJzmxLAdm:fE1N723gimNv
                                                                                                                                                                                                                                        MD5:2D1EE2AD88B0C535EFB147A15560C0C5
                                                                                                                                                                                                                                        SHA1:E9F1042BE3EE2580185C1FC0B4F5E34B86E07A7F
                                                                                                                                                                                                                                        SHA-256:C0EAABF110B403F7123A8B71133DC3376FDFE48CB13920669194CFFA19D2EDE4
                                                                                                                                                                                                                                        SHA-512:8065A55A112CE21B2460D0381E648254D03B180FA740DD340C4C544EECC6D95179FFD9968F2674BE4795C815932F10139DA9E90C7DCCCB528DCADBB71F7778B0
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\fybzTZ3WiLAPEZj0fVOx3M0F.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ySmmNhEhk7waj4UzYYFLdjJ8.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):5.001328258561509
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5TAJGJutWzOsn:fE1N723MMJQWN
                                                                                                                                                                                                                                        MD5:A02453E2B812E99AF964FAC532A95814
                                                                                                                                                                                                                                        SHA1:94DFFB50B5DE8B40A4A1F9AE849E016B13CF16E7
                                                                                                                                                                                                                                        SHA-256:781C602C790D196785FAFCC8EB8C183530A160A86026457FDD798D8EFADD8BB6
                                                                                                                                                                                                                                        SHA-512:7B732A692715774FAED4285827E2FB96B76AB3DFC61859A63BC0247A467476BD93DAA7A1AC6342C9866A5B1884431AE5BF6E043E1D3B388C3481B5D4003B5E0B
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\vwsgN3REbITHxJG5vlKYY3Vx.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zHj24vPtn17meARVbAfrBNWr.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.989456689502158
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5N0J8QAEVAl:fE1N723P
                                                                                                                                                                                                                                        MD5:09D09FF0F5CE7276D8B0B953EF063E8F
                                                                                                                                                                                                                                        SHA1:D2A13695CC8DE9AB8FD5037AE73745FD55F6A2AB
                                                                                                                                                                                                                                        SHA-256:94069961A3B701D30A2A92B967865757B8B4DBAFDDABC8E0D9CA3A9D116BECCA
                                                                                                                                                                                                                                        SHA-512:D8F079104AFE18BCF11A3D8EB735B667C033B57BE8468440D7838C58C5D765E1E314059A0B6942DB9382362E1715DDEE1525BEB8CDC10E361866F760E07D86B2
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\hQa9fYPzQBrGD6byFRloLN5U.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zTd9jVATVG0lNsWEWwXEZFpl.bat

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):72
                                                                                                                                                                                                                                        Entropy (8bit):4.812305474194333
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Ljn9m1N+E2J5sPw/wJUF:fE1N723sPrJc
                                                                                                                                                                                                                                        MD5:6047DA8CEF07FDCDA005662638D60166
                                                                                                                                                                                                                                        SHA1:2E3DC902689E037DD5F69FFF3181C2EAEFED7BFD
                                                                                                                                                                                                                                        SHA-256:F73866E5FF3B5C729DE81A04A4C26669C859B7943A6305C7A63BAC62B9B5D03E
                                                                                                                                                                                                                                        SHA-512:F565AE6414B7E8F3D50E8646075846C632852652A4F12725D4B9DF5076E6E1847A463E0E208C38CB9603435D9193DA640806E579347EFFEFFD9C913BCABE853C
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\I4LhcLo5s9gVJdPowLL5oSzp.exe"

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):32768
                                                                                                                                                                                                                                        Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                        MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                        SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                        SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                        SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):32768
                                                                                                                                                                                                                                        Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                        MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                        SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                        SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                        SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):112128
                                                                                                                                                                                                                                        Entropy (8bit):6.400158525810517
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
                                                                                                                                                                                                                                        MD5:726CD06231883A159EC1CE28DD538699
                                                                                                                                                                                                                                        SHA1:404897E6A133D255AD5A9C26AC6414D7134285A2
                                                                                                                                                                                                                                        SHA-256:12FEF2D5995D671EC0E91BDBDC91E2B0D3C90ED3A8B2B13DDAA8AD64727DCD46
                                                                                                                                                                                                                                        SHA-512:9EA82E7CB6C6A58446BD5033855947C3E2D475D2910F2B941235E0B96AA08EEC822D2DD17CC86B2D3FCE930F78B799291992408E309A6C63E3011266810EA83E
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L...j..e...........!.....$...........f.......@............................................@......................... ...........P.......................................8...........................(...@............@..L............................text...6#.......$.................. ..`.rdata..4i...@...j...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1285632
                                                                                                                                                                                                                                        Entropy (8bit):6.460494158653329
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
                                                                                                                                                                                                                                        MD5:15A42D3E4579DA615A384C717AB2109B
                                                                                                                                                                                                                                        SHA1:22AEEDEB2307B1370CDAB70D6A6B6D2C13AD2301
                                                                                                                                                                                                                                        SHA-256:3C97BB410E49B11AF8116FEB7240B7101E1967CAE7538418C45C3D2E072E8103
                                                                                                                                                                                                                                        SHA-512:1EB7F126DCCC88A2479E3818C36120F5AF3CAA0D632B9EA803485EE6531D6E2A1FD0805B1C4364983D280DF23EA5CA3AD4A5FCA558AC436EFAE36AF9B795C444
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^.._...^.._...^.._2..^W._..^W._...^W._...^.._...^...^C..^.._...^.._...^..X^...^.._...^Rich...^........................PE..d...i..e.........." .........R......h........................................P............`......................................... ...X...x........ .......`..(............0..........p........................... ................................................text............................... ..`.rdata..............................@..@.data...L........D..................@....pdata..(....`......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\0FhI3ymKwyu4YKH0P5aiSwr9.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\0rCtm6Hv5UQtXJOFVlEJjcOA.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\27xttgdEmHmLdE1NNbjDPunl.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\3OywHIBuj0AIQ7Aq3CE27htS.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\4ebcbWCvvuWPOCPYovXXMriV.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\5Xza309AWSsKZ7QtcoKLlH6j.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\6lvatP6Q76Lt1uvfZT2GD6HY.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\7QngCiEI0nWQ5NI3rtCate4r.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\7mRVtPlrMfZmo26ldo406lmd.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\91wCUE8aqMgtssmXq8JjQEVt.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\9DP8FgphO9xB4vzM75llXw4b.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\ARFJvysANOCKBRK3eId7VsQB.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\ArokRzfYMxWDCVlcYzlFE2Lj.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\C719B9p0FfrJspWW8NACmoaE.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\Pictures\Czc5fung6FsMhCVG7EMYaiqO.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\D8TGVGr0asGkgU3ycSpOmYcn.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\DqApJooverXr18YkrozyIUpZ.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\ELbDrf9qIHQaBWPxuiJjUCoM.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\F5nHoJjiPsXq9PqBPnN3uVb5.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\FMABIYNaDvdpX82vGnLOftDu.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\GFV2yyE0PpJkpGdl2N1D7Pr9.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\GJ9O0qofKCDUPenZCkorX2YL.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\Pictures\GcbucsdsAk7dv2EzyRdhbByI.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\J8btV6htPGHeL2Yg1SgCaGFn.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\Pictures\JkJexXpPrIyNVfwGJRUJua9O.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\Loo9WoJBx4a6RLa9vZq7467f.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\M7rZI00dvqcykJFiBeuGFS7T.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\Pictures\N14E2wCpaY7ufVWw1V4rquym.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\NXXoMKuzuftWWcaGwWfRizTp.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\O8qlhpLK7TtBYe0J94Fm1B86.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\OjMaXQfausZW7L4bZ74RhT97.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\RbvLNaGRBEsayaSXnP4Zo5B2.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\TPSAPLN3OIImBCuzU9uj0qm5.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\Pictures\TexEUOb49XCfEjOcQuxS4LdR.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\Tn3AK9zqC5GmoiH5iA9IY9Q6.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\TwRm9Z0OjBAq1e9wDGeHmdCv.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\Ud8P6u9zcQkOThPmdNJauqRX.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\UnZ9xXtOVzbDDdfuNC2Trxtk.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\UyBcuun7lvdsc1U8v04bEvjS.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\Pictures\VOC2vgozeooRPwe4xNfnekbg.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\VRZS2eg6KpyehTgltwjCKDt4.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\VUhKLgvybQx21ilX50E3IN7y.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\WIZZw2jIWtghnINz7Bolcg6s.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\WllNfMrTNMJ4E1bpkfOuURJc.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\WmwQPTarASP4EtQ3MAZKQqLX.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\XmniUOpJt9KGe1pM4XamnqZH.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\Pictures\Yv6kDvOTN4rtEsFYOeCJZShm.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\ZA6xyNAEYiDprMq2qgywyku5.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\ZFNbxiSI6dIgrSto9a3Z7jlo.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\aAFMFn8XgxK4ax5TQ7f1st28.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\aR1aAXIrzQtExVh9FbdfoBrR.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\bU6cqro2wPcmClLzDGRpxfw1.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\dLosfqkp920zMbaetcnvwrJJ.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\enEog6vYdNgmFKOyGbVQTrXc.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\fW9mvrDIULE1qzTuYb8DunLu.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\gpxXZca2LPxp8nx3YxfAq52Q.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\h9zNDFfiMy6YEXVQdIbIdOv5.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\iiEhcrEC7kfTSvcQ2xPEqYzR.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\jDKkqPCmIoUaiq9LrPYuCKQs.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\joRzh0eN9ubjpRYMOMHaTsYl.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\kivxs7Zej5QjZRx4S943Y5EA.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\kqcWDzUDzGODoV7JWmwBlZRR.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\lI1wLYD1b5s5Qo04Ewg0WqV1.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\lIBiF8F27nqVHoA6YIdbqFcI.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\Pictures\nw6IIdZQfEhqp8k6unIrj2qH.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\o70oR4A1odPm6ZpEPmcUY0kf.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\pTXFwTPyWVPZ4sTiGkA8a5ei.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\qXzqKXhtyyRVQ12sGB23FDz0.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6532002
                                                                                                                                                                                                                                        Entropy (8bit):7.9959593780388705
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:196608:91OXMJdJiB9rrezjknd2evIO726Kc0ODm2ysu:3OXA8wYvt2vc0OnyF
                                                                                                                                                                                                                                        MD5:5638D57A305AF6D979C2FF2F7634605A
                                                                                                                                                                                                                                        SHA1:D411FE7F10FE6488F4BBCC52704146D124177F9B
                                                                                                                                                                                                                                        SHA-256:BC912349A4C6E0700E5709EED23EDA3F1E5375C973B17DE0C77A78398CA5DB16
                                                                                                                                                                                                                                        SHA-512:ACEA97EE145A44FECD8DD403F4045DDFB1A31D1A59DC5B700D564640C4FE1FECDF7F9EFDB9FB996C52E7A5957BF09E12BA2852C9ABD56FF2E8382283F648A990
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\qiW5UZkXzhMJ8qrVDgrcAGm1.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\uU9N3wILYLaLsdrVTU78EpKz.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\v4pPJZm6TK3eJidyD0YTpSI8.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\v7Li9n9DDXtQeZJRorH86P5g.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):729201
                                                                                                                                                                                                                                        Entropy (8bit):7.981855800192188
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4MwdFPk84fAVzjjADWm239v7tjw0+0KAdhQr2l9BOAzUkxYWpoAqLhPVpWptXh:4MwddEAVzz1v7OjAdhf7BlzH2co5bpWh
                                                                                                                                                                                                                                        MD5:80ADE467A9DAAA6809A5E6F2214B1879
                                                                                                                                                                                                                                        SHA1:72C4D6A3FC781D746B6C5E7B1067807C4E37DE13
                                                                                                                                                                                                                                        SHA-256:BF6595D1CF7A1ACEEC65A5EE0672FEC849118F51366D74F2CA7C63815E03DECD
                                                                                                                                                                                                                                        SHA-512:8C0D80FD1CB579B9E5EB888B2483FCBBE261475EAFC2C0F899B2D3CB7E1EC5B199CC93B0CC50EBC8DC51A7AD0C37ED62950956D8A4A8B6044D658458DDE5D432
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L......`.................f...*.......4............@.......................................@.........................................................Y....,...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\vG3D68E3KVPIYrQEMWMU27tl.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\vQkPzCCvFzBxzLEPKtUXhb4x.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\w73g23dHAf0dTWCMUXFqmd74.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2923536
                                                                                                                                                                                                                                        Entropy (8bit):7.886264645776458
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:0Zmf33Zvs2WjOhOJqPmi+oJR1GZYsN4+56ROQGnOy8T1cy9GyGXwT1IL+h0Xr:0ZA3ZhosPm0JjGZN4YnOPT1cJoT1i+hu
                                                                                                                                                                                                                                        MD5:2F32D2509D5F08A63AF9B10707987B7D
                                                                                                                                                                                                                                        SHA1:DBAF22CC4F86D19E01C5E1245B1F021E7EE599E9
                                                                                                                                                                                                                                        SHA-256:0E0CBBD7D7394C9691900C613F18169B0C78CAC9CB9248D07BE7DBE122A17A0C
                                                                                                                                                                                                                                        SHA-512:65A1C2299544E7D3A11E2237AD25B6F01647FA8EE58EE749886A5C342F2E20992095EC54AC74B7D0997E43AF7866C5480EBB1B7A8ED63476D6C0ADF63B22620D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....~........t........@.............................p......<6-... ..................................................0)......P)..;..Pgr.......+......................................@).(....................................................MPRESS1..%......:.......................MPRESS2......%......>.................. .A....%..P...L..............@....idata.......0).....................@....tls.........@)..........................rsrc....<...P)..<..................@..@.themida..G...,.....................`....boot........pt.....................`..`................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\x6geX33yrj2DQ3LHzZRqUqDy.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7462
                                                                                                                                                                                                                                        Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                                        MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                                        SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                                        SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                                        SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                                        C:\Users\user\Pictures\xFvJiGaaRqrUdwrQth3PHHC0.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):418305
                                                                                                                                                                                                                                        Entropy (8bit):6.855748637858257
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Et/Mq3iBOHmgiOSbXEX1Hj09wKU2mvAJgiBthwUo:LaRilbUX2jS2Bt2Uo
                                                                                                                                                                                                                                        MD5:D4003F52FFAB593480270DA1AB446F5D
                                                                                                                                                                                                                                        SHA1:02D80A6C2FEE9BB0201AB1DD1EAB0B4D743BD8B4
                                                                                                                                                                                                                                        SHA-256:38DEC2BB18D0275DF5FFCB31F420B02C1C7BB85D5F162CC76E4DD561415A4713
                                                                                                                                                                                                                                        SHA-512:5CE8A80563E2212B7F75D19347A173546B474812B1C5E457B6BE5F82CBB6D211A3F5E1F48AE7F30B499C3AF918A258B1164662C183A90AAE4D90EB1A22928352
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L......c......................q.....q.............@..........................0r.................................................(.....q.................................................................@...............t............................text............................... ..`.rdata..\d.......f..................@..@.data...H.k..0...*..................@....rsrc.........q.. ...B..............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\xYhK2iEXeksXlPa9BMLXm5tE.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352400
                                                                                                                                                                                                                                        Entropy (8bit):7.961480132176744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:ztf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpF:z5z5pY8UY5X4HuQF
                                                                                                                                                                                                                                        MD5:D458586C64881FC6C1CD2A71F1FAE8F1
                                                                                                                                                                                                                                        SHA1:542F86DD862A841BA85D187208B96F3B30A0DC0D
                                                                                                                                                                                                                                        SHA-256:6A64E0026CB85DD71440D54CA9828FDF4ADA19F69DB53AAE15C0A66E989E7A69
                                                                                                                                                                                                                                        SHA-512:9E9D3EF45B6E66C455F76A2ED7A3FF4CAB4C09BB8C5D6020137485F9AC5907D188F44B910FD569FF80960072E5BCE974B4A84D0325912088A2B15E1F09455583
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\zQeTuw5vxgdbKmiVRBeW6SUZ.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\Pictures\zqrjs0OTmaC5sGR5VDn5k391.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4352392
                                                                                                                                                                                                                                        Entropy (8bit):7.961471907241633
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:Ltf1tz5NXbfgGqQJWdT2WKDCS49PNkp9ciCpn:L5z5pY8UY5X4HuQn
                                                                                                                                                                                                                                        MD5:D98D4CDB706C5A3F5ADC8B109A3AB42D
                                                                                                                                                                                                                                        SHA1:207308297D81992220E3AA3289D3CC7BF4EB52CF
                                                                                                                                                                                                                                        SHA-256:323ECB5EBF6DC9BA629BD6DACF370FD68F57DA98E0500CD256479305B31F3E54
                                                                                                                                                                                                                                        SHA-512:DF28314E78309B0F60C5F2588C18A829CEB670D5B45278E5AFC8C545D86931671881AB0D3D83BD491A417FE549D17F94103DF9DB3C0D5535AD4E1CFD485C3E9D
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\<X.2oX.2oX.2o...oY.2oF.oy.2oF.oH.2oF.o0.2o.rIo[.2oX.3o3.2oF.oY.2oF.oY.2oF.oY.2oRichX.2o........PE..L...K..d............................q.............@..........................0......s.B.....................................\.A.(....................^B.................................................................t............................text............................... ..`.rdata...b@......d@.................@..@.data...H.k..0A..*....A.............@....rsrc................@A.............@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Windows\Tasks\explorha.job

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1000019001\amert.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):306
                                                                                                                                                                                                                                        Entropy (8bit):3.4538257663639045
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6:CxUDZXaXUEZ+lX1y6y2l+lRdtE9+AQy0lPmAldt0:CylaQ1y6NkDs9+nVNdt0
                                                                                                                                                                                                                                        MD5:31E770BF22D2740430E99ECECBE6E697
                                                                                                                                                                                                                                        SHA1:6384143A049BC65C7F67D597E692E53730618D50
                                                                                                                                                                                                                                        SHA-256:7683FE4856F6FD49209D9F4F63F72935BB7AE82B0DAC4E90F5B6D1AC1022AC8B
                                                                                                                                                                                                                                        SHA-512:15F2C96B15BC57EE73753E7E7918A468BFAD2D33E43941D5C7CD7BDC5DF57334131C47B6CEB55D6BCFCC937495CC303D685D3A70A5F5874B1398A91562ABB108
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:.....V&..t,E....T..F.......<... .....s.......... ....................=.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.9.f.d.8.5.1.a.4.f.\.e.x.p.l.o.r.h.a...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................!.@3P.........................

                                                                                                                                                                                                                                        C:\Windows\Tasks\explorta.job

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\fjL0EcgV6Y.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):306
                                                                                                                                                                                                                                        Entropy (8bit):3.4122996534133256
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6:hXgADZXaXUEZ+lX1dMlylRdtE9+AQy0lPmAldt0:C8laQ12oDs9+nVNdt0
                                                                                                                                                                                                                                        MD5:DEDA1C68DF2E9BE1443298FADAB195E7
                                                                                                                                                                                                                                        SHA1:DBB19BA61765853ED0331F14CFC5A167170850CB
                                                                                                                                                                                                                                        SHA-256:97D2E67F0AD5C39B2919B2AADBEB53AE08C82987689B44D6744F226CAACC59BD
                                                                                                                                                                                                                                        SHA-512:4748175D6D4A1C27CDFB49A2685A10BA1E00EEF88426AF99AA2483AD80F3623FA2BD0C231948E4E9ACFF2C0254786435A21B7B2399350A02A27EC9280AF9F3D0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:......6....C.e.Y.9..F.......<... .....s.......... ....................=.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.5.4.5.4.e.6.f.0.6.2.\.e.x.p.l.o.r.t.a...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................!.@3P.........................

                                                                                                                                                                                                                                        C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1835008
                                                                                                                                                                                                                                        Entropy (8bit):4.4692386652691525
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:gzZfpi6ceLPx9skLmb0f2ZWSP3aJG8nAgeiJRMMhA2zX4WABluuN1jDH5S:2ZHt2ZWOKnMM6bFpDj4
                                                                                                                                                                                                                                        MD5:147E3BA12B045543ECC49C0E7DC38FB6
                                                                                                                                                                                                                                        SHA1:157B187127B5985CF8C2ADA4197F1939D74977C3
                                                                                                                                                                                                                                        SHA-256:8DC9B79A4185913E7A10673378EEFB4B7852B60B10C0097167043D6480DE5EAC
                                                                                                                                                                                                                                        SHA-512:9EFABBC28BAABD3377AA0349D3BFB0352432F65916FD450E1DE4AB227839DF253118F5C11A120DBA5931E3E2A2559A235C291625E8C53C6B21A8D9B5CCE1A8C5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        Preview:regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..F...................................................................................................................................................................................................................................................................................................................................................Q.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        Chrome Cache Entry: 530

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                        Size (bytes):5430
                                                                                                                                                                                                                                        Entropy (8bit):3.6534652184263736
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
                                                                                                                                                                                                                                        MD5:F3418A443E7D841097C714D69EC4BCB8
                                                                                                                                                                                                                                        SHA1:49263695F6B0CDD72F45CF1B775E660FDC36C606
                                                                                                                                                                                                                                        SHA-256:6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
                                                                                                                                                                                                                                        SHA-512:82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        URL:https://www.google.com/favicon.ico
                                                                                                                                                                                                                                        Preview:............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

                                                                                                                                                                                                                                        Chrome Cache Entry: 531

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (574)
                                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                                        Size (bytes):3449
                                                                                                                                                                                                                                        Entropy (8bit):5.471398251148097
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:o7sAdvWR6rTrU6Vp1iof2GwXgQ47sFP1CaKgIV6VJn6ItaUjcVa8588FDFhWDs78:owAdeR6rPXVriof2GIgtA5Lym2GsL1w
                                                                                                                                                                                                                                        MD5:76A10B0A28846CA7893ABC458FFC706B
                                                                                                                                                                                                                                        SHA1:DE09F00661476A69073FE43415799B69D9ED5327
                                                                                                                                                                                                                                        SHA-256:68101B6726D3CC371A926A13D3A0C048F1C65301BF31FF3CD59A2D0005E32ED8
                                                                                                                                                                                                                                        SHA-512:C8D0973C66FA6ABC383C9FB51FF579A9D1E8C68F76BF6C492C589226BB2D0947ADD826E03D595C3237511DF5EF257FADE070533692ACC4B64978AE1DFBE52538
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.zSZ8IZ5Kl8c.es5.O/ck=boq-identity.AccountsSignInUi.wypZ6VNmXNk.L.B1.O/am=PwCL6MaxAIgR54EPUBQIGQAAAAAAAAAAtAaYGQ/d=1/exm=A7fCU,AvtSve,CMcBD,COQbmf,E87wgc,EEDORb,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KG2eXe,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,U0aPgd,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,fKUV3e,gychg,hc6Ubd,iAskyc,inNHtf,kWgXee,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,yDVVkb,yRXbo,ywOR5c,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFjiA3ekglFbYT6HLqE7binspAz7g/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
                                                                                                                                                                                                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("Wt6vjf");.var ita=function(){var a=_.$d();return _.ni(a,1)};var aq=function(a){this.Ga=_.t(a,0,aq.messageId)};_.B(aq,_.v);aq.prototype.Ja=function(){return _.Qh(this,1)};aq.prototype.Va=function(a){return _.wi(this,1,a)};aq.messageId="f.bo";var bq=function(){_.tk.call(this)};_.B(bq,_.tk);bq.prototype.fd=function(){this.aP=!1;jta(this);_.tk.prototype.fd.call(this)};bq.prototype.aa=function(){kta(this);if(this.Zz)return lta(this),!1;if(!this.VQ)return cq(this),!0;this.dispatchEvent("p");if(!this.vK)return cq(this),!0;this.sI?(this.dispatchEvent("r"),cq(this)):lta(this);return!1};.var mta=function(a){var b=new _.pn(a.f0);null!=a.xL&&b.aa("authuser",a.xL);return b},lta=function(a){a.Zz=!0;var b=mta(a),c="rt=r&f_uid="+_.Ig(a.vK);_.Xk(b,(0,_.kf)(a.ea,a),"POST",c)};.bq.prototype.ea=function(a){a=a.target;kta(this);if(_.$k(a)){this.qG=0;if(this.sI)this.Zz=!1,this.dispatchEvent("

                                                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Entropy (8bit):7.951520514641467
                                                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                        File name:fjL0EcgV6Y.exe
                                                                                                                                                                                                                                        File size:1'804'304 bytes
                                                                                                                                                                                                                                        MD5:6bcab686349807f131a92c8fe7a4d736
                                                                                                                                                                                                                                        SHA1:487846c6d51f8df894bb174542a81fd0eb25e1ae
                                                                                                                                                                                                                                        SHA256:ccabd5bc8499c485e7abab1825f67a753a8ccfc822037f2368e3c6fa5f570926
                                                                                                                                                                                                                                        SHA512:94e16b6336a1205cf624f8fcdbb2e32a2e85be93a483d87369e3cd85b12a31f31a908c730709f40a91d0ae6a173554c66229bb44d4ac2295c29073741ce9014a
                                                                                                                                                                                                                                        SSDEEP:49152:haJmLsU7YRCWfNHICNUMjSd2HZmSTI3G/kPdLmas2:haJksZyCiMnk2cVq4
                                                                                                                                                                                                                                        TLSH:0D8533615E71BBAAD514DEBF28A040CA901C8FB4466720C9DB8FF5AFC0D980ED36A535
                                                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L..

                                                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                                                        Icon Hash:00928e8e8686b000

                                                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Entrypoint:0x7c6058
                                                                                                                                                                                                                                        Entrypoint Section:.boot
                                                                                                                                                                                                                                        Digitally signed:false
                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                                                        DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                        Time Stamp:0x66264F79 [Mon Apr 22 11:52:25 2024 UTC]
                                                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                                                        OS Version Major:6
                                                                                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                                                                                        File Version Major:6
                                                                                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                                                                                        Subsystem Version Major:6
                                                                                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                                                                                        Import Hash:9dfe5757453ac4b6ed82bf0cf7ab0266

                                                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                                                        call 00007FCC1D481CB0h
                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                        mov ebx, esp
                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                        mov esi, dword ptr [ebx+08h]
                                                                                                                                                                                                                                        mov edi, dword ptr [ebx+10h]
                                                                                                                                                                                                                                        cld
                                                                                                                                                                                                                                        mov dl, 80h
                                                                                                                                                                                                                                        mov al, byte ptr [esi]
                                                                                                                                                                                                                                        inc esi
                                                                                                                                                                                                                                        mov byte ptr [edi], al
                                                                                                                                                                                                                                        inc edi
                                                                                                                                                                                                                                        mov ebx, 00000002h
                                                                                                                                                                                                                                        add dl, dl
                                                                                                                                                                                                                                        jne 00007FCC1D481B67h
                                                                                                                                                                                                                                        mov dl, byte ptr [esi]
                                                                                                                                                                                                                                        inc esi
                                                                                                                                                                                                                                        adc dl, dl
                                                                                                                                                                                                                                        jnc 00007FCC1D481B4Ch
                                                                                                                                                                                                                                        add dl, dl
                                                                                                                                                                                                                                        jne 00007FCC1D481B67h
                                                                                                                                                                                                                                        mov dl, byte ptr [esi]
                                                                                                                                                                                                                                        inc esi
                                                                                                                                                                                                                                        adc dl, dl
                                                                                                                                                                                                                                        jnc 00007FCC1D481BB3h
                                                                                                                                                                                                                                        xor eax, eax
                                                                                                                                                                                                                                        add dl, dl
                                                                                                                                                                                                                                        jne 00007FCC1D481B67h
                                                                                                                                                                                                                                        mov dl, byte ptr [esi]
                                                                                                                                                                                                                                        inc esi
                                                                                                                                                                                                                                        adc dl, dl
                                                                                                                                                                                                                                        jnc 00007FCC1D481C47h
                                                                                                                                                                                                                                        add dl, dl
                                                                                                                                                                                                                                        jne 00007FCC1D481B67h
                                                                                                                                                                                                                                        mov dl, byte ptr [esi]
                                                                                                                                                                                                                                        inc esi
                                                                                                                                                                                                                                        adc dl, dl
                                                                                                                                                                                                                                        adc eax, eax
                                                                                                                                                                                                                                        add dl, dl
                                                                                                                                                                                                                                        jne 00007FCC1D481B67h
                                                                                                                                                                                                                                        mov dl, byte ptr [esi]
                                                                                                                                                                                                                                        inc esi
                                                                                                                                                                                                                                        adc dl, dl
                                                                                                                                                                                                                                        adc eax, eax
                                                                                                                                                                                                                                        add dl, dl
                                                                                                                                                                                                                                        jne 00007FCC1D481B67h
                                                                                                                                                                                                                                        mov dl, byte ptr [esi]
                                                                                                                                                                                                                                        inc esi
                                                                                                                                                                                                                                        adc dl, dl
                                                                                                                                                                                                                                        adc eax, eax
                                                                                                                                                                                                                                        add dl, dl
                                                                                                                                                                                                                                        jne 00007FCC1D481B67h
                                                                                                                                                                                                                                        mov dl, byte ptr [esi]
                                                                                                                                                                                                                                        inc esi
                                                                                                                                                                                                                                        adc dl, dl
                                                                                                                                                                                                                                        adc eax, eax
                                                                                                                                                                                                                                        je 00007FCC1D481B6Ah
                                                                                                                                                                                                                                        push edi
                                                                                                                                                                                                                                        mov eax, eax
                                                                                                                                                                                                                                        sub edi, eax
                                                                                                                                                                                                                                        mov al, byte ptr [edi]
                                                                                                                                                                                                                                        pop edi
                                                                                                                                                                                                                                        mov byte ptr [edi], al
                                                                                                                                                                                                                                        inc edi
                                                                                                                                                                                                                                        mov ebx, 00000002h
                                                                                                                                                                                                                                        jmp 00007FCC1D481AFBh
                                                                                                                                                                                                                                        mov eax, 00000001h
                                                                                                                                                                                                                                        add dl, dl
                                                                                                                                                                                                                                        jne 00007FCC1D481B67h
                                                                                                                                                                                                                                        mov dl, byte ptr [esi]
                                                                                                                                                                                                                                        inc esi
                                                                                                                                                                                                                                        adc dl, dl
                                                                                                                                                                                                                                        adc eax, eax
                                                                                                                                                                                                                                        add dl, dl
                                                                                                                                                                                                                                        jne 00007FCC1D481B67h
                                                                                                                                                                                                                                        mov dl, byte ptr [esi]
                                                                                                                                                                                                                                        inc esi
                                                                                                                                                                                                                                        adc dl, dl
                                                                                                                                                                                                                                        jc 00007FCC1D481B4Ch
                                                                                                                                                                                                                                        sub eax, ebx
                                                                                                                                                                                                                                        mov ebx, 00000001h
                                                                                                                                                                                                                                        jne 00007FCC1D481B8Ah
                                                                                                                                                                                                                                        mov ecx, 00000001h
                                                                                                                                                                                                                                        add dl, dl
                                                                                                                                                                                                                                        jne 00007FCC1D481B67h
                                                                                                                                                                                                                                        mov dl, byte ptr [esi]
                                                                                                                                                                                                                                        inc esi
                                                                                                                                                                                                                                        adc dl, dl
                                                                                                                                                                                                                                        adc ecx, ecx
                                                                                                                                                                                                                                        add dl, dl
                                                                                                                                                                                                                                        jne 00007FCC1D481B67h
                                                                                                                                                                                                                                        mov dl, byte ptr [esi]
                                                                                                                                                                                                                                        inc esi
                                                                                                                                                                                                                                        adc dl, dl
                                                                                                                                                                                                                                        jc 00007FCC1D481B4Ch
                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                        mov esi, edi
                                                                                                                                                                                                                                        sub esi, ebp

                                                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x7109f0xc0.idata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x730000x7e0.rsrc
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x54e0000x10.reloc
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x720180x18.tls
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                        Sections

                                                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                        0x10000x4e44a0x22c00b3741ec845f2c87aa9673079ff6ba253False0.9998032823741008data7.9986498410293665IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        0x500000x11c4e0x5600ef3ed846f14fdf6a20a6e8d9430f498aFalse0.9933230377906976data7.975372423268159IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        0x620000x45a40x8007700f99aa08eca59d048d55f978471ceFalse1.00537109375data7.831755034911041IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                        0x670000x1e00x20007779f19ea5a8ab384d22679e5783d69False0.888671875data6.61378974665399IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        0x680000x4bc40x30005fb915269ca9d01be37f8657a0a9104fFalse0.9834798177083334data7.942878619830215IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .vm_sec0x6d0000x40000x400068180fe73d5900cc170f3a2cc49bb05cFalse0.16583251953125data2.9434603833210717IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                        .idata0x710000x10000x200f9eef23d1138690aeba265ff5448dfcaFalse0.3828125data2.863715215086496IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                        .tls0x720000x10000x200f6363c53ce07d09b61b63b66eb8cf6baFalse0.056640625data0.18120187678200297IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                        .rsrc0x730000x10000x80087acbb71b21ab4ae100181a4447d8be5False0.4111328125data5.44897069280421IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .themida0x740000x3520000x0d41d8cd98f00b204e9800998ecf8427eunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                        .boot0x3c60000x187c000x187c0059e91b6cbd6c7d6dd68460432e7d05e5False0.9909273791480536OpenPGP Secret Key7.956255917420769IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .reloc0x54e0000x10000x10e9e9559f85469b458c40ee7aae3a2776False1.5GLS_BINARY_LSB_FIRST2.349601752714581IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                        Resources

                                                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                        RT_MANIFEST0x730780x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727
                                                                                                                                                                                                                                        RT_MANIFEST0x732080x5d7XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.43478260869565216

                                                                                                                                                                                                                                        Imports

                                                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                                                        kernel32.dllGetModuleHandleA
                                                                                                                                                                                                                                        ADVAPI32.dllRegCloseKey
                                                                                                                                                                                                                                        SHELL32.dllSHGetFolderPathA
                                                                                                                                                                                                                                        ole32.dllCoUninitialize
                                                                                                                                                                                                                                        WININET.dllHttpOpenRequestA
                                                                                                                                                                                                                                        WS2_32.dllclosesocket

                                                                                                                                                                                                                                        Possible Origin

                                                                                                                                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                        EnglishUnited States

                                                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                                                        ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                                                        Start time:20:32:26
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\fjL0EcgV6Y.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\fjL0EcgV6Y.exe"
                                                                                                                                                                                                                                        Imagebase:0xdb0000
                                                                                                                                                                                                                                        File size:1'804'304 bytes
                                                                                                                                                                                                                                        MD5 hash:6BCAB686349807F131A92C8FE7A4D736
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2083851627.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2064758030.0000000003380000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:2
                                                                                                                                                                                                                                        Start time:20:32:28
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"
                                                                                                                                                                                                                                        Imagebase:0xfd0000
                                                                                                                                                                                                                                        File size:1'804'304 bytes
                                                                                                                                                                                                                                        MD5 hash:6BCAB686349807F131A92C8FE7A4D736
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2084843739.0000000001DC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:3
                                                                                                                                                                                                                                        Start time:20:32:28
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        Imagebase:0xfd0000
                                                                                                                                                                                                                                        File size:1'804'304 bytes
                                                                                                                                                                                                                                        MD5 hash:6BCAB686349807F131A92C8FE7A4D736
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2102606370.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2091875914.00000000015E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:5
                                                                                                                                                                                                                                        Start time:20:32:32
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"
                                                                                                                                                                                                                                        Imagebase:
                                                                                                                                                                                                                                        File size:1'804'304 bytes
                                                                                                                                                                                                                                        MD5 hash:6BCAB686349807F131A92C8FE7A4D736
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:6
                                                                                                                                                                                                                                        Start time:20:32:36
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1000019001\amert.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1000019001\amert.exe"
                                                                                                                                                                                                                                        Imagebase:0xe30000
                                                                                                                                                                                                                                        File size:1'907'200 bytes
                                                                                                                                                                                                                                        MD5 hash:F94CAD2EA8087F7452D99C57BF5C935E
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2239011126.0000000000E31000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2177043340.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:7
                                                                                                                                                                                                                                        Start time:20:32:39
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe"
                                                                                                                                                                                                                                        Imagebase:0x160000
                                                                                                                                                                                                                                        File size:2'204'176 bytes
                                                                                                                                                                                                                                        MD5 hash:9B38B95FC36FD9B330018EC18E7DEB9D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.3093234156.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.3093234156.00000000010C3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000002.3094761202.0000000005890000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:8
                                                                                                                                                                                                                                        Start time:20:32:39
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        Imagebase:0xd0000
                                                                                                                                                                                                                                        File size:1'907'200 bytes
                                                                                                                                                                                                                                        MD5 hash:F94CAD2EA8087F7452D99C57BF5C935E
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000002.4574731193.00000000000D1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000003.2238783489.00000000048E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:9
                                                                                                                                                                                                                                        Start time:20:32:39
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"
                                                                                                                                                                                                                                        Imagebase:0xd0000
                                                                                                                                                                                                                                        File size:1'907'200 bytes
                                                                                                                                                                                                                                        MD5 hash:F94CAD2EA8087F7452D99C57BF5C935E
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.2245209175.0000000004860000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2285975252.00000000000D1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:11
                                                                                                                                                                                                                                        Start time:20:32:43
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\1000021002\2c9ff67496.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\1000021002\2c9ff67496.exe"
                                                                                                                                                                                                                                        Imagebase:0x710000
                                                                                                                                                                                                                                        File size:1'166'336 bytes
                                                                                                                                                                                                                                        MD5 hash:A45EC26929E9563254198D2B394D4D17
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                                        • Detection: 100%, Avira
                                                                                                                                                                                                                                        • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:12
                                                                                                                                                                                                                                        Start time:20:32:44
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                                                                                        Imagebase:0x610000
                                                                                                                                                                                                                                        File size:187'904 bytes
                                                                                                                                                                                                                                        MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:13
                                                                                                                                                                                                                                        Start time:20:32:44
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:14
                                                                                                                                                                                                                                        Start time:20:32:44
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
                                                                                                                                                                                                                                        Imagebase:0x7ff684c40000
                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                        MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:15
                                                                                                                                                                                                                                        Start time:20:32:44
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                                                                                        Imagebase:0x610000
                                                                                                                                                                                                                                        File size:187'904 bytes
                                                                                                                                                                                                                                        MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:16
                                                                                                                                                                                                                                        Start time:20:32:44
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:18
                                                                                                                                                                                                                                        Start time:20:32:45
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 --field-trial-handle=2032,i,3277131894660533735,10710382389248485071,262144 /prefetch:8
                                                                                                                                                                                                                                        Imagebase:0x7ff684c40000
                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                        MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:19
                                                                                                                                                                                                                                        Start time:20:32:45
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        Imagebase:0x5e0000
                                                                                                                                                                                                                                        File size:2'204'176 bytes
                                                                                                                                                                                                                                        MD5 hash:9B38B95FC36FD9B330018EC18E7DEB9D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000013.00000002.2957184812.0000000005BC0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                                        • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                        • Detection: 47%, ReversingLabs
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:20
                                                                                                                                                                                                                                        Start time:20:32:46
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                        Imagebase:0x5e0000
                                                                                                                                                                                                                                        File size:2'204'176 bytes
                                                                                                                                                                                                                                        MD5 hash:9B38B95FC36FD9B330018EC18E7DEB9D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000014.00000002.3127044186.0000000005C00000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:21
                                                                                                                                                                                                                                        Start time:20:32:49
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                                                                                                                                                        Imagebase:0x80000
                                                                                                                                                                                                                                        File size:61'440 bytes
                                                                                                                                                                                                                                        MD5 hash:889B99C52A60DD49227C5E485A016679
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:22
                                                                                                                                                                                                                                        Start time:20:32:49
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe"
                                                                                                                                                                                                                                        Imagebase:0xd00000
                                                                                                                                                                                                                                        File size:329'352 bytes
                                                                                                                                                                                                                                        MD5 hash:1C7D0F34BB1D85B5D2C01367CC8F62EF
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:moderate
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:23
                                                                                                                                                                                                                                        Start time:20:32:49
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                                                                                                                                                        Imagebase:0x7ff7512a0000
                                                                                                                                                                                                                                        File size:71'680 bytes
                                                                                                                                                                                                                                        MD5 hash:EF3179D498793BF4234F708D3BE28633
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.4581588871.00007FFD84FAD000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:24
                                                                                                                                                                                                                                        Start time:20:32:49
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:25
                                                                                                                                                                                                                                        Start time:20:32:49
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                        Imagebase:0xd20000
                                                                                                                                                                                                                                        File size:65'440 bytes
                                                                                                                                                                                                                                        MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000019.00000002.2402948638.000000000141B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:27
                                                                                                                                                                                                                                        Start time:20:32:49
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:netsh wlan show profiles
                                                                                                                                                                                                                                        Imagebase:0x7ff7975b0000
                                                                                                                                                                                                                                        File size:96'768 bytes
                                                                                                                                                                                                                                        MD5 hash:6F1E6DD688818BC3D1391D0CC7D597EB
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:28
                                                                                                                                                                                                                                        Start time:20:32:49
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:30
                                                                                                                                                                                                                                        Start time:20:32:50
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7680 -s 872
                                                                                                                                                                                                                                        Imagebase:0x5f0000
                                                                                                                                                                                                                                        File size:483'680 bytes
                                                                                                                                                                                                                                        MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:31
                                                                                                                                                                                                                                        Start time:20:32:50
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                                                                                                                                                                                                                        Imagebase:0x80000
                                                                                                                                                                                                                                        File size:61'440 bytes
                                                                                                                                                                                                                                        MD5 hash:889B99C52A60DD49227C5E485A016679
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000002.4578583730.000000006BE61000.00000020.00000001.01000000.00000014.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:32
                                                                                                                                                                                                                                        Start time:20:32:51
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1000071001\jok.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1000071001\jok.exe"
                                                                                                                                                                                                                                        Imagebase:0x490000
                                                                                                                                                                                                                                        File size:311'296 bytes
                                                                                                                                                                                                                                        MD5 hash:8510BCF5BC264C70180ABE78298E4D5B
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000020.00000000.2311996086.0000000000492000.00000002.00000001.01000000.00000015.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000020.00000002.4626441113.00000000028B7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe, Author: Joe Security
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:33
                                                                                                                                                                                                                                        Start time:20:32:51
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1000020001\aea7caadbf.exe"
                                                                                                                                                                                                                                        Imagebase:0x160000
                                                                                                                                                                                                                                        File size:2'204'176 bytes
                                                                                                                                                                                                                                        MD5 hash:9B38B95FC36FD9B330018EC18E7DEB9D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000021.00000002.3118907177.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000021.00000002.3118681563.0000000005C30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:34
                                                                                                                                                                                                                                        Start time:20:32:51
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
                                                                                                                                                                                                                                        Imagebase:0x7ff6e3d50000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:35
                                                                                                                                                                                                                                        Start time:20:32:51
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:38
                                                                                                                                                                                                                                        Start time:20:32:53
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1000073001\swiy.exe"
                                                                                                                                                                                                                                        Imagebase:0xbc0000
                                                                                                                                                                                                                                        File size:162'304 bytes
                                                                                                                                                                                                                                        MD5 hash:317465164F61FE462864A65B732CCC13
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000026.00000002.2353073715.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000026.00000002.2353073715.0000000003F65000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:39
                                                                                                                                                                                                                                        Start time:20:32:53
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:40
                                                                                                                                                                                                                                        Start time:20:32:53
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                        Imagebase:0x90000
                                                                                                                                                                                                                                        File size:65'440 bytes
                                                                                                                                                                                                                                        MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:41
                                                                                                                                                                                                                                        Start time:20:32:53
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                        Imagebase:0xf10000
                                                                                                                                                                                                                                        File size:65'440 bytes
                                                                                                                                                                                                                                        MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000029.00000002.3096645849.000000000162A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000002.3096645849.000000000166E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000029.00000002.3009103992.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000029.00000002.3009103992.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:42
                                                                                                                                                                                                                                        Start time:20:32:55
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 --field-trial-handle=2032,i,3277131894660533735,10710382389248485071,262144 /prefetch:8
                                                                                                                                                                                                                                        Imagebase:0x7ff684c40000
                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                        MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:43
                                                                                                                                                                                                                                        Start time:20:32:56
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe"
                                                                                                                                                                                                                                        Imagebase:0x246c0a50000
                                                                                                                                                                                                                                        File size:534'152 bytes
                                                                                                                                                                                                                                        MD5 hash:C1D583657C7FE7973F820983FD1ABB81
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002B.00000002.3082608256.00000246C2631000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:44
                                                                                                                                                                                                                                        Start time:20:33:00
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
                                                                                                                                                                                                                                        Imagebase:0xfd0000
                                                                                                                                                                                                                                        File size:1'804'304 bytes
                                                                                                                                                                                                                                        MD5 hash:6BCAB686349807F131A92C8FE7A4D736
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002C.00000002.2426954025.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002C.00000003.2407964114.0000000001810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:45
                                                                                                                                                                                                                                        Start time:20:33:00
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1000079001\gold.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1000079001\gold.exe"
                                                                                                                                                                                                                                        Imagebase:0x640000
                                                                                                                                                                                                                                        File size:578'048 bytes
                                                                                                                                                                                                                                        MD5 hash:F15A9CFA3726845017A7F91ABE0A14F7
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:46
                                                                                                                                                                                                                                        Start time:20:33:00
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force
                                                                                                                                                                                                                                        Imagebase:0x7ff6e3d50000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:47
                                                                                                                                                                                                                                        Start time:20:33:00
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                        Imagebase:0xed0000
                                                                                                                                                                                                                                        File size:65'440 bytes
                                                                                                                                                                                                                                        MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:48
                                                                                                                                                                                                                                        Start time:20:33:00
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                                                                                                                                                                                                                                        Imagebase:0x600000
                                                                                                                                                                                                                                        File size:2'204'176 bytes
                                                                                                                                                                                                                                        MD5 hash:9B38B95FC36FD9B330018EC18E7DEB9D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000030.00000002.3134429233.0000000005A06000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000030.00000002.3134429233.00000000059F4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000030.00000002.3139553145.000000000654A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:49
                                                                                                                                                                                                                                        Start time:20:33:00
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:50
                                                                                                                                                                                                                                        Start time:20:33:01
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):
                                                                                                                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                                                                                                                                                                                                                        Imagebase:
                                                                                                                                                                                                                                        File size:108'664 bytes
                                                                                                                                                                                                                                        MD5 hash:914F728C04D3EDDD5FBA59420E74E56B
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:51
                                                                                                                                                                                                                                        Start time:20:33:01
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                                                                                                                                                                                                                        Imagebase:0x980000
                                                                                                                                                                                                                                        File size:42'064 bytes
                                                                                                                                                                                                                                        MD5 hash:5D4073B2EB6D217C19F2B22F21BF8D57
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:52
                                                                                                                                                                                                                                        Start time:20:33:01
                                                                                                                                                                                                                                        Start date:07/05/2024
                                                                                                                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):
                                                                                                                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                                                                                                                                                                                                                        Imagebase:
                                                                                                                                                                                                                                        File size:42'064 bytes
                                                                                                                                                                                                                                        MD5 hash:5D4073B2EB6D217C19F2B22F21BF8D57
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                                                        Reset < >

                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                          Execution Coverage:11.3%
                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                                                                                          Signature Coverage:1.4%
                                                                                                                                                                                                                                          Total number of Nodes:1045
                                                                                                                                                                                                                                          Total number of Limit Nodes:21
                                                                                                                                                                                                                                          execution_graph 13474 fe8bc0 13475 fe8bd5 13474->13475 13481 fe8c13 13474->13481 13482 fec8f6 RtlEnterCriticalSection 13475->13482 13477 fe8bdf 13477->13481 13487 fece33 13477->13487 13486 fec90a 13482->13486 13483 fec90f RtlLeaveCriticalSection 13483->13477 13486->13483 13495 fec97e 13486->13495 13500 fece06 13487->13500 13490 fec8ac RtlEnterCriticalSection RtlLeaveCriticalSection 13491 fec948 13490->13491 13492 fec964 SetEvent ResetEvent 13491->13492 13493 fec953 RtlWakeAllConditionVariable 13491->13493 13492->13481 13493->13481 13496 fec98c SleepConditionVariableCS 13495->13496 13497 fec9a5 RtlLeaveCriticalSection WaitForSingleObjectEx RtlEnterCriticalSection 13495->13497 13498 fec9c9 13496->13498 13497->13498 13498->13486 13501 fece1c 13500->13501 13502 fece15 13500->13502 13509 100906b 13501->13509 13506 1008fff 13502->13506 13505 fe8c09 13505->13490 13507 100906b 18 API calls 13506->13507 13508 1009011 13507->13508 13508->13505 13512 1008da1 13509->13512 13513 1008dad __cftof 13512->13513 13520 100853b RtlEnterCriticalSection 13513->13520 13515 1008dbb 13521 1008dfc 13515->13521 13517 1008dc8 13531 1008df0 13517->13531 13520->13515 13522 1008e18 13521->13522 13524 1008e8f __cftof 13521->13524 13523 1008e6f 13522->13523 13522->13524 13534 100e567 13522->13534 13523->13524 13526 100e567 18 API calls 13523->13526 13524->13517 13528 1008e85 13526->13528 13527 1008e65 13529 100a565 _free 2 API calls 13527->13529 13530 100a565 _free 2 API calls 13528->13530 13529->13523 13530->13524 13555 1008583 RtlLeaveCriticalSection 13531->13555 13533 1008dd9 13533->13505 13535 100e574 13534->13535 13538 100e59e 13535->13538 13539 100e580 __cftof _free 13535->13539 13540 101475c 13535->13540 13545 101478f 13538->13545 13539->13527 13541 101477c RtlSizeHeap 13540->13541 13542 1014767 _free 13540->13542 13541->13538 13543 100643a __cftof 11 API calls 13542->13543 13544 1014777 13543->13544 13544->13538 13546 10147a7 13545->13546 13547 101479c 13545->13547 13549 10147af 13546->13549 13553 10147b8 __cftof 13546->13553 13548 100a7bb __cftof 3 API calls 13547->13548 13552 10147a4 _free 13548->13552 13550 100a565 _free 2 API calls 13549->13550 13550->13552 13551 10147e2 RtlReAllocateHeap 13551->13552 13551->13553 13552->13539 13553->13551 13553->13552 13554 10085a9 __cftof 2 API calls 13553->13554 13554->13553 13555->13533 13578 fe7fb0 13579 fecbc7 18 API calls 13578->13579 13580 fe800a __cftof 13579->13580 13591 fe9390 13580->13591 13583 fe80ac 13597 fd42f0 13583->13597 13586 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 13589 fe80a8 13586->13589 13588 fe804c 13588->13586 13590 fe80bf 13592 fe93c5 13591->13592 13608 fd2be0 13592->13608 13594 fe93f6 13620 fe9750 13594->13620 13596 fe8034 13596->13583 13596->13588 13598 feb6bf 3 API calls 13597->13598 13599 fd430a 13598->13599 13600 fd4311 13599->13600 13601 100649b 62 API calls 13599->13601 13603 feb630 13600->13603 13602 fd4324 13601->13602 13875 feb56b 13603->13875 13606 10032e1 std::_Xinvalid_argument RaiseException 13607 feb654 std::_Throw_future_error 13606->13607 13607->13590 13609 fd2c1d 13608->13609 13610 feb6bf 3 API calls 13609->13610 13611 fd2c46 13610->13611 13612 fd2c51 13611->13612 13613 fd2c77 13611->13613 13614 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 13612->13614 13615 fd2c88 13613->13615 13641 feb6d7 13613->13641 13616 fd2c73 13614->13616 13654 fd2340 13615->13654 13616->13594 13700 fd3740 13620->13700 13622 fe97cf 13623 fe97fc shared_ptr 13622->13623 13625 fe9838 13622->13625 13710 fe99f0 13623->13710 13628 100644a 11 API calls 13625->13628 13626 fe981b 13726 fd4200 13626->13726 13635 fe983d 13628->13635 13629 fe9823 13629->13596 13630 fe9991 13631 fe8a50 17 API calls 13630->13631 13632 fe98c4 13631->13632 13634 100644a 11 API calls 13632->13634 13640 fe994c shared_ptr 13632->13640 13633 fe998c 13636 fd2380 17 API calls 13633->13636 13639 fe999b shared_ptr 13634->13639 13635->13630 13635->13633 13637 fe98be 13635->13637 13636->13630 13638 fecbc7 18 API calls 13637->13638 13638->13632 13639->13596 13640->13596 13642 feb87d 13641->13642 13643 feb6e3 GetLastError 13642->13643 13644 feb6f5 13643->13644 13657 fd2800 13644->13657 13646 feb703 13647 10032e1 std::_Xinvalid_argument RaiseException 13646->13647 13648 feb711 13647->13648 13649 feb74a 13648->13649 13650 feb753 13648->13650 13667 feb65f 13649->13667 13652 fd29e0 65 API calls 13650->13652 13653 feb74f 13652->13653 13653->13615 13689 feadb6 13654->13689 13658 fe78a0 18 API calls 13657->13658 13659 fd284f 13658->13659 13660 fd25b0 20 API calls 13659->13660 13662 fd2867 13660->13662 13661 fd288d shared_ptr 13661->13646 13662->13661 13663 100644a 11 API calls 13662->13663 13664 fd28b6 13663->13664 13665 100308c ___std_exception_copy 16 API calls 13664->13665 13666 fd28e4 13665->13666 13666->13646 13668 fec411 3 API calls 13667->13668 13669 feb677 13668->13669 13670 feb67e 13669->13670 13673 100649b 13669->13673 13670->13653 13672 feb687 13672->13653 13680 10064a7 __cftof 13673->13680 13674 100835f __cftof 31 API calls 13675 10064d6 13674->13675 13676 10064f3 13675->13676 13677 10064e5 13675->13677 13679 100616d 41 API calls 13676->13679 13678 1006549 61 API calls 13677->13678 13681 10064ef 13678->13681 13682 100650d 13679->13682 13680->13674 13681->13672 13683 10060cd 7 API calls 13682->13683 13684 100651a 13683->13684 13685 1006521 13684->13685 13686 1006549 61 API calls 13684->13686 13687 1006543 13685->13687 13688 100a565 _free 2 API calls 13685->13688 13686->13685 13687->13672 13688->13687 13690 feadd1 13689->13690 13696 feade7 13689->13696 13693 10032e1 std::_Xinvalid_argument RaiseException 13690->13693 13691 feae58 RaiseException 13692 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 13691->13692 13694 fd2372 13692->13694 13693->13696 13695 feae7a 13697 100835f __cftof 31 API calls 13695->13697 13696->13691 13696->13695 13699 feae38 __cftof 13696->13699 13698 feae7f 13697->13698 13699->13691 13701 fd37f6 13700->13701 13706 fd375f 13700->13706 13701->13622 13702 fd3820 13703 fe89c0 17 API calls 13702->13703 13704 fd3825 13703->13704 13704->13622 13706->13701 13706->13702 13707 fd381b 13706->13707 13708 fd37cd shared_ptr 13706->13708 13709 100644a 11 API calls 13707->13709 13731 fe7530 13708->13731 13709->13702 13711 fe9a70 13710->13711 13746 fe6950 13711->13746 13714 fd3740 18 API calls 13717 fe9b7e shared_ptr 13714->13717 13715 fe7530 18 API calls 13716 fe9b10 13715->13716 13716->13714 13718 fe9c12 shared_ptr 13717->13718 13719 fe9c9e 13717->13719 13720 fecbc7 18 API calls 13718->13720 13721 100644a 11 API calls 13719->13721 13723 fe9c3e 13720->13723 13722 fe9ca3 shared_ptr 13721->13722 13722->13626 13756 fd3de0 13723->13756 13725 fe9c86 13725->13626 13727 fd422e 13726->13727 13728 fd4259 shared_ptr 13726->13728 13727->13728 13729 100644a 11 API calls 13727->13729 13728->13629 13730 fd42eb 13729->13730 13732 fe75ab 13731->13732 13733 fe7542 13731->13733 13734 fd2380 17 API calls 13732->13734 13735 fe757c 13733->13735 13736 fe754d 13733->13736 13738 fe755a 13734->13738 13737 fe7599 13735->13737 13740 fecbc7 18 API calls 13735->13740 13736->13732 13739 fe7554 13736->13739 13737->13701 13741 100644a 11 API calls 13738->13741 13745 fe7563 13738->13745 13742 fecbc7 18 API calls 13739->13742 13743 fe7586 13740->13743 13744 fe75b5 13741->13744 13742->13738 13743->13701 13745->13701 13747 fe6991 13746->13747 13748 fecbc7 18 API calls 13747->13748 13749 fe69b8 13748->13749 13750 fe6bc6 13749->13750 13753 fecbc7 18 API calls 13749->13753 13751 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 13750->13751 13752 fe6c2c 13751->13752 13752->13715 13752->13716 13754 fe6b3b __cftof __Mtx_init_in_situ 13753->13754 13762 fd2dc0 13754->13762 13757 fd3e48 13756->13757 13758 fd3e1e 13756->13758 13760 fd3e58 13757->13760 13819 fd2b00 13757->13819 13758->13725 13760->13725 13763 fd2e7e GetCurrentThreadId 13762->13763 13764 fd2e06 13762->13764 13766 fd2eef 13763->13766 13768 fd2e94 13763->13768 13765 febe8c 13 API calls 13764->13765 13767 fd2e12 13765->13767 13766->13750 13769 fd2e1d 13767->13769 13770 fd2f1e 13767->13770 13768->13766 13773 febe8c 13 API calls 13768->13773 13774 fecbc7 18 API calls 13769->13774 13775 fd2e30 __Mtx_unlock 13769->13775 13771 feba4a 69 API calls 13770->13771 13772 fd2f24 13771->13772 13776 feba4a 69 API calls 13772->13776 13777 fd2eb9 13773->13777 13774->13775 13775->13772 13778 fd2e6f 13775->13778 13776->13777 13779 feba4a 69 API calls 13777->13779 13780 fd2ec0 __Mtx_unlock 13777->13780 13778->13763 13778->13766 13779->13780 13781 feba4a 69 API calls 13780->13781 13782 fd2ed8 __Cnd_broadcast 13780->13782 13781->13782 13782->13766 13783 feba4a 69 API calls 13782->13783 13784 fd2f3c 13783->13784 13785 febe8c 13 API calls 13784->13785 13795 fd2f80 shared_ptr __Mtx_unlock 13785->13795 13786 fd30c5 13787 feba4a 69 API calls 13786->13787 13788 fd30cb 13787->13788 13789 feba4a 69 API calls 13788->13789 13790 fd30d1 13789->13790 13791 feba4a 69 API calls 13790->13791 13792 fd30d7 13791->13792 13794 feba4a 69 API calls 13792->13794 13793 fd30a7 13796 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 13793->13796 13799 fd30dd 13794->13799 13795->13786 13795->13788 13795->13793 13797 fd3032 GetCurrentThreadId 13795->13797 13798 fd30bf 13796->13798 13797->13793 13800 fd303b 13797->13800 13798->13750 13800->13793 13801 febe8c 13 API calls 13800->13801 13803 fd305f 13801->13803 13802 fd3093 __Mtx_unlock 13802->13792 13802->13793 13803->13786 13803->13790 13803->13802 13805 feb52c 13803->13805 13808 feb352 13805->13808 13809 feb37c 13808->13809 13810 fec74b _xtime_get 2 API calls 13809->13810 13817 feb384 __Xtime_diff_to_millis2 13809->13817 13814 feb3af __Xtime_diff_to_millis2 13810->13814 13812 feb408 13813 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 13812->13813 13815 feb418 13813->13815 13816 fec74b _xtime_get 2 API calls 13814->13816 13814->13817 13815->13803 13816->13817 13818 febe9d GetCurrentThreadId 13817->13818 13818->13812 13820 fecbc7 18 API calls 13819->13820 13821 fd2b0e 13820->13821 13831 feb027 13821->13831 13824 fd2b49 13824->13725 13826 fd2b58 13849 fd2460 13826->13849 13829 10032e1 std::_Xinvalid_argument RaiseException 13830 fd2b73 13829->13830 13832 feb05e 13831->13832 13833 feb034 13831->13833 13863 feaf66 GetModuleHandleExW 13832->13863 13854 fec357 13833->13854 13837 feb044 13839 feb04d 13837->13839 13840 feb056 GetLastError 13837->13840 13838 feb076 QueueUserWorkItem 13842 feb08a GetLastError 13838->13842 13843 fd2b42 13838->13843 13856 feaffe 13839->13856 13840->13832 13842->13843 13843->13824 13846 fd2b80 13843->13846 13845 feb074 13845->13838 13869 feafdb 13846->13869 13848 fd2bb2 shared_ptr 13848->13826 13850 100308c ___std_exception_copy 16 API calls 13849->13850 13851 fd2497 13850->13851 13852 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 13851->13852 13853 fd24ad 13852->13853 13853->13829 13855 fec372 CreateThreadpoolWork 13854->13855 13855->13837 13857 feaf66 Concurrency::details::_Reschedule_chore GetModuleHandleExW 13856->13857 13858 feb007 13857->13858 13859 feb018 13858->13859 13866 feaedb GetModuleHandleExW 13858->13866 13867 fec5ac 13859->13867 13862 feb021 13862->13843 13864 feaf7c 13863->13864 13864->13838 13865 feaedb GetModuleHandleExW 13864->13865 13865->13845 13866->13859 13868 fec5c1 TpPostWork 13867->13868 13868->13862 13870 feaff7 13869->13870 13871 feafe7 13869->13871 13870->13848 13871->13870 13873 fec258 13871->13873 13874 fec26d TpReleaseWork 13873->13874 13874->13870 13876 fd21e0 std::invalid_argument::invalid_argument 16 API calls 13875->13876 13877 feb57f 13876->13877 13877->13606 10907 100649b 10914 10064a7 __cftof 10907->10914 10909 10064d6 10910 10064f3 10909->10910 10911 10064e5 10909->10911 10937 100616d 10910->10937 10912 1006549 61 API calls 10911->10912 10915 10064ef 10912->10915 10923 100835f 10914->10923 10919 1006521 10921 1006543 10919->10921 10960 100a565 10919->10960 10965 100cd56 10923->10965 10926 100836f 10928 1008379 IsProcessorFeaturePresent 10926->10928 10932 1008398 10926->10932 10930 1008385 10928->10930 10989 100628e 10930->10989 10968 1005dcd 10932->10968 10933 100cfd7 RtlAllocateHeap 10934 100cfea _free 10933->10934 10935 10083a2 __cftof 10933->10935 10934->10909 10935->10933 10935->10934 10995 10085a9 10935->10995 11134 10060ea 10937->11134 10940 1006191 10942 10060cd 10940->10942 11316 100601b 10942->11316 10944 10060e5 10944->10919 10945 1006549 10944->10945 10946 1006574 __cftof 10945->10946 10947 1006557 __dosmaperr _free 10945->10947 10948 10065b6 CreateFileW 10946->10948 10955 100659a __dosmaperr _free 10946->10955 10952 100643a __cftof 11 API calls 10947->10952 10949 10065e8 10948->10949 10950 10065da 10948->10950 11372 1006627 10949->11372 11351 10066b1 GetFileType 10950->11351 10954 100656f 10952->10954 10954->10919 10956 100643a __cftof 11 API calls 10955->10956 10957 10065b1 10956->10957 10957->10919 10958 10065e3 __cftof 10958->10957 10959 1006619 FindCloseChangeNotification 10958->10959 10959->10957 10961 100a570 HeapFree 10960->10961 10962 100a599 _free 10960->10962 10961->10962 10963 100a585 _free 10961->10963 10962->10921 10964 100a58b GetLastError 10963->10964 10964->10962 10998 100cc88 10965->10998 11009 1005ca7 10968->11009 10971 100cda4 10972 100cdb0 __cftof 10971->10972 10973 100ce22 _free 10972->10973 10974 100ce0c 10972->10974 10975 100cddd __cftof 10972->10975 11094 100643a 10973->11094 10974->10926 10978 100ce4e 10975->10978 11097 100853b RtlEnterCriticalSection 10975->11097 10980 100ce96 __cftof 10978->10980 10981 100cf8b 10978->10981 11098 100cf37 10980->11098 10982 100cf96 10981->10982 11102 1008583 RtlLeaveCriticalSection 10981->11102 10984 1005dcd __cftof 17 API calls 10982->10984 10987 100cf9e __cftof 10984->10987 10985 100cfd7 RtlAllocateHeap 10986 100cfea _free 10985->10986 10985->10987 10986->10926 10987->10985 10987->10986 10988 10085a9 __cftof 2 API calls 10987->10988 10988->10987 10990 10062aa __cftof 10989->10990 10991 10062d6 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 10990->10991 10994 10063a7 __cftof 10991->10994 10993 10063c5 10993->10932 11115 fec7d1 10994->11115 11123 10085d6 10995->11123 10999 100cc94 __cftof 10998->10999 11004 100853b RtlEnterCriticalSection 10999->11004 11001 100cca2 11005 100cce0 11001->11005 11004->11001 11008 1008583 RtlLeaveCriticalSection 11005->11008 11007 1008364 11007->10926 11007->10971 11008->11007 11010 1005cb5 11009->11010 11011 1005cc7 11009->11011 11030 fed4bc GetModuleHandleW 11010->11030 11022 1005b4e 11011->11022 11016 1005d00 11016->10935 11017 1005d02 11037 1005d0b 11017->11037 11023 1005b5a __cftof 11022->11023 11045 100853b RtlEnterCriticalSection 11023->11045 11025 1005b64 11046 1005bba 11025->11046 11027 1005b71 11050 1005b8f 11027->11050 11031 fed4c8 11030->11031 11031->11011 11032 1005d4d GetModuleHandleExW 11031->11032 11033 1005d6c GetProcAddress 11032->11033 11034 1005d81 11032->11034 11033->11034 11035 1005d95 FreeLibrary 11034->11035 11036 1005cc6 11034->11036 11035->11036 11036->11011 11074 1009a72 GetPEB 11037->11074 11040 1005d3a 11043 1005d4d __cftof 3 API calls 11040->11043 11041 1005d1a GetPEB 11041->11040 11042 1005d2a GetCurrentProcess TerminateProcess 11041->11042 11042->11040 11044 1005d42 11043->11044 11045->11025 11047 1005bc6 __cftof 11046->11047 11049 1005c27 __cftof 11047->11049 11053 1009015 11047->11053 11049->11027 11073 1008583 RtlLeaveCriticalSection 11050->11073 11052 1005b7d 11052->11016 11052->11017 11056 1008d46 11053->11056 11057 1008d52 __cftof 11056->11057 11064 100853b RtlEnterCriticalSection 11057->11064 11059 1008d60 11065 1008f25 11059->11065 11064->11059 11066 1008f44 11065->11066 11067 1008d6d 11065->11067 11066->11067 11068 100a565 _free 2 API calls 11066->11068 11069 1008d95 11067->11069 11068->11067 11072 1008583 RtlLeaveCriticalSection 11069->11072 11071 1008d7e 11071->11049 11072->11071 11073->11052 11075 1005d15 11074->11075 11076 1009a8c 11074->11076 11075->11040 11075->11041 11078 100aa37 11076->11078 11081 100a9b4 11078->11081 11080 100aa53 11080->11075 11082 100a9e2 11081->11082 11086 100a9de __cftof 11081->11086 11082->11086 11087 100a8ed 11082->11087 11085 100a9fc GetProcAddress 11085->11086 11086->11080 11088 100a8fe __cftof 11087->11088 11089 100a91c LoadLibraryExW 11088->11089 11091 100a992 FreeLibrary 11088->11091 11092 100a9a9 11088->11092 11093 100a96a LoadLibraryExW 11088->11093 11089->11088 11090 100a937 GetLastError 11089->11090 11090->11088 11091->11088 11092->11085 11092->11086 11093->11088 11103 10063d6 11094->11103 11096 1006446 11096->10974 11097->10978 11099 100cf44 11098->11099 11100 100cf3d 11098->11100 11099->10974 11114 1008583 RtlLeaveCriticalSection 11100->11114 11102->10982 11104 10063e1 11103->11104 11105 10063ef 11104->11105 11110 1006467 IsProcessorFeaturePresent 11104->11110 11105->11096 11107 1006439 11108 10063d6 __cftof 11 API calls 11107->11108 11109 1006446 11108->11109 11109->11096 11111 1006473 11110->11111 11112 100628e __cftof 8 API calls 11111->11112 11113 1006488 GetCurrentProcess TerminateProcess 11112->11113 11113->11107 11114->11099 11116 fec7dc IsProcessorFeaturePresent 11115->11116 11117 fec7da 11115->11117 11119 feca08 11116->11119 11117->10993 11122 fec9cc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 11119->11122 11121 fecaeb 11121->10993 11122->11121 11124 10085e2 __cftof 11123->11124 11129 100853b RtlEnterCriticalSection 11124->11129 11126 10085ed 11130 1008629 11126->11130 11129->11126 11133 1008583 RtlLeaveCriticalSection 11130->11133 11132 10085b4 11132->10935 11133->11132 11135 100610a 11134->11135 11139 1006101 11134->11139 11135->11139 11143 100ad6b 11135->11143 11139->10940 11140 100aa77 11139->11140 11313 100a885 11140->11313 11144 100ad7e 11143->11144 11146 1006140 11143->11146 11144->11146 11151 100ed1c 11144->11151 11147 100ad98 11146->11147 11148 100adc0 11147->11148 11149 100adab 11147->11149 11148->11139 11149->11148 11285 100de22 11149->11285 11152 100ed28 __cftof 11151->11152 11159 100ed77 11152->11159 11162 100853b RtlEnterCriticalSection 11152->11162 11154 100ed4f 11163 100ed9d 11154->11163 11159->11146 11160 100835f __cftof 31 API calls 11161 100ed9c 11160->11161 11162->11154 11164 100edab __cftof 11163->11164 11166 100ed60 11163->11166 11164->11166 11170 100ead0 11164->11170 11167 100ed7c 11166->11167 11284 1008583 RtlLeaveCriticalSection 11167->11284 11169 100ed73 11169->11159 11169->11160 11171 100eb50 11170->11171 11174 100eae6 11170->11174 11172 100eb9e 11171->11172 11175 100a565 _free 2 API calls 11171->11175 11238 100ec41 11172->11238 11174->11171 11176 100eb19 11174->11176 11181 100a565 _free 2 API calls 11174->11181 11177 100eb72 11175->11177 11178 100eb3b 11176->11178 11186 100a565 _free 2 API calls 11176->11186 11179 100a565 _free 2 API calls 11177->11179 11180 100a565 _free 2 API calls 11178->11180 11182 100eb85 11179->11182 11183 100eb45 11180->11183 11185 100eb0e 11181->11185 11187 100a565 _free 2 API calls 11182->11187 11188 100a565 _free 2 API calls 11183->11188 11184 100ec0c 11189 100a565 _free 2 API calls 11184->11189 11198 100e6ad 11185->11198 11191 100eb30 11186->11191 11192 100eb93 11187->11192 11188->11171 11194 100ec12 11189->11194 11226 100e7ab 11191->11226 11197 100a565 _free 2 API calls 11192->11197 11193 100a565 HeapFree GetLastError _free 11195 100ebac 11193->11195 11194->11166 11195->11184 11195->11193 11197->11172 11199 100e6be 11198->11199 11225 100e7a7 11198->11225 11200 100e6cf 11199->11200 11201 100a565 _free 2 API calls 11199->11201 11202 100e6e1 11200->11202 11204 100a565 _free 2 API calls 11200->11204 11201->11200 11203 100e6f3 11202->11203 11205 100a565 _free 2 API calls 11202->11205 11206 100e705 11203->11206 11207 100a565 _free 2 API calls 11203->11207 11204->11202 11205->11203 11208 100e717 11206->11208 11209 100a565 _free 2 API calls 11206->11209 11207->11206 11210 100e729 11208->11210 11212 100a565 _free 2 API calls 11208->11212 11209->11208 11211 100e73b 11210->11211 11213 100a565 _free 2 API calls 11210->11213 11214 100a565 _free 2 API calls 11211->11214 11216 100e74d 11211->11216 11212->11210 11213->11211 11214->11216 11215 100e75f 11218 100e771 11215->11218 11220 100a565 _free 2 API calls 11215->11220 11216->11215 11217 100a565 _free 2 API calls 11216->11217 11217->11215 11219 100e783 11218->11219 11221 100a565 _free 2 API calls 11218->11221 11222 100e795 11219->11222 11223 100a565 _free 2 API calls 11219->11223 11220->11218 11221->11219 11224 100a565 _free 2 API calls 11222->11224 11222->11225 11223->11222 11224->11225 11225->11176 11227 100e7b8 11226->11227 11237 100e810 11226->11237 11228 100e7c8 11227->11228 11229 100a565 _free 2 API calls 11227->11229 11230 100e7da 11228->11230 11232 100a565 _free 2 API calls 11228->11232 11229->11228 11231 100e7ec 11230->11231 11233 100a565 _free 2 API calls 11230->11233 11234 100a565 _free 2 API calls 11231->11234 11235 100e7fe 11231->11235 11232->11230 11233->11231 11234->11235 11236 100a565 _free 2 API calls 11235->11236 11235->11237 11236->11237 11237->11178 11239 100ec4e 11238->11239 11240 100ec6d 11238->11240 11239->11240 11244 100e84c 11239->11244 11240->11195 11243 100a565 _free 2 API calls 11243->11240 11245 100e92a 11244->11245 11246 100e85d 11244->11246 11245->11243 11280 100e814 11246->11280 11249 100e814 __cftof 2 API calls 11250 100e870 11249->11250 11251 100e814 __cftof 2 API calls 11250->11251 11252 100e87b 11251->11252 11253 100e814 __cftof 2 API calls 11252->11253 11254 100e886 11253->11254 11255 100e814 __cftof 2 API calls 11254->11255 11256 100e894 11255->11256 11257 100a565 _free 2 API calls 11256->11257 11258 100e89f 11257->11258 11259 100a565 _free 2 API calls 11258->11259 11260 100e8aa 11259->11260 11261 100a565 _free 2 API calls 11260->11261 11262 100e8b5 11261->11262 11263 100e814 __cftof 2 API calls 11262->11263 11264 100e8c3 11263->11264 11265 100e814 __cftof 2 API calls 11264->11265 11266 100e8d1 11265->11266 11267 100e814 __cftof 2 API calls 11266->11267 11268 100e8e2 11267->11268 11269 100e814 __cftof 2 API calls 11268->11269 11270 100e8f0 11269->11270 11271 100e814 __cftof 2 API calls 11270->11271 11272 100e8fe 11271->11272 11273 100a565 _free 2 API calls 11272->11273 11274 100e909 11273->11274 11275 100a565 _free 2 API calls 11274->11275 11276 100e914 11275->11276 11277 100a565 _free 2 API calls 11276->11277 11278 100e91f 11277->11278 11279 100a565 _free 2 API calls 11278->11279 11279->11245 11281 100e847 11280->11281 11282 100e837 11280->11282 11281->11249 11282->11281 11283 100a565 _free 2 API calls 11282->11283 11283->11282 11284->11169 11286 100de2c 11285->11286 11289 100dd3a 11286->11289 11288 100de32 11288->11148 11290 100dd46 __cftof 11289->11290 11291 100dd60 11290->11291 11304 100853b RtlEnterCriticalSection 11290->11304 11293 100dd67 11291->11293 11295 100835f __cftof 31 API calls 11291->11295 11293->11288 11294 100dd9c 11305 100ddb9 11294->11305 11297 100ddd9 11295->11297 11303 100de15 11297->11303 11308 1009e9e 11297->11308 11298 100dd70 11298->11294 11300 100a565 _free 2 API calls 11298->11300 11300->11294 11303->11288 11304->11298 11312 1008583 RtlLeaveCriticalSection 11305->11312 11307 100ddc0 11307->11291 11309 1009ec1 11308->11309 11310 100835f __cftof 31 API calls 11309->11310 11311 1009f37 11310->11311 11312->11307 11314 100a9b4 __cftof 5 API calls 11313->11314 11315 100a89b 11314->11315 11315->10940 11317 1006043 11316->11317 11318 1006029 11316->11318 11319 1006069 11317->11319 11320 100604a 11317->11320 11331 10061ac 11318->11331 11340 100a809 11319->11340 11322 1006033 __dosmaperr _free 11320->11322 11335 10061c6 11320->11335 11322->10944 11325 1006078 11326 100607f GetLastError 11325->11326 11327 10061c6 5 API calls 11325->11327 11329 10060a5 11325->11329 11326->11322 11327->11329 11328 100a809 __fassign MultiByteToWideChar 11330 10060bc 11328->11330 11329->11322 11329->11328 11330->11322 11330->11326 11332 10061bf 11331->11332 11333 10061b7 11331->11333 11332->11322 11334 100a565 _free 2 API calls 11333->11334 11334->11332 11336 10061ac 2 API calls 11335->11336 11337 10061d4 11336->11337 11343 1006205 11337->11343 11342 100a81a MultiByteToWideChar 11340->11342 11342->11325 11346 100a7bb 11343->11346 11345 10061e5 11345->11322 11348 100a7f7 _free 11346->11348 11349 100a7c9 __cftof 11346->11349 11347 100a7e4 RtlAllocateHeap 11347->11348 11347->11349 11348->11345 11349->11347 11349->11348 11350 10085a9 __cftof 2 API calls 11349->11350 11350->11349 11352 10066ec 11351->11352 11353 100679e 11351->11353 11354 1006706 __cftof 11352->11354 11397 1006a27 11352->11397 11355 10067ca 11353->11355 11358 10067a8 11353->11358 11359 1006725 GetFileInformationByHandle 11354->11359 11371 1006782 __dosmaperr _free 11354->11371 11356 10067f4 PeekNamedPipe 11355->11356 11355->11371 11356->11371 11360 10067bb GetLastError 11358->11360 11358->11371 11359->11360 11362 100673b 11359->11362 11360->11371 11361 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 11364 100681f 11361->11364 11380 1006979 11362->11380 11364->10958 11368 1006821 7 API calls 11369 100676b 11368->11369 11370 1006821 7 API calls 11369->11370 11370->11371 11371->11361 11439 1006bc4 11372->11439 11375 100663a __dosmaperr 11375->10958 11376 1006979 41 API calls 11377 1006653 11376->11377 11378 1006a27 12 API calls 11377->11378 11379 1006672 11378->11379 11379->10958 11382 100698f _wcsrchr 11380->11382 11381 1006747 11390 1006821 11381->11390 11382->11381 11401 100b294 11382->11401 11384 10069d3 11384->11381 11385 100b294 41 API calls 11384->11385 11386 10069e4 11385->11386 11386->11381 11387 100b294 41 API calls 11386->11387 11388 10069f5 11387->11388 11388->11381 11389 100b294 41 API calls 11388->11389 11389->11381 11391 1006847 FileTimeToSystemTime 11390->11391 11392 1006839 11390->11392 11393 1006859 SystemTimeToTzSpecificLocalTime 11391->11393 11395 100683f 11391->11395 11392->11391 11392->11395 11393->11395 11394 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 11396 1006758 11394->11396 11395->11394 11396->11368 11398 1006a40 11397->11398 11400 1006a54 __dosmaperr 11398->11400 11420 100ae18 11398->11420 11400->11354 11402 100b2c5 11401->11402 11404 100b2a2 11401->11404 11409 100b2dd 11402->11409 11403 100b2a8 _free 11407 100643a __cftof 11 API calls 11403->11407 11404->11402 11404->11403 11406 100b2d8 11406->11384 11408 100b2b8 11407->11408 11408->11384 11410 100b307 11409->11410 11411 100b2ed _free 11409->11411 11412 100b326 11410->11412 11413 100b30f _free 11410->11413 11415 100643a __cftof 11 API calls 11411->11415 11414 10060ea __cftof 41 API calls 11412->11414 11416 100643a __cftof 11 API calls 11413->11416 11419 100b331 11414->11419 11417 100b2fd 11415->11417 11416->11417 11417->11406 11418 100b255 41 API calls 11418->11419 11419->11417 11419->11418 11432 10038d0 11420->11432 11422 100ae42 GetCurrentDirectoryW 11423 100ae6d 11422->11423 11426 100ae5e 11422->11426 11434 100cf9f 11423->11434 11425 100ae7a 11427 100ae82 GetCurrentDirectoryW 11425->11427 11430 100ae8e _free 11425->11430 11428 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 11426->11428 11427->11430 11429 100aeba 11428->11429 11429->11400 11431 100a565 _free 2 API calls 11430->11431 11431->11426 11433 10038e7 11432->11433 11433->11422 11433->11433 11435 100cfac __cftof 11434->11435 11436 100cfea _free 11435->11436 11437 100cfd7 RtlAllocateHeap 11435->11437 11438 10085a9 __cftof 2 API calls 11435->11438 11436->11425 11437->11435 11437->11436 11438->11435 11440 1006be8 11439->11440 11445 1006bee 11440->11445 11449 10068e6 11440->11449 11442 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 11443 1006635 11442->11443 11443->11375 11443->11376 11445->11442 11446 1006c43 GetDriveTypeW 11448 1006c51 11446->11448 11447 1006c14 11447->11446 11447->11448 11455 1008316 11448->11455 11450 10068f2 _free 11449->11450 11458 100b12b 11450->11458 11452 1006918 11452->11447 11453 100690a _free 11453->11452 11454 100b12b 26 API calls 11453->11454 11454->11452 11456 100a565 _free 2 API calls 11455->11456 11457 100832e 11456->11457 11457->11445 11461 100af8e 11458->11461 11462 100b00a 11461->11462 11463 100af9e 11461->11463 11493 10117a8 11462->11493 11463->11462 11464 100afa5 11463->11464 11466 100afb2 11464->11466 11467 100afd5 11464->11467 11475 100aebc GetFullPathNameW 11466->11475 11480 100af25 GetFullPathNameW 11467->11480 11470 100afcb 11470->11453 11471 100afeb 11487 100b0c5 11471->11487 11474 1008316 ___std_exception_destroy 2 API calls 11474->11470 11476 100aedc GetLastError 11475->11476 11478 100aef2 11475->11478 11477 100aee8 __dosmaperr _free 11476->11477 11477->11470 11478->11477 11479 100af08 GetFullPathNameW 11478->11479 11479->11476 11479->11477 11481 100af45 GetLastError 11480->11481 11482 100af5b 11480->11482 11483 100af51 __dosmaperr _free 11481->11483 11482->11483 11496 100b067 11482->11496 11483->11471 11486 100af71 GetFullPathNameW 11486->11481 11486->11483 11488 100aff5 11487->11488 11489 100b0d2 11487->11489 11488->11470 11488->11474 11489->11488 11490 1008354 ___std_exception_copy 3 API calls 11489->11490 11491 100b0eb 11490->11491 11513 100b149 11491->11513 11520 10115d2 11493->11520 11501 100b026 11496->11501 11502 100b031 11501->11502 11503 100b039 11501->11503 11504 1008316 ___std_exception_destroy 2 API calls 11502->11504 11505 100b0a6 11503->11505 11504->11503 11508 1008354 11505->11508 11507 100af69 11507->11483 11507->11486 11511 100a7bb __cftof 11508->11511 11509 100a7e4 RtlAllocateHeap 11510 100a7f7 _free 11509->11510 11509->11511 11510->11507 11511->11509 11511->11510 11512 10085a9 __cftof RtlEnterCriticalSection RtlLeaveCriticalSection 11511->11512 11512->11511 11514 100b15a 11513->11514 11516 100b156 11513->11516 11515 100b161 _free 11514->11515 11518 100b174 __cftof _free 11514->11518 11517 100643a __cftof 11 API calls 11515->11517 11516->11488 11517->11516 11518->11516 11519 100643a __cftof 11 API calls 11518->11519 11519->11516 11521 10115f0 _free 11520->11521 11522 1011604 11520->11522 11527 100643a __cftof 11 API calls 11521->11527 11523 1011643 11522->11523 11524 101160c 11522->11524 11525 100ae18 12 API calls 11523->11525 11548 101172c 11524->11548 11530 1011612 11525->11530 11528 1011600 11527->11528 11529 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 11528->11529 11531 1011641 11529->11531 11532 10116e3 11530->11532 11533 101167c 11530->11533 11538 1011617 __dosmaperr _free 11530->11538 11531->11470 11534 10116f7 11532->11534 11532->11538 11535 100b067 5 API calls 11533->11535 11536 100aebc 3 API calls 11534->11536 11537 1011699 11535->11537 11536->11528 11539 100af25 8 API calls 11537->11539 11540 100643a __cftof 11 API calls 11538->11540 11541 10116a6 11539->11541 11540->11528 11542 10116cb 11541->11542 11543 10116ac 11541->11543 11542->11528 11546 1008316 ___std_exception_destroy 2 API calls 11542->11546 11544 100b0c5 14 API calls 11543->11544 11545 10116b4 11544->11545 11545->11528 11547 1008316 ___std_exception_destroy 2 API calls 11545->11547 11546->11528 11547->11528 11549 1011763 11548->11549 11553 1011746 __dosmaperr _free 11548->11553 11550 1011761 11549->11550 11551 101176c GetDriveTypeW 11549->11551 11552 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 11550->11552 11551->11550 11554 10117a6 11552->11554 11555 100643a __cftof 11 API calls 11553->11555 11554->11530 11555->11550 11556 fd8250 11557 fd8256 11556->11557 11563 1005f09 11557->11563 11560 fd8276 11562 fd8270 11577 1005e52 11563->11577 11565 fd8263 11565->11560 11566 1005f97 11565->11566 11567 1005fa3 __cftof 11566->11567 11568 1005fc2 11567->11568 11569 1005fad _free 11567->11569 11574 1005fbd 11568->11574 11625 10084d2 RtlEnterCriticalSection 11568->11625 11571 100643a __cftof 11 API calls 11569->11571 11571->11574 11572 1005fdf 11626 1005f20 11572->11626 11574->11562 11575 1005fea 11640 1006011 11575->11640 11579 1005e5e __cftof 11577->11579 11578 1005e65 _free 11580 100643a __cftof 11 API calls 11578->11580 11579->11578 11581 1005e85 11579->11581 11583 1005e75 _free 11580->11583 11581->11583 11586 100a033 11581->11586 11583->11565 11584 1005ea0 11584->11583 11594 1005ef2 11584->11594 11587 100a03f __cftof 11586->11587 11598 100853b RtlEnterCriticalSection 11587->11598 11589 100a04d 11599 100a0d7 11589->11599 11595 1005ef6 11594->11595 11624 10084e6 RtlLeaveCriticalSection 11595->11624 11597 1005f07 11597->11583 11598->11589 11606 100a0fa 11599->11606 11600 100a152 11601 100cf9f 3 API calls 11600->11601 11602 100a15b 11601->11602 11604 100a565 _free 2 API calls 11602->11604 11605 100a164 11604->11605 11611 100a05a 11605->11611 11617 100ac31 11605->11617 11606->11600 11606->11606 11606->11611 11615 10084d2 RtlEnterCriticalSection 11606->11615 11616 10084e6 RtlLeaveCriticalSection 11606->11616 11612 100a093 11611->11612 11623 1008583 RtlLeaveCriticalSection 11612->11623 11614 100a07e 11614->11584 11615->11606 11616->11606 11618 100a9b4 __cftof 5 API calls 11617->11618 11619 100ac4d 11618->11619 11620 100ac6b InitializeCriticalSectionAndSpinCount 11619->11620 11621 100a183 11619->11621 11620->11621 11622 10084d2 RtlEnterCriticalSection 11621->11622 11622->11611 11623->11614 11624->11597 11625->11572 11627 1005f42 11626->11627 11628 1005f2d _free 11626->11628 11631 1005f3d 11627->11631 11643 10097a9 11627->11643 11630 100643a __cftof 11 API calls 11628->11630 11630->11631 11631->11575 11636 1005f65 11658 100a62b 11636->11658 11638 1005f6b 11638->11631 11639 100a565 _free 2 API calls 11638->11639 11639->11631 11818 10084e6 RtlLeaveCriticalSection 11640->11818 11642 1006019 11642->11574 11644 10097c1 11643->11644 11648 1005f57 11643->11648 11645 100a754 11 API calls 11644->11645 11644->11648 11646 10097df 11645->11646 11665 100fba9 11646->11665 11649 100a77b 11648->11649 11650 100a792 11649->11650 11651 1005f5f 11649->11651 11650->11651 11652 100a565 _free 2 API calls 11650->11652 11653 100a754 11651->11653 11652->11651 11654 100a760 _free 11653->11654 11655 100a775 11653->11655 11656 100643a __cftof 11 API calls 11654->11656 11655->11636 11657 100a770 11656->11657 11657->11636 11659 100a651 11658->11659 11663 100a63c __dosmaperr _free 11658->11663 11660 100a678 11659->11660 11662 100a69a __dosmaperr _free 11659->11662 11788 100a59f 11660->11788 11664 100643a __cftof 11 API calls 11662->11664 11663->11638 11664->11663 11666 100fbb5 __cftof 11665->11666 11667 100fc07 11666->11667 11668 100fc70 __dosmaperr _free 11666->11668 11672 100fbbd __dosmaperr _free 11666->11672 11676 100b4e3 RtlEnterCriticalSection 11667->11676 11671 100643a __cftof 11 API calls 11668->11671 11670 100fc0d 11674 100fc29 __dosmaperr _free 11670->11674 11677 100fc9b 11670->11677 11671->11672 11672->11648 11703 100fc68 11674->11703 11676->11670 11678 100fcbd 11677->11678 11702 100fcd9 __dosmaperr _free 11677->11702 11679 100fd11 11678->11679 11681 100fcc1 __dosmaperr _free 11678->11681 11680 100fd24 11679->11680 11706 1013d34 11679->11706 11709 100f842 11680->11709 11685 100643a __cftof 11 API calls 11681->11685 11685->11702 11686 100fd79 11688 100fdd2 WriteFile 11686->11688 11689 100fd8d 11686->11689 11687 100fd3a 11690 100fd63 11687->11690 11691 100fd3e 11687->11691 11692 100fdf6 GetLastError 11688->11692 11688->11702 11694 100fdc2 11689->11694 11695 100fd98 11689->11695 11719 100f430 GetConsoleCP 11690->11719 11691->11702 11714 100f7da 11691->11714 11692->11702 11747 100f8b3 11694->11747 11696 100fdb2 11695->11696 11699 100fd9d 11695->11699 11739 100fa77 11696->11739 11699->11702 11732 100f98e 11699->11732 11702->11674 11787 100b598 RtlLeaveCriticalSection 11703->11787 11705 100fc6e 11705->11672 11754 1013cb8 11706->11754 11708 1013d4a 11708->11680 11765 1013c62 11709->11765 11711 100f8a9 11711->11686 11711->11687 11712 100f853 11712->11711 11713 100f890 GetConsoleMode 11712->11713 11713->11711 11717 100f831 11714->11717 11718 100f7fc 11714->11718 11715 101491c CreateFileW CloseHandle WriteConsoleW GetLastError WriteConsoleW 11715->11718 11716 100f833 GetLastError 11716->11717 11717->11702 11718->11715 11718->11716 11718->11717 11720 10060ea __cftof 41 API calls 11719->11720 11728 100f48c 11720->11728 11721 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 11722 100f7d8 11721->11722 11722->11702 11724 100bd9a 41 API calls __fassign 11724->11728 11725 100f72c 11725->11721 11728->11724 11728->11725 11729 100f6af WriteFile 11728->11729 11731 100f6e7 WriteFile 11728->11731 11770 10121f3 11728->11770 11776 100cb99 11728->11776 11780 100e097 11728->11780 11729->11728 11730 100f7a8 GetLastError 11729->11730 11730->11725 11731->11728 11731->11730 11733 100f99d 11732->11733 11734 100fa5c 11733->11734 11735 100fa12 WriteFile 11733->11735 11736 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 11734->11736 11735->11733 11737 100fa5e GetLastError 11735->11737 11738 100fa75 11736->11738 11737->11734 11738->11702 11745 100fa86 11739->11745 11740 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 11741 100fba7 11740->11741 11741->11702 11742 100e097 __cftof WideCharToMultiByte 11742->11745 11743 100fb90 GetLastError 11746 100fb8e 11743->11746 11744 100fb45 WriteFile 11744->11743 11744->11745 11745->11742 11745->11743 11745->11744 11745->11746 11746->11740 11748 100f8c2 11747->11748 11751 100f932 WriteFile 11748->11751 11753 100f973 11748->11753 11749 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 11750 100f98c 11749->11750 11750->11702 11751->11748 11752 100f975 GetLastError 11751->11752 11752->11753 11753->11749 11760 100b75f 11754->11760 11756 1013cca 11757 1013ce3 SetFilePointerEx 11756->11757 11758 1013cd2 __dosmaperr _free 11756->11758 11757->11758 11759 1013cfb GetLastError 11757->11759 11758->11708 11759->11758 11761 100b781 __dosmaperr _free 11760->11761 11762 100b76c __dosmaperr _free 11760->11762 11763 100b7a6 11761->11763 11764 100643a __cftof 11 API calls 11761->11764 11762->11756 11763->11756 11764->11762 11766 1013c6f _free 11765->11766 11768 1013c7c _free 11765->11768 11766->11712 11767 1013c88 11767->11712 11768->11767 11769 100643a __cftof 11 API calls 11768->11769 11769->11766 11773 10122a8 11770->11773 11774 101220c 11770->11774 11772 1015a79 __fassign 5 API calls 11772->11773 11773->11772 11775 101227e _free 11773->11775 11774->11775 11783 1015a79 11774->11783 11775->11728 11777 100cba4 11776->11777 11778 100ad6b __cftof 31 API calls 11777->11778 11779 100cbb4 11778->11779 11779->11728 11782 100e0b0 WideCharToMultiByte 11780->11782 11782->11728 11784 1015aa0 __cftof 11783->11784 11785 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 11784->11785 11786 1015c1e 11785->11786 11786->11774 11787->11705 11789 100a5ab __cftof 11788->11789 11796 100b4e3 RtlEnterCriticalSection 11789->11796 11791 100a5b9 11793 100a5e6 _free 11791->11793 11797 100a6b8 11791->11797 11810 100a61f 11793->11810 11796->11791 11798 100b75f 11 API calls 11797->11798 11800 100a6c8 11798->11800 11799 100a6ce 11813 100b6ce 11799->11813 11800->11799 11802 100a700 11800->11802 11804 100b75f 11 API calls 11800->11804 11802->11799 11803 100b75f 11 API calls 11802->11803 11805 100a70c CloseHandle 11803->11805 11806 100a6f7 11804->11806 11805->11799 11808 100a718 GetLastError 11805->11808 11807 100b75f 11 API calls 11806->11807 11807->11802 11808->11799 11809 100a726 __dosmaperr 11809->11793 11817 100b598 RtlLeaveCriticalSection 11810->11817 11812 100a608 11812->11663 11814 100b6dd 11813->11814 11815 100b734 __dosmaperr _free 11813->11815 11814->11815 11816 100b72e SetStdHandle 11814->11816 11815->11809 11816->11815 11817->11812 11818->11642 11819 fd6020 RegOpenKeyExA 11820 fd605d RegSetValueExA 11819->11820 11821 fd6087 RegCloseKey 11819->11821 11820->11821 11824 fd6098 shared_ptr 11821->11824 11822 fd6156 11829 100644a 11822->11829 11823 fec7d1 __ehhandler$?_Init@?$_Mpunct@_W@std@@IAEXABV_Locinfo@2@@Z 5 API calls 11827 fd6152 11823->11827 11824->11822 11826 fd613e shared_ptr 11824->11826 11826->11823 11830 10063d6 __cftof 11 API calls 11829->11830 11831 1006459 11830->11831 11832 1006467 __cftof 11 API calls 11831->11832 11833 1006466 11832->11833

                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                          Function 00FD6A70 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 174processmemorythreadCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • std::_Xinvalid_argument.LIBCPMT ref: 00FD6C15
                                                                                                                                                                                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00FD6C4D
                                                                                                                                                                                                                                          • CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00FD6CAB
                                                                                                                                                                                                                                          • VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00FD6CC4
                                                                                                                                                                                                                                          • Wow64GetThreadContext.KERNEL32(?,00000000), ref: 00FD6CD9
                                                                                                                                                                                                                                          • ReadProcessMemory.KERNELBASE(?, ,?,00000004,00000000), ref: 00FD6CF9
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Process$AllocContextCreateFileMemoryModuleNameReadThreadVirtualWow64Xinvalid_argumentstd::_
                                                                                                                                                                                                                                          • String ID: $VUUU$invalid stoi argument
                                                                                                                                                                                                                                          • API String ID: 2361538342-3954507777
                                                                                                                                                                                                                                          • Opcode ID: d143c891a9842623cf0cdb8334ebcfc476edd5c7546a3c561e4036d8316996d3
                                                                                                                                                                                                                                          • Instruction ID: c2848128a4ec3281ff3c1b15913b5d4b587a663331b9e43db5fc91205f754fa3
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d143c891a9842623cf0cdb8334ebcfc476edd5c7546a3c561e4036d8316996d3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3851D471604301AFE7209F64CC46F9ABBE9FF84710F104529F784EA2C0DB79A904CB9A
                                                                                                                                                                                                                                          Function 00FDB670 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 304networkfileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1042 fdb670-fdb6bc 1043 fdbab1-fdbad6 call fe78a0 1042->1043 1044 fdb6c2-fdb6c6 1042->1044 1049 fdbad8-fdbae4 1043->1049 1050 fdbb04-fdbb1c 1043->1050 1044->1043 1046 fdb6cc-fdb6d0 1044->1046 1046->1043 1048 fdb6d6-fdb75f InternetOpenW InternetConnectA call fe71e0 call fd5d40 1046->1048 1073 fdb761 1048->1073 1074 fdb763-fdb77f HttpOpenRequestA 1048->1074 1052 fdbafa-fdbb01 call fece48 1049->1052 1053 fdbae6-fdbaf4 1049->1053 1054 fdba68-fdba80 1050->1054 1055 fdbb22-fdbb2e 1050->1055 1052->1050 1053->1052 1058 fdbb7f-fdbb84 call 100644a 1053->1058 1062 fdba86-fdba92 1054->1062 1063 fdbb53-fdbb6f call fec7d1 1054->1063 1060 fdba5e-fdba65 call fece48 1055->1060 1061 fdbb34-fdbb42 1055->1061 1060->1054 1061->1058 1069 fdbb44 1061->1069 1070 fdbb49-fdbb50 call fece48 1062->1070 1071 fdba98-fdbaa6 1062->1071 1069->1060 1070->1063 1071->1058 1078 fdbaac 1071->1078 1073->1074 1079 fdb781-fdb790 1074->1079 1080 fdb7b0-fdb81f call fe71e0 call fd5d40 call fe71e0 call fd5d40 1074->1080 1078->1070 1082 fdb7a6-fdb7ad call fece48 1079->1082 1083 fdb792-fdb7a0 1079->1083 1094 fdb821 1080->1094 1095 fdb823-fdb839 HttpSendRequestA 1080->1095 1082->1080 1083->1082 1094->1095 1096 fdb83b-fdb84a 1095->1096 1097 fdb86a-fdb892 1095->1097 1098 fdb84c-fdb85a 1096->1098 1099 fdb860-fdb867 call fece48 1096->1099 1100 fdb894-fdb8a3 1097->1100 1101 fdb8c3-fdb8e4 InternetReadFile 1097->1101 1098->1099 1099->1097 1104 fdb8b9-fdb8c0 call fece48 1100->1104 1105 fdb8a5-fdb8b3 1100->1105 1102 fdb8ea 1101->1102 1106 fdb8f0-fdb9a0 call 1003a30 InternetReadFile 1102->1106 1104->1101 1105->1104
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • InternetOpenW.WININET(01028D34,00000000,00000000,00000000,00000000), ref: 00FDB6FC
                                                                                                                                                                                                                                          • InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00FDB720
                                                                                                                                                                                                                                          • HttpOpenRequestA.WININET(?,00000000), ref: 00FDB76A
                                                                                                                                                                                                                                          • HttpSendRequestA.WININET(?,00000000), ref: 00FDB82A
                                                                                                                                                                                                                                          • InternetReadFile.WININET(?,?,000003FF,?), ref: 00FDB8DC
                                                                                                                                                                                                                                          • InternetReadFile.WININET(?,?,000003FF,?), ref: 00FDB990
                                                                                                                                                                                                                                          • InternetCloseHandle.WININET(?), ref: 00FDB9B7
                                                                                                                                                                                                                                          • InternetCloseHandle.WININET(?), ref: 00FDB9BF
                                                                                                                                                                                                                                          • InternetCloseHandle.WININET(?), ref: 00FDB9C7
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
                                                                                                                                                                                                                                          • String ID: WA9QQy==$WiVq$cDRX8BqpMw==$cDRX8FO0MyY=$invalid stoi argument$stoi argument out of range
                                                                                                                                                                                                                                          • API String ID: 1354133546-2062743901
                                                                                                                                                                                                                                          • Opcode ID: e338371cab1a0a09fe95d71111aeb1a557e8221338d719c29312d0b146f049b5
                                                                                                                                                                                                                                          • Instruction ID: de14678c173002797c03765d63c4f4618749e4214f01b083af16311cfc6dce90
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e338371cab1a0a09fe95d71111aeb1a557e8221338d719c29312d0b146f049b5
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FDB103B1A00258DBDB24CF28CC84B9DBBBAEF81300F5441AAF50897395D7799AC0DF95
                                                                                                                                                                                                                                          Function 00FD78B0 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 388libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1117 fd78b0-fd7932 call 10038d0 GetVersionExW 1120 fd7938-fd7960 call fe71e0 call fd5d40 1117->1120 1121 fd7e1a-fd7e37 call fec7d1 1117->1121 1128 fd7964-fd7986 call fe71e0 call fd5d40 1120->1128 1129 fd7962 1120->1129 1134 fd7988 1128->1134 1135 fd798a-fd79a3 GetModuleHandleA GetProcAddress 1128->1135 1129->1128 1134->1135 1136 fd79a5-fd79b4 1135->1136 1137 fd79d4-fd79ff 1135->1137 1140 fd79ca-fd79d1 call fece48 1136->1140 1141 fd79b6-fd79c4 1136->1141 1138 fd7a01-fd7a10 1137->1138 1139 fd7a30-fd7a51 1137->1139 1142 fd7a26-fd7a2d call fece48 1138->1142 1143 fd7a12-fd7a20 1138->1143 1144 fd7a57 GetSystemInfo 1139->1144 1145 fd7a53-fd7a55 GetNativeSystemInfo 1139->1145 1140->1137 1141->1140 1146 fd7e38 call 100644a 1141->1146 1142->1139 1143->1142 1143->1146 1149 fd7a5d-fd7a66 1144->1149 1145->1149 1155 fd7e3d-fd7e42 call 100644a 1146->1155 1153 fd7a68-fd7a6f 1149->1153 1154 fd7a84-fd7a87 1149->1154 1156 fd7e15 1153->1156 1157 fd7a75-fd7a7f 1153->1157 1158 fd7a8d-fd7a96 1154->1158 1159 fd7dbb-fd7dbe 1154->1159 1156->1121 1162 fd7e10 1157->1162 1163 fd7aa9-fd7aac 1158->1163 1164 fd7a98-fd7aa4 1158->1164 1159->1156 1165 fd7dc0-fd7dc9 1159->1165 1162->1156 1166 fd7d98-fd7d9a 1163->1166 1167 fd7ab2-fd7ab9 1163->1167 1164->1162 1168 fd7dcb-fd7dcf 1165->1168 1169 fd7df0-fd7df3 1165->1169 1176 fd7d9c-fd7da6 1166->1176 1177 fd7da8-fd7dab 1166->1177 1170 fd7abf-fd7b16 call fe71e0 call fd5d40 call fe71e0 call fd5d40 call fd5e90 1167->1170 1171 fd7b94-fd7d81 call fe71e0 call fd5d40 call fe71e0 call fd5d40 call fd5e90 call fe71e0 call fd5d40 call fd5860 call fe71e0 call fd5d40 call fe71e0 call fd5d40 call fd5e90 call fe71e0 call fd5d40 call fd5860 call fe71e0 call fd5d40 call fe71e0 call fd5d40 call fd5e90 call fe71e0 call fd5d40 call fd5860 1167->1171 1172 fd7de4-fd7dee 1168->1172 1173 fd7dd1-fd7dd6 1168->1173 1174 fd7df5-fd7dff 1169->1174 1175 fd7e01-fd7e0d 1169->1175 1199 fd7b1b-fd7b22 1170->1199 1213 fd7d87-fd7d90 1171->1213 1172->1156 1173->1172 1179 fd7dd8-fd7de2 1173->1179 1174->1156 1175->1162 1176->1162 1177->1156 1181 fd7dad-fd7db9 1177->1181 1179->1156 1181->1162 1201 fd7b24 1199->1201 1202 fd7b26-fd7b46 call 1008331 1199->1202 1201->1202 1207 fd7b7d-fd7b7f 1202->1207 1208 fd7b48-fd7b57 1202->1208 1212 fd7b85-fd7b8f 1207->1212 1207->1213 1210 fd7b6d-fd7b7a call fece48 1208->1210 1211 fd7b59-fd7b67 1208->1211 1210->1207 1211->1155 1211->1210 1212->1213 1213->1159 1217 fd7d92 1213->1217 1217->1166
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetVersionExW.KERNEL32(?), ref: 00FD792A
                                                                                                                                                                                                                                          • GetModuleHandleA.KERNEL32(00000000), ref: 00FD798B
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000), ref: 00FD7992
                                                                                                                                                                                                                                          • GetNativeSystemInfo.KERNELBASE(?), ref: 00FD7A53
                                                                                                                                                                                                                                          • GetSystemInfo.KERNEL32(?), ref: 00FD7A57
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: InfoSystem$AddressHandleModuleNativeProcVersion
                                                                                                                                                                                                                                          • String ID: OfAuIe==$OfAuJO==$OfAvHe==
                                                                                                                                                                                                                                          • API String ID: 374719553-782918887
                                                                                                                                                                                                                                          • Opcode ID: 9921b1cfc8b91ae79549c8592ea56bcfcef07e786c5278aa2ad9c8b9224fedcb
                                                                                                                                                                                                                                          • Instruction ID: b330e484305093950be7b1a736df584be55a9fa5213d947e3df5417830127c65
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9921b1cfc8b91ae79549c8592ea56bcfcef07e786c5278aa2ad9c8b9224fedcb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3D1D671E043449BDB24BB28DC4739D7773AB41720F98428EE4559F382EB394E80ABD2
                                                                                                                                                                                                                                          Function 00FD6160 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 253COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1251 fd6160-fd6238 GetUserNameA LookupAccountNameA GetSidIdentifierAuthority call fe71e0 call fd5d40 1256 fd623c-fd625b call fd21c0 1251->1256 1257 fd623a 1251->1257 1260 fd625d-fd626c 1256->1260 1261 fd628c-fd6292 1256->1261 1257->1256 1262 fd626e-fd627c 1260->1262 1263 fd6282-fd6289 call fece48 1260->1263 1264 fd6295-fd629a 1261->1264 1262->1263 1265 fd64b7 call 100644a 1262->1265 1263->1261 1264->1264 1267 fd629c-fd62c4 call fe71e0 call fd5d40 1264->1267 1271 fd64bc call 100644a 1265->1271 1278 fd62c8-fd62e9 call fd21c0 1267->1278 1279 fd62c6 1267->1279 1276 fd64c1-fd64c6 call 100644a 1271->1276 1283 fd62eb-fd62fa 1278->1283 1284 fd631a-fd632e GetSidSubAuthorityCount 1278->1284 1279->1278 1285 fd62fc-fd630a 1283->1285 1286 fd6310-fd6317 call fece48 1283->1286 1287 fd63d8-fd63fc 1284->1287 1288 fd6334-fd633a 1284->1288 1285->1271 1285->1286 1286->1284 1291 fd6400-fd6405 1287->1291 1290 fd6340-fd636d GetSidSubAuthority call fe71e0 call fd5d40 1288->1290 1301 fd636f 1290->1301 1302 fd6371-fd6398 call fd21c0 1290->1302 1291->1291 1294 fd6407-fd646c call fe78a0 * 2 1291->1294 1305 fd646e-fd647d 1294->1305 1306 fd6499-fd64b6 call fec7d1 1294->1306 1301->1302 1311 fd63c9-fd63cc 1302->1311 1312 fd639a-fd63a9 1302->1312 1308 fd648f-fd6496 call fece48 1305->1308 1309 fd647f-fd648d 1305->1309 1308->1306 1309->1276 1309->1308 1311->1290 1318 fd63d2 1311->1318 1315 fd63bf-fd63c6 call fece48 1312->1315 1316 fd63ab-fd63b9 1312->1316 1315->1311 1316->1265 1316->1315 1318->1287
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetUserNameA.ADVAPI32(?,?), ref: 00FD61BA
                                                                                                                                                                                                                                          • LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00FD6200
                                                                                                                                                                                                                                          • GetSidIdentifierAuthority.ADVAPI32(?,?,00000000), ref: 00FD620D
                                                                                                                                                                                                                                          • GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FD6321
                                                                                                                                                                                                                                          • GetSidSubAuthority.ADVAPI32(?,00000000), ref: 00FD6348
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Authority$Name$AccountCountIdentifierLookupUser
                                                                                                                                                                                                                                          • String ID: LO1p9O==$NOVp9O==$Wu0i7FWn
                                                                                                                                                                                                                                          • API String ID: 4230999276-3394816801
                                                                                                                                                                                                                                          • Opcode ID: 58bbd1351b43371e4efd2635f41b94eb6e9ce4992b9bb29fb709822f6df7294c
                                                                                                                                                                                                                                          • Instruction ID: b801667aacf629b45c3f25345a71c8dff96230d07d59a97654a3e654beecb0af
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 58bbd1351b43371e4efd2635f41b94eb6e9ce4992b9bb29fb709822f6df7294c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5A91D2B19002188BDB28DF28CC85BDDB77AEB45300F5445EEE509D7285DB399BC48FA4
                                                                                                                                                                                                                                          Function 00FD6E30 Relevance: 11.1, APIs: 5, Strings: 1, Instructions: 574sleepthreadCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1355 fd6e30-fd6ed8 call fe8c50 call fe78a0 ShellExecuteA 1360 fd6eda-fd6ee6 1355->1360 1361 fd6f06-fd6f1e 1355->1361 1362 fd6efc-fd6f03 call fece48 1360->1362 1363 fd6ee8-fd6ef6 1360->1363 1364 fd6f48-fd6f60 1361->1364 1365 fd6f20-fd6f2c 1361->1365 1362->1361 1363->1362 1368 fd6f9c-fd705b call 100644a call fe71e0 * 6 call fd6e30 1363->1368 1366 fd6f8a-fd6f9b 1364->1366 1367 fd6f62-fd6f6e 1364->1367 1370 fd6f3e-fd6f45 call fece48 1365->1370 1371 fd6f2e-fd6f3c 1365->1371 1372 fd6f80-fd6f87 call fece48 1367->1372 1373 fd6f70-fd6f7e 1367->1373 1396 fd705d-fd7069 1368->1396 1397 fd7089-fd708f 1368->1397 1370->1364 1371->1368 1371->1370 1372->1366 1373->1368 1373->1372 1398 fd707f-fd7086 call fece48 1396->1398 1399 fd706b-fd7079 1396->1399 1400 fd70b9-fd70bf 1397->1400 1401 fd7091-fd709d 1397->1401 1398->1397 1399->1398 1404 fd7107-fd7161 call 100644a Sleep 1399->1404 1402 fd70e9-fd7104 call fec7d1 1400->1402 1403 fd70c1-fd70cd 1400->1403 1406 fd70af-fd70b6 call fece48 1401->1406 1407 fd709f-fd70ad 1401->1407 1409 fd70df-fd70e6 call fece48 1403->1409 1410 fd70cf-fd70dd 1403->1410 1419 fd71e1-fd7257 call fe78a0 * 3 CreateThread Sleep 1404->1419 1420 fd7163-fd7177 call fec8f6 1404->1420 1406->1400 1407->1404 1407->1406 1409->1402 1410->1404 1410->1409 1434 fd7259-fd7265 1419->1434 1435 fd7285-fd729d 1419->1435 1420->1419 1425 fd7179-fd71de call fece33 call fec8ac 1420->1425 1425->1419 1438 fd727b-fd7282 call fece48 1434->1438 1439 fd7267-fd7275 1434->1439 1436 fd729f-fd72ab 1435->1436 1437 fd72c7-fd72df 1435->1437 1442 fd72bd-fd72c4 call fece48 1436->1442 1443 fd72ad-fd72bb 1436->1443 1444 fd7309-fd731a 1437->1444 1445 fd72e1-fd72ed 1437->1445 1438->1435 1439->1438 1440 fd731b-fd7390 call 100644a call fe7e60 call fe7b00 1439->1440 1459 fd73be-fd743d call fe71e0 * 2 call fd5d40 call fe78a0 call fd6e30 1440->1459 1460 fd7392-fd739e 1440->1460 1442->1437 1443->1440 1443->1442 1449 fd72ff-fd7306 call fece48 1445->1449 1450 fd72ef-fd72fd 1445->1450 1449->1444 1450->1440 1450->1449 1480 fd743f-fd744b 1459->1480 1481 fd746b-fd7471 1459->1481 1461 fd73b4-fd73bb call fece48 1460->1461 1462 fd73a0-fd73ae 1460->1462 1461->1459 1462->1461 1464 fd74fa call 100644a 1462->1464 1471 fd74ff-fd7504 call 100644a 1464->1471 1482 fd744d-fd745b 1480->1482 1483 fd7461-fd7468 call fece48 1480->1483 1484 fd749b-fd74b3 1481->1484 1485 fd7473-fd747f 1481->1485 1482->1471 1482->1483 1483->1481 1486 fd74dd-fd74f9 call fec7d1 1484->1486 1487 fd74b5-fd74c1 1484->1487 1489 fd7491-fd7498 call fece48 1485->1489 1490 fd7481-fd748f 1485->1490 1492 fd74d3-fd74da call fece48 1487->1492 1493 fd74c3-fd74d1 1487->1493 1489->1484 1490->1471 1490->1489 1492->1486 1493->1471 1493->1492
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • ShellExecuteA.SHELL32(00000000,00FD704D,?,?,00000000,00000000), ref: 00FD6EC4
                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064,DA74349A,?,00000000,01019148,000000FF), ref: 00FD714C
                                                                                                                                                                                                                                          • __Init_thread_footer.LIBCMT ref: 00FD71D9
                                                                                                                                                                                                                                            • Part of subcall function 00FEC8AC: RtlEnterCriticalSection.NTDLL(01035640), ref: 00FEC8B6
                                                                                                                                                                                                                                            • Part of subcall function 00FEC8AC: RtlLeaveCriticalSection.NTDLL(01035640), ref: 00FEC8E9
                                                                                                                                                                                                                                            • Part of subcall function 00FEC8AC: RtlWakeAllConditionVariable.NTDLL ref: 00FEC960
                                                                                                                                                                                                                                          • CreateThread.KERNELBASE(00000000,00000000,00FD6FB0,01036530,00000000,00000000), ref: 00FD723E
                                                                                                                                                                                                                                          • Sleep.KERNELBASE(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FD7249
                                                                                                                                                                                                                                            • Part of subcall function 00FEC8F6: RtlEnterCriticalSection.NTDLL(01035640), ref: 00FEC901
                                                                                                                                                                                                                                            • Part of subcall function 00FEC8F6: RtlLeaveCriticalSection.NTDLL(01035640), ref: 00FEC93E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CriticalSection$EnterLeaveSleep$ConditionCreateExecuteInit_thread_footerShellThreadVariableWake
                                                                                                                                                                                                                                          • String ID: runas
                                                                                                                                                                                                                                          • API String ID: 2746060404-4000483414
                                                                                                                                                                                                                                          • Opcode ID: e8fc961fc67835f49d8581299d73a5537fba05e0ea4004d0ac50dd39e547956d
                                                                                                                                                                                                                                          • Instruction ID: 724dff78d368564e2afc9be01fd62e6068fc3bc3943c492ae6b1a3e1b8554845
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e8fc961fc67835f49d8581299d73a5537fba05e0ea4004d0ac50dd39e547956d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 89123A71600248ABEB18EF28DC85B9D7BA6EB45310F54821DF8419B3C5D73A9A84DB91
                                                                                                                                                                                                                                          Function 00FECBC7 Relevance: 1.7, APIs: 1, Instructions: 172COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1734 fecbc7-fecbca 1735 fecbd9-fecbdc call 1008354 1734->1735 1737 fecbe1-fecbe4 1735->1737 1738 fecbcc-fecbd7 call 10085a9 1737->1738 1739 fecbe6-fecbe7 1737->1739 1738->1735 1742 fecbe8-fecbec 1738->1742 1743 fecbf2-fed5a3 call fea3f1 call 10032e1 IsProcessorFeaturePresent 1742->1743 1744 fd2380-fd23d0 call fd22c0 call 10032e1 call 100308c 1742->1744 1756 fed5a9-fed60e 1743->1756 1757 fed752-fed755 1743->1757 1758 fed653 1756->1758 1759 fed610-fed61d 1756->1759 1760 fed659-fed665 1758->1760 1761 fed61f-fed624 1759->1761 1762 fed642-fed651 1759->1762 1764 fed696 1760->1764 1765 fed667-fed689 1760->1765 1761->1762 1763 fed626-fed62b 1761->1763 1762->1760 1763->1762 1766 fed62d-fed632 1763->1766 1768 fed699-fed6b6 1764->1768 1767 fed68b-fed694 1765->1767 1765->1768 1766->1762 1769 fed634-fed639 1766->1769 1767->1768 1770 fed74f-fed751 1768->1770 1771 fed6bc-fed6d4 1768->1771 1769->1762 1772 fed63b-fed640 1769->1772 1770->1757 1771->1770 1773 fed6d6-fed6dc 1771->1773 1772->1758 1772->1762 1773->1770 1774 fed6de-fed6f6 1773->1774 1774->1770 1775 fed6f8-fed712 1774->1775 1775->1770 1776 fed714-fed72f 1775->1776 1776->1770 1777 fed731-fed740 1776->1777 1777->1770 1778 fed742-fed749 1777->1778 1778->1770
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • ___std_exception_copy.LIBVCRUNTIME ref: 00FD23BE
                                                                                                                                                                                                                                            • Part of subcall function 010032E1: RaiseException.KERNEL32(E06D7363,00000001,00000003,00FD239C,DA74349A,?,?,00FD239C,?,01030C14,?), ref: 01003341
                                                                                                                                                                                                                                          • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00FED59C
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFeaturePresentProcessorRaise___std_exception_copy
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1131819199-0
                                                                                                                                                                                                                                          • Opcode ID: 976a9b4c60fe0293b1ffdc19f7f2c836a93d417e550a37b492695e121b2fc199
                                                                                                                                                                                                                                          • Instruction ID: f6b3f676023850d549f96ce786214b06e53d2d639ee2fb822ee8d236daf15d24
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 976a9b4c60fe0293b1ffdc19f7f2c836a93d417e550a37b492695e121b2fc199
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B451C071D00309DFDB25CF5AD9857AEBBF9FB48320F24846AE444EB694D3799940CB50
                                                                                                                                                                                                                                          Function 00FE2DC0 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 0 fe2dc0-fe2df9 1 fe2dff-fe2e4f call fe78a0 0->1 2 fe39d0-fe39d6 0->2 17 fe3aa7 call fe79e0 1->17 18 fe2e55-fe2e9b call fe78a0 1->18 3 fe39d8-fe39e4 2->3 4 fe3a04-fe3a1c 2->4 6 fe39fa-fe3a01 call fece48 3->6 7 fe39e6-fe39f4 3->7 8 fe3a1e-fe3a2a 4->8 9 fe3a4a-fe3a62 4->9 6->4 7->6 13 fe3ae3 call 100644a 7->13 15 fe3a2c-fe3a3a 8->15 16 fe3a40-fe3a47 call fece48 8->16 11 fe3a8c-fe3aa6 call fec7d1 9->11 12 fe3a64-fe3a70 9->12 19 fe3a82-fe3a89 call fece48 12->19 20 fe3a72-fe3a80 12->20 15->13 15->16 16->9 30 fe3aac call fe79e0 17->30 18->17 32 fe2ea1-fe2edf call fe78a0 18->32 19->11 20->13 20->19 36 fe3ab1 call 100644a 30->36 32->17 39 fe2ee5-fe2f30 call fe78a0 call fe71e0 call fd5d40 32->39 40 fe3ab6 call 100644a 36->40 54 fe2f34-fe2f69 call fe8380 39->54 55 fe2f32 39->55 43 fe3abb call fe79e0 40->43 47 fe3ac0 call 100644a 43->47 51 fe3ac5 call 100644a 47->51 56 fe3aca-fe3acf call feb979 51->56 54->30 61 fe2f6f-fe2f9e call fe78a0 54->61 55->54 60 fe3ad4 call 100644a 56->60 65 fe3ad9-fe3ade call feb9b9 60->65 66 fe2fcf-fe2ff4 call fd93c0 61->66 67 fe2fa0-fe2faf 61->67 65->13 75 fe2ffa-fe3062 call fe71e0 call fd5d40 call fe78a0 66->75 76 fe34d8-fe34de 66->76 69 fe2fc5-fe2fcc call fece48 67->69 70 fe2fb1-fe2fbf 67->70 69->66 70->36 70->69 110 fe3066-fe309d call fe8c50 75->110 111 fe3064 75->111 77 fe350c-fe3512 76->77 78 fe34e0-fe34ec 76->78 80 fe3514-fe3520 77->80 81 fe3540-fe3546 77->81 82 fe34ee-fe34fc 78->82 83 fe3502-fe3509 call fece48 78->83 85 fe3536-fe353d call fece48 80->85 86 fe3522-fe3530 80->86 87 fe3548-fe3554 81->87 88 fe3574-fe358c 81->88 82->60 82->83 83->77 85->81 86->60 86->85 92 fe356a-fe3571 call fece48 87->92 93 fe3556-fe3564 87->93 94 fe358e-fe359d 88->94 95 fe35bd-fe35c3 88->95 92->88 93->60 93->92 101 fe359f-fe35ad 94->101 102 fe35b3-fe35ba call fece48 94->102 95->2 98 fe35c9-fe35d5 95->98 105 fe35db-fe35e9 98->105 106 fe39c6-fe39cd call fece48 98->106 101->60 101->102 102->95 105->60 113 fe35ef 105->113 106->2 117 fe309f-fe30aa 110->117 118 fe30ca-fe30d7 110->118 111->110 113->106 119 fe30ac-fe30ba 117->119 120 fe30c0-fe30c7 call fece48 117->120 121 fe3108-fe310f 118->121 122 fe30d9-fe30e8 118->122 119->40 119->120 120->118 123 fe3115-fe3137 121->123 124 fe32d3-fe3303 call 1006cf3 call 1008229 121->124 126 fe30fe-fe3105 call fece48 122->126 127 fe30ea-fe30f8 122->127 123->43 128 fe313d-fe316f call fe78a0 call fda830 123->128 124->56 140 fe3309-fe330c 124->140 126->121 127->40 127->126 141 fe31c7-fe31d0 128->141 142 fe3171-fe3177 128->142 140->65 143 fe3312-fe3315 140->143 146 fe31d2-fe31e1 141->146 147 fe3201-fe3241 call fe71e0 * 2 call fd4940 141->147 144 fe3179-fe3185 142->144 145 fe31a5-fe31c4 142->145 143->76 148 fe331b 143->148 156 fe319b-fe31a2 call fece48 144->156 157 fe3187-fe3195 144->157 145->141 149 fe31f7-fe31fe call fece48 146->149 150 fe31e3-fe31f1 146->150 189 fe3299-fe32a2 147->189 190 fe3243-fe3249 147->190 151 fe340d-fe34d2 call fe78a0 call fe71e0 call fd5d40 call fe71e0 * 5 call fe1710 148->151 152 fe35f4-fe36bd call fe78a0 call fe71e0 call fd5d40 call fe71e0 * 5 148->152 153 fe3322-fe33e7 call fe78a0 call fe71e0 call fd5d40 call fe71e0 * 5 148->153 154 fe36c2-fe371c call fe71e0 * 4 call fe2700 148->154 149->147 150->47 150->149 151->76 238 fe33eb-fe33fd call fe71e0 call fe0210 152->238 153->238 216 fe3721-fe3724 154->216 156->145 157->47 157->156 189->124 193 fe32a4-fe32b3 189->193 196 fe324b-fe3257 190->196 197 fe3277-fe3296 190->197 200 fe32c9-fe32d0 call fece48 193->200 201 fe32b5-fe32c3 193->201 204 fe326d-fe3274 call fece48 196->204 205 fe3259-fe3267 196->205 197->189 200->124 201->51 201->200 204->197 205->51 205->204 216->76 244 fe3402-fe3408 238->244 244->76
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • std::_Xinvalid_argument.LIBCPMT ref: 00FE3ACF
                                                                                                                                                                                                                                            • Part of subcall function 00FE71E0: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00FE72CC
                                                                                                                                                                                                                                            • Part of subcall function 00FE71E0: __Cnd_destroy_in_situ.LIBCPMT ref: 00FE72D8
                                                                                                                                                                                                                                            • Part of subcall function 00FE71E0: __Mtx_destroy_in_situ.LIBCPMT ref: 00FE72E1
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
                                                                                                                                                                                                                                          • String ID: "$0TI3$0TY3$0Y1h$0ik3$1C03$1Cxp$1Thi$246122658369$3c5ff2$5120$Ks==$Muso$Py4vHy==$RCM+$RCQ+$cSQ3$dDY3$dYc3$dZM3$eCM3$eYQ3$eZQ68u==$ef0=$fS43$fjM3$invalid stoi argument$stoi argument out of range
                                                                                                                                                                                                                                          • API String ID: 4234742559-994318480
                                                                                                                                                                                                                                          • Opcode ID: d5f8d1c94ca4e182f29d209acd9bf59200b2f487674c9c1a31c8b8850513682c
                                                                                                                                                                                                                                          • Instruction ID: 74bd56683a8b1dc0034b0bf6c4c314b8936764975bfda42dcc9a037cb622337e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d5f8d1c94ca4e182f29d209acd9bf59200b2f487674c9c1a31c8b8850513682c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4352F671A003889BDF14EF79CC4E7DDBBB5AF45300F64819CE444A7282D7799B849BA2
                                                                                                                                                                                                                                          Function 00FE3F30 Relevance: 48.0, APIs: 5, Strings: 21, Instructions: 2513COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00FE71E0: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00FE72CC
                                                                                                                                                                                                                                            • Part of subcall function 00FE71E0: __Cnd_destroy_in_situ.LIBCPMT ref: 00FE72D8
                                                                                                                                                                                                                                            • Part of subcall function 00FE71E0: __Mtx_destroy_in_situ.LIBCPMT ref: 00FE72E1
                                                                                                                                                                                                                                            • Part of subcall function 00FDB670: InternetOpenW.WININET(01028D34,00000000,00000000,00000000,00000000), ref: 00FDB6FC
                                                                                                                                                                                                                                            • Part of subcall function 00FDB670: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00FDB720
                                                                                                                                                                                                                                            • Part of subcall function 00FDB670: HttpOpenRequestA.WININET(?,00000000), ref: 00FDB76A
                                                                                                                                                                                                                                          • std::_Xinvalid_argument.LIBCPMT ref: 00FE4712
                                                                                                                                                                                                                                          • IsUserAnAdmin.SHELL32 ref: 00FE4897
                                                                                                                                                                                                                                          • GetUserNameA.ADVAPI32(?,?), ref: 00FE4922
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: InternetOpenUser$AdminCnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situNameRequestXinvalid_argumentstd::_
                                                                                                                                                                                                                                          • String ID: 0TI3$0TY3$0ik3$1C03$246122658369$3c5ff2$Ks==$Py4vHy==$RCM+$RCQ+$cSQ3$dDY3$dYc3$dZM3$eCM3$eYQ3$eZQ68u==$ef0=$fS43$fjM3$stoi argument out of range
                                                                                                                                                                                                                                          • API String ID: 306990891-3557771482
                                                                                                                                                                                                                                          • Opcode ID: 4170da86fbbceab8df22b309640a3e12e3ed2bbcccc2787bbd6a431caf926e75
                                                                                                                                                                                                                                          • Instruction ID: 989ca22ab94e4521935599d32fda6ad4834397bc6e1f7d18db5f788bebbda965
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4170da86fbbceab8df22b309640a3e12e3ed2bbcccc2787bbd6a431caf926e75
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AA232671D002988BDB29DB29CD8979DBB76AB81304F5481DCE048AB2C2DB795FC4DF91
                                                                                                                                                                                                                                          Function 00FDB230 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 130COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1321 fdb230-fdb29f call fe7cf0 CoInitialize 1324 fdb2c7 1321->1324 1325 fdb2a1-fdb2bb 1321->1325 1326 fdb2c9-fdb2cf 1324->1326 1334 fdb347-fdb361 1325->1334 1335 fdb2c1 7712D120 1325->1335 1327 fdb2d1-fdb2e3 1326->1327 1328 fdb303-fdb31d 1326->1328 1330 fdb2f9-fdb300 call fece48 1327->1330 1331 fdb2e5-fdb2f3 1327->1331 1332 fdb3ae-fdb3c9 call fec7d1 1328->1332 1333 fdb323-fdb32f 1328->1333 1330->1328 1331->1330 1336 fdb3ca-fdb3cf call 100644a 1331->1336 1338 fdb3a4-fdb3ab call fece48 1333->1338 1339 fdb331-fdb33f 1333->1339 1334->1324 1349 fdb367-fdb36c 1334->1349 1335->1324 1338->1332 1339->1336 1343 fdb345 1339->1343 1343->1338 1349->1324 1350 fdb372-fdb37e 1349->1350 1352 fdb394-fdb39f 7712D120 1350->1352 1353 fdb380-fdb38f 7712D120 1350->1353 1352->1326 1353->1324
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: 7712D120$Initialize
                                                                                                                                                                                                                                          • String ID: WA9QQy==$cDRX8BqpMw==$cDRX8FO0MyY=
                                                                                                                                                                                                                                          • API String ID: 3088731647-1349885928
                                                                                                                                                                                                                                          • Opcode ID: 45ae01e435b23b4a9b5fbaf2f05e31d048d7d46aabf2aaf17bdddc7a9a47cb42
                                                                                                                                                                                                                                          • Instruction ID: 16f9821aa3e39b2e079ccac4d2fac2aa5ce214bde56fca281e6afb6a6cf69b3b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 45ae01e435b23b4a9b5fbaf2f05e31d048d7d46aabf2aaf17bdddc7a9a47cb42
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5941E232A00219DFDB14CF69CC89BAE7BBAEF49715F24811DF405EB284D735A944DB90
                                                                                                                                                                                                                                          Function 00FD7E50 Relevance: 7.7, APIs: 5, Instructions: 155libraryloaderCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1500 fd7e50-fd7ed1 call 10038d0 GetVersionExW 1503 fd7edd-fd7f05 call fe71e0 call fd5d40 1500->1503 1504 fd7ed3-fd7ed8 1500->1504 1512 fd7f09-fd7f2b call fe71e0 call fd5d40 1503->1512 1513 fd7f07 1503->1513 1505 fd801f-fd803b call fec7d1 1504->1505 1518 fd7f2d 1512->1518 1519 fd7f2f-fd7f48 GetModuleHandleA GetProcAddress 1512->1519 1513->1512 1518->1519 1520 fd7f79-fd7fa4 1519->1520 1521 fd7f4a-fd7f59 1519->1521 1522 fd7fa6-fd7fb5 1520->1522 1523 fd7fd1-fd7ff2 1520->1523 1524 fd7f6f-fd7f76 call fece48 1521->1524 1525 fd7f5b-fd7f69 1521->1525 1528 fd7fc7-fd7fce call fece48 1522->1528 1529 fd7fb7-fd7fc5 1522->1529 1530 fd7ff8 GetSystemInfo 1523->1530 1531 fd7ff4-fd7ff6 GetNativeSystemInfo 1523->1531 1524->1520 1525->1524 1526 fd803c-fd8041 call 100644a 1525->1526 1528->1523 1529->1526 1529->1528 1535 fd7ffe-fd8005 1530->1535 1531->1535 1535->1505 1538 fd8007-fd800f 1535->1538 1539 fd8018-fd801b 1538->1539 1540 fd8011-fd8016 1538->1540 1539->1505 1541 fd801d 1539->1541 1540->1505 1541->1505
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetVersionExW.KERNEL32(?), ref: 00FD7EC9
                                                                                                                                                                                                                                          • GetModuleHandleA.KERNEL32(00000000), ref: 00FD7F30
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000), ref: 00FD7F37
                                                                                                                                                                                                                                          • GetNativeSystemInfo.KERNELBASE(?), ref: 00FD7FF4
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressHandleInfoModuleNativeProcSystemVersion
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2167034304-0
                                                                                                                                                                                                                                          • Opcode ID: 57484eb61e3fd34f0a00a27dccef2972afa0ed01afdfd9f4807b92d883207485
                                                                                                                                                                                                                                          • Instruction ID: 27591c8a42b57fc43f55817fc37c4ad717a5470bbd7b2e230984627ad609cfcd
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 57484eb61e3fd34f0a00a27dccef2972afa0ed01afdfd9f4807b92d883207485
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 96512771D043089BEB24EF28CD497DDBB76EB45310F54429AF404AB3C1EB399A849B91
                                                                                                                                                                                                                                          Function 010066B1 Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1542 10066b1-10066e6 GetFileType 1543 10066ec-10066f7 1542->1543 1544 100679e-10067a1 1542->1544 1545 1006719-1006735 call 10038d0 GetFileInformationByHandle 1543->1545 1546 10066f9-100670a call 1006a27 1543->1546 1547 10067a3-10067a6 1544->1547 1548 10067ca-10067f2 1544->1548 1558 10067bb-10067c8 GetLastError call 1006cbd 1545->1558 1564 100673b-100677d call 1006979 call 1006821 * 3 1545->1564 1562 1006710-1006717 1546->1562 1563 10067b7-10067b9 1546->1563 1547->1548 1553 10067a8-10067aa 1547->1553 1549 10067f4-1006807 PeekNamedPipe 1548->1549 1550 100680f-1006811 1548->1550 1549->1550 1554 1006809-100680c 1549->1554 1555 1006812-1006820 call fec7d1 1550->1555 1553->1558 1559 10067ac-10067b1 call 1006cf3 1553->1559 1554->1550 1558->1563 1559->1563 1562->1545 1563->1555 1576 1006782-100679a call 1006946 1564->1576 1576->1550 1579 100679c 1576->1579 1579->1563
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 010066D3
                                                                                                                                                                                                                                          • GetFileInformationByHandle.KERNELBASE(?,?), ref: 0100672D
                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 010067BB
                                                                                                                                                                                                                                          • __dosmaperr.LIBCMT ref: 010067C2
                                                                                                                                                                                                                                          • PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 010067FF
                                                                                                                                                                                                                                            • Part of subcall function 01006A27: __dosmaperr.LIBCMT ref: 01006A5C
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1206951868-0
                                                                                                                                                                                                                                          • Opcode ID: 376f1de581a35a6a3845ad7ad2e6f78038b87904a43d0ab34a4f63346fc6b5c8
                                                                                                                                                                                                                                          • Instruction ID: d3d3c0745c6cc8e7558965924fe1db2a671a96d0a0162388ba49e899196161f8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 376f1de581a35a6a3845ad7ad2e6f78038b87904a43d0ab34a4f63346fc6b5c8
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1B416DB5900205ABEB25DFB5D8449AFBBFAFF88300F10452DF996D3690EB359914CB60
                                                                                                                                                                                                                                          Function 00FD5E90 Relevance: 4.6, APIs: 3, Instructions: 131registryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1580 fd5e90-fd5f15 call 10038d0 RegOpenKeyExA 1583 fd5f17-fd5f3b RegQueryValueExA 1580->1583 1584 fd5f41-fd5f64 RegCloseKey 1580->1584 1583->1584 1585 fd5f67-fd5f6c 1584->1585 1585->1585 1586 fd5f6e-fd5f85 call fe78a0 1585->1586 1589 fd5faf-fd5fc7 1586->1589 1590 fd5f87-fd5f93 1586->1590 1591 fd5fc9-fd5fd5 1589->1591 1592 fd5ff1-fd600c call fec7d1 1589->1592 1593 fd5fa5-fd5fac call fece48 1590->1593 1594 fd5f95-fd5fa3 1590->1594 1596 fd5fe7-fd5fee call fece48 1591->1596 1597 fd5fd7-fd5fe5 1591->1597 1593->1589 1594->1593 1599 fd600d-fd6012 call 100644a 1594->1599 1596->1592 1597->1596 1597->1599
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?), ref: 00FD5F0D
                                                                                                                                                                                                                                          • RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,?), ref: 00FD5F3B
                                                                                                                                                                                                                                          • RegCloseKey.KERNELBASE(?), ref: 00FD5F47
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseOpenQueryValue
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3677997916-0
                                                                                                                                                                                                                                          • Opcode ID: bb4e47082679d39b53ae71881df8e087e691203e592844c67fabacf9f71c5cdd
                                                                                                                                                                                                                                          • Instruction ID: ffef122dcd154847fdfa4350e39a3924a615a63cd96d79212150674f2e5e0f59
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bb4e47082679d39b53ae71881df8e087e691203e592844c67fabacf9f71c5cdd
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9141F4B15002089FEB24CF24CC45BED7BBAEB44704F14826DF5159B2C1DB799A84CB94
                                                                                                                                                                                                                                          Function 00FD6020 Relevance: 4.6, APIs: 3, Instructions: 108registryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1606 fd6020-fd605b RegOpenKeyExA 1607 fd605d-fd6081 RegSetValueExA 1606->1607 1608 fd6087-fd6096 RegCloseKey 1606->1608 1607->1608 1609 fd6098-fd60a4 1608->1609 1610 fd60c4-fd60dc 1608->1610 1611 fd60ba-fd60c1 call fece48 1609->1611 1612 fd60a6-fd60b4 1609->1612 1613 fd60de-fd60ea 1610->1613 1614 fd6106-fd611e 1610->1614 1611->1610 1612->1611 1617 fd6156-fd615b call 100644a 1612->1617 1619 fd60fc-fd6103 call fece48 1613->1619 1620 fd60ec-fd60fa 1613->1620 1615 fd6148-fd6155 call fec7d1 1614->1615 1616 fd6120-fd612c 1614->1616 1621 fd613e-fd6145 call fece48 1616->1621 1622 fd612e-fd613c 1616->1622 1619->1614 1620->1617 1620->1619 1621->1615 1622->1617 1622->1621
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,000F003F,?), ref: 00FD6053
                                                                                                                                                                                                                                          • RegSetValueExA.KERNELBASE(80000001,?,00000000,00000002,?,?), ref: 00FD6081
                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(80000001), ref: 00FD608A
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CloseOpenValue
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 779948276-0
                                                                                                                                                                                                                                          • Opcode ID: 6319ca7b57ba3acf495b980c19a5be82a1ac79098e26a2fecaecbe24fbbffd48
                                                                                                                                                                                                                                          • Instruction ID: ed99026679b0f113b7422450918bcd8345d638ea43add3a948d4536311831726
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6319ca7b57ba3acf495b980c19a5be82a1ac79098e26a2fecaecbe24fbbffd48
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E431AD71210248AFEB28CF28CD89BAD7B72EB45300F648218F80586396D73AD981DB90
                                                                                                                                                                                                                                          Function 00FD9050 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 229COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1632 fd9050-fd90c9 GetModuleFileNameA 1633 fd90d0-fd90d5 1632->1633 1633->1633 1634 fd90d7-fd9113 call fe78a0 call fe71e0 1633->1634 1639 fd926f-fd92c8 call fe8380 1634->1639 1640 fd9119 1634->1640 1646 fd92ce-fd930d call fe78a0 1639->1646 1647 fd93b0 call fe79e0 1639->1647 1641 fd9120-fd9147 call fe71e0 call fd5d40 1640->1641 1654 fd9149 1641->1654 1655 fd914b-fd9195 call fe8380 1641->1655 1656 fd930f-fd931e 1646->1656 1657 fd933e-fd9362 1646->1657 1653 fd93b5-fd93ba call 100644a 1647->1653 1654->1655 1655->1647 1672 fd919b-fd91d3 call fe78a0 1655->1672 1663 fd9334-fd933b call fece48 1656->1663 1664 fd9320-fd932e 1656->1664 1660 fd938f-fd93af call fec7d1 1657->1660 1661 fd9364-fd9373 1657->1661 1666 fd9385-fd938c call fece48 1661->1666 1667 fd9375-fd9383 1661->1667 1663->1657 1664->1653 1664->1663 1666->1660 1667->1653 1667->1666 1677 fd91d5-fd91e4 1672->1677 1678 fd9204-fd922f 1672->1678 1681 fd91fa-fd9201 call fece48 1677->1681 1682 fd91e6-fd91f4 1677->1682 1679 fd9231-fd9240 1678->1679 1680 fd9260-fd9269 1678->1680 1683 fd9256-fd925d call fece48 1679->1683 1684 fd9242-fd9250 1679->1684 1680->1639 1680->1641 1681->1678 1682->1653 1682->1681 1683->1680 1684->1653 1684->1683
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104,DA74349A,?,00000000), ref: 00FD909F
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileModuleName
                                                                                                                                                                                                                                          • String ID: Zw==
                                                                                                                                                                                                                                          • API String ID: 514040917-3872017056
                                                                                                                                                                                                                                          • Opcode ID: 31b48806f4edb6531da3ef70bf0f9bf800c32a38158a93dc099950eb67fcea5c
                                                                                                                                                                                                                                          • Instruction ID: d7603f0f97b9d38f8e80f92e4507c4ab9f50a129bd1cd425174392a7abeac310
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 31b48806f4edb6531da3ef70bf0f9bf800c32a38158a93dc099950eb67fcea5c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F091B131A042588BDB28DB28CC85BEDB7B6EB85300F1481E9E44DA7291DB759FC5DF90
                                                                                                                                                                                                                                          Function 01006549 Relevance: 3.1, APIs: 2, Instructions: 87COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1689 1006549-1006555 1690 1006574-1006598 call 10038d0 1689->1690 1691 1006557-1006573 call 1006ce0 call 1006cf3 call 100643a 1689->1691 1697 10065b6-10065d8 CreateFileW 1690->1697 1698 100659a-10065b4 call 1006ce0 call 1006cf3 call 100643a 1690->1698 1699 10065e8-10065ef call 1006627 1697->1699 1700 10065da-10065de call 10066b1 1697->1700 1720 1006622-1006626 1698->1720 1711 10065f0-10065f2 1699->1711 1707 10065e3-10065e6 1700->1707 1707->1711 1713 1006614-1006617 1711->1713 1714 10065f4-1006611 call 10038d0 1711->1714 1718 1006620 1713->1718 1719 1006619-100661a FindCloseChangeNotification 1713->1719 1714->1713 1718->1720 1719->1718
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 309d5b3496fac842eee228656c23ac8ead70716b41f8f8eed3f42dcd54e3e0e1
                                                                                                                                                                                                                                          • Instruction ID: cfa4121ff7c2e2d5ebe4d4104edf291db73fbb1463ac7df61c34437575df5cbf
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 309d5b3496fac842eee228656c23ac8ead70716b41f8f8eed3f42dcd54e3e0e1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8721B872900209BBFB136B689C45F9E776AEF42375F110251F9A42B1C0DB725A2587A1
                                                                                                                                                                                                                                          Function 01006821 Relevance: 3.1, APIs: 2, Instructions: 54timeCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 1722 1006821-1006837 1723 1006847-1006857 FileTimeToSystemTime 1722->1723 1724 1006839-100683d 1722->1724 1726 1006897-100689a 1723->1726 1727 1006859-100686b SystemTimeToTzSpecificLocalTime 1723->1727 1724->1723 1725 100683f-1006845 1724->1725 1728 100689c-10068a7 call fec7d1 1725->1728 1726->1728 1727->1726 1729 100686d-100688d call 10068a8 1727->1729 1733 1006892-1006895 1729->1733 1733->1728
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FileTimeToSystemTime.KERNEL32(?,?), ref: 0100684F
                                                                                                                                                                                                                                          • SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 01006863
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1707611234-0
                                                                                                                                                                                                                                          • Opcode ID: 2fe1fa7c223111417483c0cac488e48b6b7ac5b91eef32359d6553d9f6497645
                                                                                                                                                                                                                                          • Instruction ID: 230160f86cee56a7db2c76ea6892708dfa2114295da288774112243b8ea6edf1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2fe1fa7c223111417483c0cac488e48b6b7ac5b91eef32359d6553d9f6497645
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2811ECB290020DABEB11DEA5C984EDF7BBDAB08310F544266F552E2180EB35EB54CB71
                                                                                                                                                                                                                                          Function 0100649B Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _free
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 269201875-0
                                                                                                                                                                                                                                          • Opcode ID: 1cdc96e7160e44f32d9424163ae35ed7704e7a2fc8b5dc4ed42e26a7a63245f3
                                                                                                                                                                                                                                          • Instruction ID: ea1e3a2c95e8e11786715e9d5a10c4da87ee6a85cc3673aed3efab36c55db0cb
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1cdc96e7160e44f32d9424163ae35ed7704e7a2fc8b5dc4ed42e26a7a63245f3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2211C431D05219AFEF02AFA89C017EE7BF5AF00325F1081A6E894A71D0DF724A50CB80
                                                                                                                                                                                                                                          Function 0100A7BB Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RtlAllocateHeap.NTDLL(00000000,DA74349A,?), ref: 0100A7ED
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AllocateHeap
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1279760036-0
                                                                                                                                                                                                                                          • Opcode ID: c0577ab05d8dee0e3cd6f4bfb66b5734015eb1d26075150c670a066745e8f9ae
                                                                                                                                                                                                                                          • Instruction ID: 8174efc88387cca832f64312489a8fa21336a9f5c4fdaf2d74f984a46f0a3efb
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c0577ab05d8dee0e3cd6f4bfb66b5734015eb1d26075150c670a066745e8f9ae
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B9E06C31704716EBF67326695C00B9A7AA8BF415B0F158171ADCF971C1DB56C94182E1
                                                                                                                                                                                                                                          Function 00FE63F0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Sleep
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3472027048-0
                                                                                                                                                                                                                                          • Opcode ID: bff5d2606082d2c9e684edd412539a242d266976e54af2331a526dc85292d830
                                                                                                                                                                                                                                          • Instruction ID: 838a76d15aa480f742083a2ce95bbfc5612a6ef75c335215f5419a643ca57878
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bff5d2606082d2c9e684edd412539a242d266976e54af2331a526dc85292d830
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3FF0F431A00644A7C711BB6ADD0771EBB79EB42B60F90034DF8106B396DB3D2A0497D2

                                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                                          Function 01012918 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: __floor_pentium4
                                                                                                                                                                                                                                          • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                          • API String ID: 4168288129-2761157908
                                                                                                                                                                                                                                          • Opcode ID: a10400672f8ce7be4c6f73fb773145f606842ac25e34211418356cf448ad64d9
                                                                                                                                                                                                                                          • Instruction ID: bd4e6b2d74c1811cf779f7c77c8e5481b77ceee10566dea15a70d570eef69bf6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a10400672f8ce7be4c6f73fb773145f606842ac25e34211418356cf448ad64d9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 23C22871E046288FDB65CE28DD407EAB7F5FB48314F1441EAD98DAB244E779AE818F40
                                                                                                                                                                                                                                          Function 0100628E Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 01006386
                                                                                                                                                                                                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 01006390
                                                                                                                                                                                                                                          • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0100639D
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3906539128-0
                                                                                                                                                                                                                                          • Opcode ID: 12176c6f068e6ccb97877915479469851a3d9e306ebc2b5c0e0a432d876a90de
                                                                                                                                                                                                                                          • Instruction ID: b10b6fc6ca947d9e4d49606732118863687993db5a3cd39a10c737202ab66a46
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12176c6f068e6ccb97877915479469851a3d9e306ebc2b5c0e0a432d876a90de
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D331C5749013189BDB61DF28D888BCDBBB8FF18710F6041EAE55CA7290E7749B858F44
                                                                                                                                                                                                                                          Function 01012480 Relevance: 3.4, APIs: 2, Instructions: 450COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 0ace9fcb4f62d81112caa0248d520c372debca230bc35019f2ded4e7fce015b3
                                                                                                                                                                                                                                          • Instruction ID: ed9c5d70314f46f0c7ed48c346cf2a84920406a5321343c73c0db75911f72632
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0ace9fcb4f62d81112caa0248d520c372debca230bc35019f2ded4e7fce015b3
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7BF14E71E012199FDF14CFA8C8806AEBBF1FF88314F2582A9E955A7385D735A901CB90
                                                                                                                                                                                                                                          Function 01005D0B Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000000,?,01005D0A,?,?,00000000,?), ref: 01005D2D
                                                                                                                                                                                                                                          • TerminateProcess.KERNEL32(00000000,?,01005D0A,?,?,00000000,?), ref: 01005D34
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Process$CurrentTerminate
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2429186680-0
                                                                                                                                                                                                                                          • Opcode ID: 1483431dcd80b4352b4962bd3cb1ba51f0868e8fae199acfa4ffcdcbf16c0260
                                                                                                                                                                                                                                          • Instruction ID: faa7479ca1b2e0aa92eeed23c56530f60fbd276fa6ab745686b36b767c910704
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1483431dcd80b4352b4962bd3cb1ba51f0868e8fae199acfa4ffcdcbf16c0260
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3EE04631000248ABDF337F58CC4CA483B69FB21249F204816F9898A169CB3AD982CF80
                                                                                                                                                                                                                                          Function 010167C9 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,010167C4,?,?,00000008,?,?,0101564A,00000000), ref: 010169F6
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ExceptionRaise
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3997070919-0
                                                                                                                                                                                                                                          • Opcode ID: 252134e022e4491ad7e6efa0973de684a34ea682fc1694e36b9ef0196bdc3e7d
                                                                                                                                                                                                                                          • Instruction ID: 4b93983189b7c619f92cbaec115007498251cd447a3a30545f8d6d1b527b7667
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 252134e022e4491ad7e6efa0973de684a34ea682fc1694e36b9ef0196bdc3e7d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E3B15A326106058FE715CF1CC886AA47FE1FF45364F258698E9DACF2A5C37AE981CB40
                                                                                                                                                                                                                                          Function 01007633 Relevance: 1.5, Strings: 1, Instructions: 216COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                                          • API String ID: 0-4108050209
                                                                                                                                                                                                                                          • Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
                                                                                                                                                                                                                                          • Instruction ID: fe39ee942f5291f31b5f2f4cd23bab248970731cb7d70393101128300d5aec9b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DC519B7020064956FFBB8A3C8C947BE7BDAAB19244F04059ED6C7DB2C2DA1DBA44C753
                                                                                                                                                                                                                                          Function 0100ABF2 Relevance: 1.3, Strings: 1, Instructions: 23COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          • GetSystemTimePreciseAsFileTime, xrefs: 0100AC02
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: GetSystemTimePreciseAsFileTime
                                                                                                                                                                                                                                          • API String ID: 0-595813830
                                                                                                                                                                                                                                          • Opcode ID: 8cf51c8e3912d1501708a97fcaf1e2f76dc867e41f985d231af346e4e609d9c7
                                                                                                                                                                                                                                          • Instruction ID: 616f86b2ecb095870f56267b4f72ec1ee5d3abdf1b22f4ef507b8afbad14e835
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8cf51c8e3912d1501708a97fcaf1e2f76dc867e41f985d231af346e4e609d9c7
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C0E0CD32741334B3923129856C05E9ABE45D744971F054062FE846E245C57A451087D4
                                                                                                                                                                                                                                          Function 0104D250 Relevance: .2, Instructions: 191COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: a3e0410f3302f57e912645284ba463c8538b0a02ab0610b74b9739244c11c2a8
                                                                                                                                                                                                                                          • Instruction ID: 28592722a651ed7e041d470a9535d6f4fa3778159ac6e5399ed925c3b61232cc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a3e0410f3302f57e912645284ba463c8538b0a02ab0610b74b9739244c11c2a8
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BE618DB3F156254BF3544E38CC983626692DB95314F2F42788F4CAB7C5D97E6C0A9388
                                                                                                                                                                                                                                          Function 0101703B Relevance: .1, Instructions: 104COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 574b290d7c17d94565dc76b30bc2adec38c268e00180a3b1d4de9f9c9e05e326
                                                                                                                                                                                                                                          • Instruction ID: 2cd98c2daa61c8e53d5d47371f9a117df1300100a7c7b0ee192fbcd65067f9ba
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 574b290d7c17d94565dc76b30bc2adec38c268e00180a3b1d4de9f9c9e05e326
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1221B373F204395B7B0CC47E8C522BDB6E1C78C551745823AE8A6EA2C1D96CD917E2E4
                                                                                                                                                                                                                                          Function 01016F1B Relevance: .1, Instructions: 81COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 0c69a75099dfa8650b3cde177f71ea68028fe658cad86de8920dbbdfcab49094
                                                                                                                                                                                                                                          • Instruction ID: fa8db1d3c8812b4c10bbabc0cd878bb2791466377c57959fbf80b6f4c3a6d3f6
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0c69a75099dfa8650b3cde177f71ea68028fe658cad86de8920dbbdfcab49094
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4211A323F30C256A675C816D8C132BAA1D6EBD815034F533ED826E7284E8A4DE23D290
                                                                                                                                                                                                                                          Function 01018380 Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                                                                                                                                                                          • Instruction ID: 85a55fd126972d7770e7e360e79645743bcf37f7cedeed23802916068f282e10
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6D11387724404143E2888A6DD8B85BBABD5EBC522076CC3FBD2C14B76CCA2AE3419500
                                                                                                                                                                                                                                          Function 01009A72 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
                                                                                                                                                                                                                                          • Instruction ID: 1213d3c0586a98bc00f3da2f2f2434e584d140ca2197d77ed616af0a8d54ccb3
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8EE08C72A21228EBCB16DB8CC90498AF7ECFB4AA04F21409AF645D3181C270DF40C7D0
                                                                                                                                                                                                                                          Function 0100EAD0 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • ___free_lconv_mon.LIBCMT ref: 0100EB14
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E6CA
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E6DC
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E6EE
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E700
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E712
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E724
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E736
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E748
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E75A
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E76C
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E77E
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E790
                                                                                                                                                                                                                                            • Part of subcall function 0100E6AD: _free.LIBCMT ref: 0100E7A2
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100EB09
                                                                                                                                                                                                                                            • Part of subcall function 0100A565: HeapFree.KERNEL32(00000000,00000000,?,0100832E,?,?,?,010030DC,00000000,?,?,DA74349A,?,00FD23C3,?,?), ref: 0100A57B
                                                                                                                                                                                                                                            • Part of subcall function 0100A565: GetLastError.KERNEL32(00000000,?,0100832E,?,?,?,010030DC,00000000,?,?,DA74349A,?,00FD23C3,?,?,?), ref: 0100A58D
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100EB2B
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100EB40
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100EB4B
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100EB6D
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100EB80
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100EB8E
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100EB99
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100EBD1
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100EBD8
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100EBF5
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100EC0D
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 161543041-0
                                                                                                                                                                                                                                          • Opcode ID: 61b6a94f554c5cd098b041a8b0954905498f63019e9c5aefe07e21ffbce3e5a7
                                                                                                                                                                                                                                          • Instruction ID: 84a16bbab448db1f377fba9eb65b122dbf4a248cfdb1acd70e3faa9ea62a61c9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 61b6a94f554c5cd098b041a8b0954905498f63019e9c5aefe07e21ffbce3e5a7
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 14311B31604B05DEFB63AA38D844B9777E9BF50211F544869E5DAE71D0EB31E9408B20
                                                                                                                                                                                                                                          Function 01015202 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RtlDecodePointer.NTDLL(?), ref: 0101521B
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DecodePointer
                                                                                                                                                                                                                                          • String ID: acos$asin$exp$log$log10$pow$sqrt
                                                                                                                                                                                                                                          • API String ID: 3527080286-3064271455
                                                                                                                                                                                                                                          • Opcode ID: a4589b580943d2d58d68337e2e7ce427b13750422f10371a146437b17a03374d
                                                                                                                                                                                                                                          • Instruction ID: d4d260442128ce3135954539e65bcd9df5e29950f91efcaa1acbd16d37311ecd
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a4589b580943d2d58d68337e2e7ce427b13750422f10371a146437b17a03374d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4751667190061ACBEF148F6DED481ADBFB1FF9B204F158099E5C1AB25CCBB98625CB50
                                                                                                                                                                                                                                          Function 00FE0210 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 146COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: Ks==$Muso$invalid stoi argument$stoi argument out of range
                                                                                                                                                                                                                                          • API String ID: 0-412186370
                                                                                                                                                                                                                                          • Opcode ID: 301e22180d836d9f236249347f69a63736dd462b0a0041e90828be6347d4ff19
                                                                                                                                                                                                                                          • Instruction ID: 43d277ac3436528c2aeeaa92df384a37963a844cfb48dd67ced3ca7acac20adc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 301e22180d836d9f236249347f69a63736dd462b0a0041e90828be6347d4ff19
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 615107309042A9AFEB21DF15CC05BCEBBB5FF16304F1441D8E5492B282C7B81A84DFA2
                                                                                                                                                                                                                                          Function 00FD2DC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • __Mtx_unlock.LIBCPMT ref: 00FD2E5F
                                                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00FD2E7E
                                                                                                                                                                                                                                          • __Mtx_unlock.LIBCPMT ref: 00FD2ECC
                                                                                                                                                                                                                                          • __Cnd_broadcast.LIBCPMT ref: 00FD2EE3
                                                                                                                                                                                                                                            • Part of subcall function 00FEBE8C: mtx_do_lock.LIBCPMT ref: 00FEBE94
                                                                                                                                                                                                                                          • __Mtx_unlock.LIBCPMT ref: 00FD2FF5
                                                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00FD3032
                                                                                                                                                                                                                                          • __Mtx_unlock.LIBCPMT ref: 00FD309B
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Mtx_unlock$CurrentThread$Cnd_broadcastmtx_do_lock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2883768668-0
                                                                                                                                                                                                                                          • Opcode ID: 679c4f27871868b003cd9a8d0d72f3b9c949a4ba9f3b894190dc3e030188d650
                                                                                                                                                                                                                                          • Instruction ID: 58f609f41301091d0429b3964e77aeb5af4fc7f11d595d4b865d9721fb34597b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 679c4f27871868b003cd9a8d0d72f3b9c949a4ba9f3b894190dc3e030188d650
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3A1FE71E002459FDB20DF65C844B9ABBB9EF15324F08852AE915D7341EB38EA04EBD2
                                                                                                                                                                                                                                          Function 00FDD400 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 185COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: mtx_do_lock
                                                                                                                                                                                                                                          • String ID: list too long
                                                                                                                                                                                                                                          • API String ID: 1389037287-1124181908
                                                                                                                                                                                                                                          • Opcode ID: db55e680d427a7789fc67c048e4a3a52cd57085bb9a4e34fbe7ffa8ed18f8fdd
                                                                                                                                                                                                                                          • Instruction ID: 1a03f569110b3c82be81762cea6807dc094b5f3e09d57a5159dad1e6032482aa
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: db55e680d427a7789fc67c048e4a3a52cd57085bb9a4e34fbe7ffa8ed18f8fdd
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0D61B2B0D04358ABDB20DF64CC45B9AF7B8FF05314F1441AAF80CA7241EB79AA45DB91
                                                                                                                                                                                                                                          Function 01004020 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _ValidateLocalCookies.LIBCMT ref: 01004057
                                                                                                                                                                                                                                          • ___except_validate_context_record.LIBVCRUNTIME ref: 0100405F
                                                                                                                                                                                                                                          • _ValidateLocalCookies.LIBCMT ref: 010040E8
                                                                                                                                                                                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 01004113
                                                                                                                                                                                                                                          • _ValidateLocalCookies.LIBCMT ref: 01004168
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                                                          • String ID: csm
                                                                                                                                                                                                                                          • API String ID: 1170836740-1018135373
                                                                                                                                                                                                                                          • Opcode ID: 7b8372c3c53cd2c1e3dd648ba576c321e39ef007ad4078f913e4b045d3f32f9e
                                                                                                                                                                                                                                          • Instruction ID: 19539d1947d0a0e6b03ad7117f6f1d7101b2a1a048c2e1625c5b538b2ccf4875
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7b8372c3c53cd2c1e3dd648ba576c321e39ef007ad4078f913e4b045d3f32f9e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E151D734A002099FEF12DF68C880AEE7FF5BF55214F148095EA98DB392D732DA15CB94
                                                                                                                                                                                                                                          Function 0100A8ED Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                          • API String ID: 0-537541572
                                                                                                                                                                                                                                          • Opcode ID: a5afd02e59dfad5c7b84f8b6082dfd3fcceb056d276307d4b1afddabd26f1037
                                                                                                                                                                                                                                          • Instruction ID: 68f84256847adbdbfde9bb5201a6a8376ce42180403c87a0ebcbb5c9d999402c
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a5afd02e59dfad5c7b84f8b6082dfd3fcceb056d276307d4b1afddabd26f1037
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9121D579B05321EBFB338A6C9C44B6F7B989B05760F260165F9D6AB2D1D634D900C6F0
                                                                                                                                                                                                                                          Function 0100E84C Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 0100E814: _free.LIBCMT ref: 0100E839
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100E89A
                                                                                                                                                                                                                                            • Part of subcall function 0100A565: HeapFree.KERNEL32(00000000,00000000,?,0100832E,?,?,?,010030DC,00000000,?,?,DA74349A,?,00FD23C3,?,?), ref: 0100A57B
                                                                                                                                                                                                                                            • Part of subcall function 0100A565: GetLastError.KERNEL32(00000000,?,0100832E,?,?,?,010030DC,00000000,?,?,DA74349A,?,00FD23C3,?,?,?), ref: 0100A58D
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100E8A5
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100E8B0
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100E904
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100E90F
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100E91A
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100E925
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 776569668-0
                                                                                                                                                                                                                                          • Opcode ID: 2c0cd81dde5832f75f17083bdff0568922edb084d12c4a80e26750f4bcce964d
                                                                                                                                                                                                                                          • Instruction ID: ade3dbea2c65b785ef50df32e57e86bf26215bbf69abafe76775eec23e87a68f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2c0cd81dde5832f75f17083bdff0568922edb084d12c4a80e26750f4bcce964d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5D11CC71640B05EAF522B7B0CC45FCB779CAF14B01F808C55A2ED671D1EB65B6058761
                                                                                                                                                                                                                                          Function 0100F430 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetConsoleCP.KERNEL32(?,?,?), ref: 0100F478
                                                                                                                                                                                                                                          • __fassign.LIBCMT ref: 0100F657
                                                                                                                                                                                                                                          • __fassign.LIBCMT ref: 0100F674
                                                                                                                                                                                                                                          • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0100F6BC
                                                                                                                                                                                                                                          • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0100F6FC
                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0100F7A8
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileWrite__fassign$ConsoleErrorLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 4031098158-0
                                                                                                                                                                                                                                          • Opcode ID: 0f84f138c53e8b63505e970dab2d890fbc569ceed531e2734c240e5027b83424
                                                                                                                                                                                                                                          • Instruction ID: c1a86b2fc1a7206abf723510e0100c7c3e3976dee6ff8457735c63244041c4e5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0f84f138c53e8b63505e970dab2d890fbc569ceed531e2734c240e5027b83424
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9FD1C075D0025A9FEF26CFA8C8809EDBBB5FF49314F280159E999FB281D7319906CB50
                                                                                                                                                                                                                                          Function 00FD7510 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 307sleepCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00FD6E30: ShellExecuteA.SHELL32(00000000,00FD704D,?,?,00000000,00000000), ref: 00FD6EC4
                                                                                                                                                                                                                                          • Sleep.KERNEL32(000003E8), ref: 00FD75F9
                                                                                                                                                                                                                                          • SetCurrentDirectoryA.KERNEL32(00000000,DA74349A), ref: 00FD76A4
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CurrentDirectoryExecuteShellSleep
                                                                                                                                                                                                                                          • String ID: 0Y1h$Kc==$NYsd
                                                                                                                                                                                                                                          • API String ID: 1553058795-3330701492
                                                                                                                                                                                                                                          • Opcode ID: a73ce778ecf243e5dbe3794f63a42c852b40a1d450a6b3be67abeb10a8d0442e
                                                                                                                                                                                                                                          • Instruction ID: 4143e8f80b3dee58ba79f4c09e28eafef05b23db4559c4558b6ba4ce3a20a9d5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a73ce778ecf243e5dbe3794f63a42c852b40a1d450a6b3be67abeb10a8d0442e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 40A12471A143449BDB08FB78CD4AB9DBB63AB81314F24825DF4009F3C6EB399A4097D2
                                                                                                                                                                                                                                          Function 01006979 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _wcsrchr
                                                                                                                                                                                                                                          • String ID: .bat$.cmd$.com$.exe
                                                                                                                                                                                                                                          • API String ID: 1752292252-4019086052
                                                                                                                                                                                                                                          • Opcode ID: fcfd0cdee1bf714568e68524d15b9eb3c0fea6cd5bc05d9c2e843527c34acc12
                                                                                                                                                                                                                                          • Instruction ID: 8722337dd76800ba520b7cfbf733c2e062c0e68330bbbf7f2bed81201c5c7089
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fcfd0cdee1bf714568e68524d15b9eb3c0fea6cd5bc05d9c2e843527c34acc12
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B0012B37604326257A26705E9C016AB2BC99F92BB0F19402EEDD4FB2C0ED5AD8525590
                                                                                                                                                                                                                                          Function 01005D4D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,01005D42,00000000,?,01005D0A,?,?,00000000), ref: 01005D62
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 01005D75
                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(00000000,?,?,01005D42,00000000,?,01005D0A,?,?,00000000), ref: 01005D98
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                          • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                          • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                          • Opcode ID: 6d85d2aa8f519ea37624b68bdffb7d051273b907a6a9375baebe1a9fee744210
                                                                                                                                                                                                                                          • Instruction ID: 17b291a7a39fe5eff6412fc3545f8e75a4688682e54931f23d0dd26f7a46ef7e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6d85d2aa8f519ea37624b68bdffb7d051273b907a6a9375baebe1a9fee744210
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 80F08231500319FBEB329F95DD0DB9E7FA9EB00755F200196F581A1194CB798A01DF90
                                                                                                                                                                                                                                          Function 0100E7AB Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100E7C3
                                                                                                                                                                                                                                            • Part of subcall function 0100A565: HeapFree.KERNEL32(00000000,00000000,?,0100832E,?,?,?,010030DC,00000000,?,?,DA74349A,?,00FD23C3,?,?), ref: 0100A57B
                                                                                                                                                                                                                                            • Part of subcall function 0100A565: GetLastError.KERNEL32(00000000,?,0100832E,?,?,?,010030DC,00000000,?,?,DA74349A,?,00FD23C3,?,?,?), ref: 0100A58D
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100E7D5
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100E7E7
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100E7F9
                                                                                                                                                                                                                                          • _free.LIBCMT ref: 0100E80B
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 776569668-0
                                                                                                                                                                                                                                          • Opcode ID: d934af5f8f7a279774acc621a5044e39737670f923f02df3ac037e0f5c8d4828
                                                                                                                                                                                                                                          • Instruction ID: 4a160e5d32219200aaeefa1da4b395a753e0fdbb1a510a7c2e19b6134f1ea3dc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d934af5f8f7a279774acc621a5044e39737670f923f02df3ac037e0f5c8d4828
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 13F0FF32604701ABB676DA58E5C5C5677EDFB50B10BA40C45F1CCE7584DB36F9818750
                                                                                                                                                                                                                                          Function 00FD8600 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 367COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetTempPathA.KERNEL32(00000104,?,DA74349A,?,00000000), ref: 00FD8647
                                                                                                                                                                                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,DA74349A,00000000,?), ref: 00FD884A
                                                                                                                                                                                                                                          • SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,DA74349A,00000000), ref: 00FD89CA
                                                                                                                                                                                                                                            • Part of subcall function 00FE71E0: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00FE72CC
                                                                                                                                                                                                                                            • Part of subcall function 00FE71E0: __Cnd_destroy_in_situ.LIBCPMT ref: 00FE72D8
                                                                                                                                                                                                                                            • Part of subcall function 00FE71E0: __Mtx_destroy_in_situ.LIBCPMT ref: 00FE72E1
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Path$Folder$Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situTemp
                                                                                                                                                                                                                                          • String ID: Zw==
                                                                                                                                                                                                                                          • API String ID: 1772894803-3872017056
                                                                                                                                                                                                                                          • Opcode ID: fc421446fde6cd9320c5ae53e298aa35f71f75a9de458808899af9af46bb42a6
                                                                                                                                                                                                                                          • Instruction ID: d36616c8656c425f26719b2a5df0236ab8cbd59e7a9b6bb73d9c0476a4ee19be
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fc421446fde6cd9320c5ae53e298aa35f71f75a9de458808899af9af46bb42a6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5DD13371A002589BDB28DB28CC85BEDBBB6EB46710F1442DDE409A7381DB395F85CF91
                                                                                                                                                                                                                                          Function 00FE1710 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID: invalid stoi argument$stoi argument out of range
                                                                                                                                                                                                                                          • API String ID: 0-1606216832
                                                                                                                                                                                                                                          • Opcode ID: 83e168230d4aa1a39d0dbdcf77881ebf13a5b3e1ac3f1394f0807c902a137b7c
                                                                                                                                                                                                                                          • Instruction ID: 35854be1e6f4ae3f3c733692f2669b444f94ebcff1d27531068ebca5d0ebd057
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 83e168230d4aa1a39d0dbdcf77881ebf13a5b3e1ac3f1394f0807c902a137b7c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7A41D6309052A89FEF65DF1ACC557CD7BB5AF12704F1041D8E1882B282CBB95AC8DF92
                                                                                                                                                                                                                                          Function 0100C260 Relevance: 6.3, APIs: 4, Instructions: 320COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: _strrchr
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3213747228-0
                                                                                                                                                                                                                                          • Opcode ID: 2be3246e1f92ff9055cdda0d2c6c42c9db80f0564b8feef83651b155efb1fb25
                                                                                                                                                                                                                                          • Instruction ID: a6b3facb519e5d39cbe0073c20f6ff4ce9e176dd756d76378d41dfdadc13d1b4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2be3246e1f92ff9055cdda0d2c6c42c9db80f0564b8feef83651b155efb1fb25
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 01B147329002869FFB17CF68C9807FEBBE5EF55340F1582EAD8C59B281D6359A41CB61
                                                                                                                                                                                                                                          Function 00FEB352 Relevance: 6.1, APIs: 4, Instructions: 80COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Xtime_diff_to_millis2_xtime_get
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 531285432-0
                                                                                                                                                                                                                                          • Opcode ID: 65d17fefe98884be2d74d1617e4338f9141d32915288e050647c2e38583672fb
                                                                                                                                                                                                                                          • Instruction ID: b0a27934f15b3eefb8935a8ae39818d8996cfa6e71495d4c8d3f926daf4f7123
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 65d17fefe98884be2d74d1617e4338f9141d32915288e050647c2e38583672fb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 30215171E001599FDF10EFA5CC869BFBBB9EF08710F100056FA01A7291D7389D02ABA1
                                                                                                                                                                                                                                          Function 0100AF25 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetFullPathNameW.KERNEL32(?,?,?,00000000,?,00000000,?,010116A6,?,?,?,?,?,00000000), ref: 0100AF3B
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,010116A6,?,?,?,?,?,00000000), ref: 0100AF45
                                                                                                                                                                                                                                          • __dosmaperr.LIBCMT ref: 0100AF4C
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFullLastNamePath__dosmaperr
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2398240785-0
                                                                                                                                                                                                                                          • Opcode ID: 928bf5b71cce8d8e3205dd3b911b39f5e2c34642330d45b2b3a69277b9047aa9
                                                                                                                                                                                                                                          • Instruction ID: 0dfd4291874d512c9d2a14afbaaa0ad98326323283e604f0e84f827959b4dddf
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 928bf5b71cce8d8e3205dd3b911b39f5e2c34642330d45b2b3a69277b9047aa9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4F06271600616FBEB321FA6D808D6ABFA9FF442A0B004154F959C75E0DB36E82097D0
                                                                                                                                                                                                                                          Function 0100AEBC Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetFullPathNameW.KERNEL32(?,?,?,00000000,?,00000000,?,0101171B,?,?,?,?,00000000), ref: 0100AED2
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,0101171B,?,?,?,?,00000000), ref: 0100AEDC
                                                                                                                                                                                                                                          • __dosmaperr.LIBCMT ref: 0100AEE3
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFullLastNamePath__dosmaperr
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2398240785-0
                                                                                                                                                                                                                                          • Opcode ID: 91afd3e2c2b7458ae6153127ef957bd9b5d6aeb43ba7b3b3d3f2c247d5bbdc8d
                                                                                                                                                                                                                                          • Instruction ID: fc9e9edf07792ccee4974bef29db103101c1113268ae510b8699a3a935dd6c7f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 91afd3e2c2b7458ae6153127ef957bd9b5d6aeb43ba7b3b3d3f2c247d5bbdc8d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: ACF06231600216FBAB321FA6D808D6ABFA9FF442A0B104155F659C7590DB36E861D7E0
                                                                                                                                                                                                                                          Function 0101624F Relevance: 6.0, APIs: 4, Instructions: 29COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • WriteConsoleW.KERNEL32(?,?,?,00000000,?,?,0101493A,?,00000001,?,?,?,0100F805,?,?,?), ref: 01016266
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,0101493A,?,00000001,?,?,?,0100F805,?,?,?,?,?,?,0100FD59,?), ref: 01016272
                                                                                                                                                                                                                                            • Part of subcall function 01016238: CloseHandle.KERNEL32(FFFFFFFE,01016282,?,0101493A,?,00000001,?,?,?,0100F805,?,?,?,?,?), ref: 01016248
                                                                                                                                                                                                                                          • ___initconout.LIBCMT ref: 01016282
                                                                                                                                                                                                                                            • Part of subcall function 010161FA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,01016229,01014927,?,?,0100F805,?,?,?,?), ref: 0101620D
                                                                                                                                                                                                                                          • WriteConsoleW.KERNEL32(?,?,?,00000000,?,0101493A,?,00000001,?,?,?,0100F805,?,?,?,?), ref: 01016297
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2744216297-0
                                                                                                                                                                                                                                          • Opcode ID: 129e46fdb37daed2f0a9f930f4a83d1fdd3c34720fbfd2448ffc1057a6126786
                                                                                                                                                                                                                                          • Instruction ID: 996c9f177f161aa93a6ecb216e474890bc5c6071b21f24c40ec84fa99eea5dcd
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 129e46fdb37daed2f0a9f930f4a83d1fdd3c34720fbfd2448ffc1057a6126786
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5AF03036010265BBCFB21FA9DC04DCD3F66FB493B1F154151FA9985128C67BD8209B90
                                                                                                                                                                                                                                          Function 00FEC97E Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • SleepConditionVariableCS.KERNELBASE(?,00FEC91B,00000064), ref: 00FEC9A1
                                                                                                                                                                                                                                          • RtlLeaveCriticalSection.NTDLL(01035640), ref: 00FEC9AB
                                                                                                                                                                                                                                          • WaitForSingleObjectEx.KERNEL32(01036578,00000000,?,00FEC91B,00000064,?,76230F00,?,00FD716D,01036578), ref: 00FEC9BC
                                                                                                                                                                                                                                          • RtlEnterCriticalSection.NTDLL(01035640), ref: 00FEC9C3
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000002.00000002.4573587455.0000000000FD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00FD0000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4572545222.0000000000FD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4574918700.0000000001020000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4575052327.0000000001021000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576019683.0000000001030000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4576938361.0000000001032000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4577872105.0000000001037000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4578788591.000000000103D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4579372632.0000000001041000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4580224055.0000000001043000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001044000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011B9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011BF000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C3000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011C9000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.00000000011CD000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001235000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4581083323.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000002.00000002.4587577336.0000000001396000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_fd0000_explorta.jbxd
                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3269011525-0
                                                                                                                                                                                                                                          • Opcode ID: 95d9040a555a27fb25bdd638f8b06bf37db770bbd90cfbb26d5f2786f947c658
                                                                                                                                                                                                                                          • Instruction ID: b34f46d091ff2939b7a744c3e84a372134ec6ef022011aafb0730787641d779b
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 95d9040a555a27fb25bdd638f8b06bf37db770bbd90cfbb26d5f2786f947c658
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 55E01236642628ABC6311F92FC09A9E7F2CAF4D761B250015F6855B128C6665800ABD9

                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                          Function 05170B9D Relevance: .1, Instructions: 81COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 63597a5fbb8abf1e3cd72f0d4e3443557d2d888c11ed02bc9c25000f5beb13a0
                                                                                                                                                                                                                                          • Instruction ID: 4f9c3462f79d77c16f9b981920616bbee94490f58d0bc742aa009acaf3c3e18f
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 63597a5fbb8abf1e3cd72f0d4e3443557d2d888c11ed02bc9c25000f5beb13a0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5501B1EB199218BDB152C1892F18AF7A77EE1CA7303318867F406C6402D3990A8E2430
                                                                                                                                                                                                                                          Function 05170AC2 Relevance: .1, Instructions: 109COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: d2840fc236377db6ace0c443d4f9c40e961cb5ef060dbce44f57e7fd468bcebe
                                                                                                                                                                                                                                          • Instruction ID: 752cc0b303af6bbea63e564c0cc70fea846e7a2884048cbb8b156bdeb9079429
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d2840fc236377db6ace0c443d4f9c40e961cb5ef060dbce44f57e7fd468bcebe
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5E2126AF18D218BDB666C5585F9CEFA6B3EF6CA3347314862F403C7402D7840E499971
                                                                                                                                                                                                                                          Function 05170B59 Relevance: .1, Instructions: 108COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 045ad9bd6f3a72afc649de4f162c35f7de3853ff206da02a7a69cb03dd95036f
                                                                                                                                                                                                                                          • Instruction ID: da78e33119439609cc915bd6bdbee68a7a0ad595e3e4bb3d48abed7f908602e9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 045ad9bd6f3a72afc649de4f162c35f7de3853ff206da02a7a69cb03dd95036f
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5211C6AF18C3587DB252C1981F98EF66B7EE6CE7347314866F802C7402D3854E595971
                                                                                                                                                                                                                                          Function 05170AF3 Relevance: .1, Instructions: 106COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 777992b7370aee0d1e8fa1620df4766143842c67a311bbf9d6f4bbb77117af2b
                                                                                                                                                                                                                                          • Instruction ID: 12bd8d305210d61a6b21d223a09ce5cf4262840a6acb5b7404e9a9fa2389767a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 777992b7370aee0d1e8fa1620df4766143842c67a311bbf9d6f4bbb77117af2b
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B41123AF28C358BEB252C1982F9CAF66B2EE6CA3347314866F802C7402D3850E495571
                                                                                                                                                                                                                                          Function 05170AE4 Relevance: .1, Instructions: 106COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: fd4d6abea49fdb3d89893e6c707349f439373a53a4adb66b02b1436ead1ab128
                                                                                                                                                                                                                                          • Instruction ID: 10ae2dbcd17c865b0e7cb5bcc67cfd0adc0f1f097e8cf6b087d166f57740c713
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fd4d6abea49fdb3d89893e6c707349f439373a53a4adb66b02b1436ead1ab128
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 201106AF18D358BDB662C1581F9CEFA6B3EE6CA3347314866F807C7402D3840E995971
                                                                                                                                                                                                                                          Function 05170B3D Relevance: .1, Instructions: 102COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: f372519727290dc28d7a8cb3396beef557b2e069ac105558cca3dfe309b4b642
                                                                                                                                                                                                                                          • Instruction ID: a05908eeef189f3e52bf825d029a020bb0239ed2f6329793ee68fd01d09c5b89
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f372519727290dc28d7a8cb3396beef557b2e069ac105558cca3dfe309b4b642
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2A1127AF189318BEB212C5585B8CDF67B7EE5CA3307314876F402C7502D3914A495571
                                                                                                                                                                                                                                          Function 05170B10 Relevance: .1, Instructions: 97COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 862bce368a21a19a9c1c726b863d48325e96351816795ce2b71e50d82293594e
                                                                                                                                                                                                                                          • Instruction ID: 439245d3dd072363f1f5f273af3ec9d70c1388ec034640fb2b52ae76f1cbba38
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 862bce368a21a19a9c1c726b863d48325e96351816795ce2b71e50d82293594e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 771126EF18C318BEB252C5585F88EF67B3EE6CA7347314866F802C7402D3950E595931
                                                                                                                                                                                                                                          Function 05170B22 Relevance: .1, Instructions: 97COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: e80f7c6083bb95d7e4c3937037d8bfccf7a104ec4ead31a0c3edb6d6c0ba80c8
                                                                                                                                                                                                                                          • Instruction ID: c641dc4b455c4270edd253ed68742958c08c304b854876be9aebbe10a83e3539
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e80f7c6083bb95d7e4c3937037d8bfccf7a104ec4ead31a0c3edb6d6c0ba80c8
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 601103AF18C358BEF212C5581F9CAF66B3EE6CB33473148A6F402C7502D3850E899A71
                                                                                                                                                                                                                                          Function 05170B31 Relevance: .1, Instructions: 89COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 61a107f36b051281460fc72a70c9bfeade72d49dc6776235f338eef485c27535
                                                                                                                                                                                                                                          • Instruction ID: 3a3de738888a0beadb2b451ba191ba7e7a0b4e0d6908c2ab679714b98728d0b1
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 61a107f36b051281460fc72a70c9bfeade72d49dc6776235f338eef485c27535
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB1102AF18C218BEB252C5982F88AFA6B7EE5CB3347314876F802C7502D3850E895971
                                                                                                                                                                                                                                          Function 05170B66 Relevance: .1, Instructions: 88COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: d46a8836e44d76356424211c1c142a4714229b391c237d5df316f3bbfa7c57e5
                                                                                                                                                                                                                                          • Instruction ID: 428ec16ce5d27f3252807e26d1bd6bb410b94997a662a5066ab5c7dcdb303e2e
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d46a8836e44d76356424211c1c142a4714229b391c237d5df316f3bbfa7c57e5
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4D1102EB2882187EF21295946F88AF77B7EE6CA7307314876F802C7402D3950E8A5931
                                                                                                                                                                                                                                          Function 05170BAC Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 941eb406856b08e55dcf2c89177551c2709b811ad4bdf68adc8fb666bd114bb6
                                                                                                                                                                                                                                          • Instruction ID: 89e98e445aa0688bee585e2b032de321585116fd1472fd4d8304603ddc9c9df2
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 941eb406856b08e55dcf2c89177551c2709b811ad4bdf68adc8fb666bd114bb6
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 49F04CFB1582257EB31285595F989FBB7BEF6CA730731487AF402C7401C35549D96930
                                                                                                                                                                                                                                          Function 05170BE2 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 13406540b20e6a9590858fcfe7a20ea31ac50803a4cf7655718280f6f6f47a53
                                                                                                                                                                                                                                          • Instruction ID: 0362f33351c0ce601ce009fd935b10a51cada400ea682e0d30eb55b3f3602972
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 13406540b20e6a9590858fcfe7a20ea31ac50803a4cf7655718280f6f6f47a53
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BEE026A301870C9EE322931C4A8C6BA7AB6F64DB307220E957006C7900C3254C894D10
                                                                                                                                                                                                                                          Function 05170BE7 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: c44711978616352974e949b199bcae0b6802da1d8ce11337f8f96f74d36b7bb4
                                                                                                                                                                                                                                          • Instruction ID: 0bc14f0b3733b2beaab517f3c430d6e945d96b5bdb2b628f8b71dd57728ba391
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c44711978616352974e949b199bcae0b6802da1d8ce11337f8f96f74d36b7bb4
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 89E07DA3028709AEF3679B0C4A4C2BA7779FB0D7247250D857042C7402C7280C954E60
                                                                                                                                                                                                                                          Function 05170C12 Relevance: .0, Instructions: 20COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 9053f5dfa842fb5faa1b5f81002c126653d32d98b0f1017c7d6b5f92efe0f2b2
                                                                                                                                                                                                                                          • Instruction ID: 1ff803d7b7d6f30a9900d0575f45e8d570a3560795320f76e06ec227f66bdc85
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9053f5dfa842fb5faa1b5f81002c126653d32d98b0f1017c7d6b5f92efe0f2b2
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A9D0A7A6128A068B91269328EE7E2DA6764F70C7147114EA1A10EDB183CB3884464640
                                                                                                                                                                                                                                          Function 05170C04 Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: 29ea180b17e3609f93b03d7a8c966f800859e6b6ad54be6fbf85b557db32d270
                                                                                                                                                                                                                                          • Instruction ID: 0608167749c53cdceae5b84b003af212c3fa35898c62104acebcd940cc6ec179
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 29ea180b17e3609f93b03d7a8c966f800859e6b6ad54be6fbf85b557db32d270
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3D0A76712860A89E2269758875C3A57771FB0D7247210DD29146CB401DF3844955900
                                                                                                                                                                                                                                          Function 05170C29 Relevance: .0, Instructions: 10COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000006.00000002.2241229448.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_6_2_5170000_amert.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                          • Opcode ID: c9735e5ac46289fa2a706bb4ed744dd5d8da7fae494a5594a1b2d0be525b8883
                                                                                                                                                                                                                                          • Instruction ID: 4069987adfef74faa78d9091f33d7f24b6f14efd79e0b7967814267993eedce4
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c9735e5ac46289fa2a706bb4ed744dd5d8da7fae494a5594a1b2d0be525b8883
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BAC02B73630B0B55912237A84C5F1293FA4F50C9213110ED27001CF003DB2CC4845680

                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                          Execution Coverage:23.7%
                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                                                                                          Signature Coverage:4.9%
                                                                                                                                                                                                                                          Total number of Nodes:2000
                                                                                                                                                                                                                                          Total number of Limit Nodes:63
                                                                                                                                                                                                                                          execution_graph 46915 179950 46916 179978 std::ios_base::_Ios_base_dtor 46915->46916 46917 179968 46915->46917 46917->46916 46918 198c70 std::_Throw_Cpp_error 40 API calls 46917->46918 46919 17998d 46918->46919 46920 179a4f 46919->46920 46927 192b74 46919->46927 46924 1799dd 46936 17c430 76 API calls 4 library calls 46924->46936 46926 179a04 46928 192af7 46927->46928 46930 1799cc 46928->46930 46937 199815 46928->46937 46930->46920 46935 1783b0 40 API calls 46930->46935 46934 19d0a8 78 API calls 46934->46930 46935->46924 46936->46926 46939 19975e __fread_nolock 46937->46939 46938 199771 46960 1a16ff 14 API calls __dosmaperr 46938->46960 46939->46938 46941 199791 46939->46941 46943 1997a3 46941->46943 46944 199796 46941->46944 46942 199776 46961 198c60 40 API calls __fread_nolock 46942->46961 46947 1aa8ef 17 API calls 46943->46947 46962 1a16ff 14 API calls __dosmaperr 46944->46962 46949 1997ac 46947->46949 46948 192b43 46948->46930 46954 19d5f6 46948->46954 46950 1997c0 46949->46950 46951 1997b3 46949->46951 46964 1997fe RtlLeaveCriticalSection __fread_nolock 46950->46964 46963 1a16ff 14 API calls __dosmaperr 46951->46963 46955 19d609 __fread_nolock 46954->46955 46965 19d34d 46955->46965 46958 19899c __fread_nolock 40 API calls 46959 192b5e 46958->46959 46959->46930 46959->46934 46960->46942 46961->46948 46962->46948 46963->46948 46964->46948 46967 19d359 __fread_nolock 46965->46967 46966 19d35f 46986 198be3 40 API calls 2 library calls 46966->46986 46967->46966 46970 19d3a2 46967->46970 46969 19d37a 46969->46958 46976 1a1250 RtlEnterCriticalSection 46970->46976 46972 19d3ae 46977 19d4d0 46972->46977 46974 19d3c4 46987 19d3ed RtlLeaveCriticalSection __fread_nolock 46974->46987 46976->46972 46978 19d4e3 46977->46978 46979 19d4f6 46977->46979 46978->46974 46988 19d3f7 46979->46988 46981 19d5a7 46981->46974 46982 19d519 46982->46981 46983 199a91 73 API calls 46982->46983 46984 19d547 46983->46984 46985 1a263d 42 API calls 46984->46985 46985->46981 46986->46969 46987->46969 46989 19d408 46988->46989 46991 19d460 46988->46991 46989->46991 46992 1a25fd 42 API calls __fread_nolock 46989->46992 46991->46982 46992->46991 46993 1bdc50 46994 1bdc9d 46993->46994 46995 1bdd82 46993->46995 46996 17ab20 42 API calls 46994->46996 47009 17ab20 46995->47009 46999 1bdcf9 46996->46999 47078 17b980 42 API calls 46999->47078 47000 1763b0 std::_Throw_Cpp_error 42 API calls 47002 1bde08 47000->47002 47014 1e1b90 47002->47014 47003 1bdd50 47079 245f70 26 API calls ___std_exception_copy 47003->47079 47005 1bde15 47007 1bdd70 47080 1788d0 47007->47080 47011 17ab55 47009->47011 47010 17aba3 47011->47010 47085 17e8a0 47011->47085 47013 17ab83 47013->47000 47089 246c20 47014->47089 47016 1e43bc 47016->47005 47017 1e441d 47018 162cf0 std::_Throw_Cpp_error 42 API calls 47017->47018 47019 1e442d 47018->47019 47022 1e4518 47023 162cf0 std::_Throw_Cpp_error 42 API calls 47022->47023 47025 1e4528 47023->47025 47212 167b10 42 API calls 3 library calls 47025->47212 47026 1e445c 47028 198c70 std::_Throw_Cpp_error 40 API calls 47026->47028 47031 1e4461 47028->47031 47029 1e43de 47032 162cf0 std::_Throw_Cpp_error 42 API calls 47029->47032 47179 162b50 42 API calls 2 library calls 47031->47179 47035 1e43ee 47032->47035 47037 1e4466 47180 163330 42 API calls 47037->47180 47042 1e446b 47044 162cf0 std::_Throw_Cpp_error 42 API calls 47042->47044 47043 17af80 42 API calls 47063 1e1bec __fread_nolock std::locale::_Locimp::_Locimp 47043->47063 47046 1e4483 47044->47046 47045 17b0e0 42 API calls 47045->47063 47050 1e44c4 47055 162cf0 std::_Throw_Cpp_error 42 API calls 47050->47055 47056 1e44d7 47055->47056 47057 17ace0 42 API calls 47056->47057 47062 246450 45 API calls 47062->47063 47063->47016 47063->47017 47063->47022 47063->47026 47063->47029 47063->47031 47063->47037 47063->47042 47063->47043 47063->47045 47063->47050 47063->47062 47064 1e2713 SHGetFolderPathA 47063->47064 47065 1e2a15 SHGetFolderPathA 47063->47065 47066 1e2d13 SHGetFolderPathA 47063->47066 47067 1e3073 SHGetFolderPathA 47063->47067 47068 1e339b SHGetFolderPathA 47063->47068 47069 162fe0 40 API calls std::_Throw_Cpp_error 47063->47069 47070 1e36a5 SHGetFolderPathA 47063->47070 47071 1632d0 42 API calls std::_Throw_Cpp_error 47063->47071 47073 193672 42 API calls std::_Facet_Register 47063->47073 47074 178b00 42 API calls 47063->47074 47075 1785d0 78 API calls 47063->47075 47076 163040 42 API calls std::_Throw_Cpp_error 47063->47076 47077 1763b0 42 API calls std::_Throw_Cpp_error 47063->47077 47104 1a12b7 50 API calls __fread_nolock 47063->47104 47105 1e4560 47063->47105 47176 176130 42 API calls 2 library calls 47063->47176 47064->47063 47065->47063 47066->47063 47067->47063 47068->47063 47069->47063 47070->47063 47071->47063 47073->47063 47074->47063 47075->47063 47076->47063 47077->47063 47078->47003 47079->47007 47081 1788f3 47080->47081 47082 178914 std::ios_base::_Ios_base_dtor 47080->47082 47081->47082 47083 198c70 std::_Throw_Cpp_error 40 API calls 47081->47083 47082->46995 47084 178947 47083->47084 47086 17e8ce 47085->47086 47088 17e8f8 std::locale::_Locimp::_Locimp 47085->47088 47087 1632d0 std::_Throw_Cpp_error 42 API calls 47086->47087 47087->47088 47088->47013 47213 192b99 47089->47213 47092 246c57 47095 246cd4 47092->47095 47096 246c63 47092->47096 47093 246ccd 47216 192534 47093->47216 47097 192534 std::_Throw_Cpp_error 78 API calls 47095->47097 47100 246c7b GetFileAttributesA 47096->47100 47103 246c92 47096->47103 47098 246ce5 47097->47098 47099 192baa RtlReleaseSRWLockExclusive 47101 246cb8 47099->47101 47102 246c87 GetLastError 47100->47102 47100->47103 47101->47063 47102->47103 47103->47099 47104->47063 47106 1e5ce4 47105->47106 47107 1e45c1 47105->47107 47460 1939b3 RtlAcquireSRWLockExclusive RtlReleaseSRWLockExclusive SleepConditionVariableSRW 47106->47460 47109 246c20 88 API calls 47107->47109 47110 1e5d5a 47107->47110 47113 1e45d1 47109->47113 47176->47063 47179->47037 47224 192bc8 GetCurrentThreadId 47213->47224 47217 19254a std::_Throw_Cpp_error 47216->47217 47248 1924e7 47217->47248 47225 192c11 47224->47225 47226 192bf2 47224->47226 47228 192c1a 47225->47228 47229 192c31 47225->47229 47227 192bf7 RtlAcquireSRWLockExclusive 47226->47227 47235 192c07 47226->47235 47227->47235 47230 192c25 RtlAcquireSRWLockExclusive 47228->47230 47228->47235 47231 192c90 47229->47231 47238 192c49 47229->47238 47230->47235 47233 192c97 RtlTryAcquireSRWLockExclusive 47231->47233 47231->47235 47233->47235 47234 192ba6 47234->47092 47234->47093 47239 193d77 47235->47239 47237 192c80 RtlTryAcquireSRWLockExclusive 47237->47235 47237->47238 47238->47235 47238->47237 47246 19302b GetSystemTimePreciseAsFileTime GetSystemTimeAsFileTime __aulldiv __aullrem __Xtime_get_ticks 47238->47246 47240 193d7f 47239->47240 47241 193d80 IsProcessorFeaturePresent 47239->47241 47240->47234 47243 19455a 47241->47243 47247 19451d SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 47243->47247 47245 19463d 47245->47234 47246->47238 47247->47245 47249 1924f3 __EH_prolog3_GS 47248->47249 47250 162cf0 std::_Throw_Cpp_error 42 API calls 47249->47250 47251 192507 47250->47251 47269 1636e0 47251->47269 47270 1763b0 std::_Throw_Cpp_error 42 API calls 47269->47270 47460->47107 47479 1c1d90 47480 1c1de0 47479->47480 47481 17ab20 42 API calls 47480->47481 47482 1c1eb4 47481->47482 47483 246c20 88 API calls 47482->47483 47484 1c1eda 47483->47484 47486 1c1efd 47484->47486 47537 246b90 47484->47537 47489 1c293e 47486->47489 47491 1c2910 47486->47491 47549 17b260 47486->47549 47488 2466f0 95 API calls 47488->47489 47490 17ab20 42 API calls 47489->47490 47492 1c2a23 47490->47492 47491->47488 47491->47489 47493 246c20 88 API calls 47492->47493 47494 1c2a49 47493->47494 47495 246b90 87 API calls 47494->47495 47496 1c2a6c 47494->47496 47495->47496 47497 17b260 42 API calls 47496->47497 47500 1c34a9 47496->47500 47501 1c347f 47496->47501 47535 1c2a9c 47497->47535 47498 1730f0 42 API calls 47532 1c1f2d 47498->47532 47499 2466f0 95 API calls 47499->47500 47501->47499 47501->47500 47502 17b260 42 API calls 47502->47532 47503 173200 42 API calls 47503->47535 47504 1763b0 42 API calls std::_Throw_Cpp_error 47504->47532 47505 17b260 42 API calls 47505->47535 47507 17ac50 42 API calls 47507->47532 47508 1763b0 42 API calls std::_Throw_Cpp_error 47508->47535 47509 246c20 88 API calls 47509->47532 47510 199820 42 API calls 47510->47532 47511 246b90 87 API calls 47511->47532 47514 246c20 88 API calls 47514->47535 47516 176240 42 API calls 47516->47532 47517 17ac50 42 API calls 47517->47535 47518 19d0a8 78 API calls 47518->47532 47519 173200 42 API calls 47519->47532 47520 199820 42 API calls 47520->47535 47521 246b90 87 API calls 47521->47535 47522 17ae20 42 API calls 47522->47535 47523 162cf0 42 API calls std::_Throw_Cpp_error 47523->47532 47524 17abb0 42 API calls 47524->47535 47525 176240 42 API calls 47525->47535 47526 1730f0 42 API calls 47526->47535 47527 19d0a8 78 API calls 47527->47535 47528 162cf0 42 API calls std::_Throw_Cpp_error 47528->47535 47529 17b400 42 API calls 47529->47532 47530 17af80 42 API calls 47530->47532 47532->47491 47532->47498 47532->47502 47532->47504 47532->47507 47532->47509 47532->47510 47532->47511 47532->47516 47532->47518 47532->47519 47532->47523 47532->47529 47532->47530 47566 176210 42 API calls std::_Throw_Cpp_error 47532->47566 47567 17ae20 47532->47567 47570 17abb0 47532->47570 47574 163350 47532->47574 47533 17af80 42 API calls 47533->47535 47534 163350 78 API calls 47534->47535 47535->47501 47535->47503 47535->47505 47535->47508 47535->47514 47535->47517 47535->47520 47535->47521 47535->47522 47535->47524 47535->47525 47535->47526 47535->47527 47535->47528 47535->47533 47535->47534 47536 17b400 42 API calls 47535->47536 47578 176210 42 API calls std::_Throw_Cpp_error 47535->47578 47536->47535 47538 192b99 12 API calls 47537->47538 47539 246bbd 47538->47539 47540 246bc4 47539->47540 47541 246c02 47539->47541 47543 246bd0 CreateDirectoryA 47540->47543 47544 246c09 47540->47544 47542 192534 std::_Throw_Cpp_error 78 API calls 47541->47542 47542->47544 47545 192baa RtlReleaseSRWLockExclusive 47543->47545 47546 192534 std::_Throw_Cpp_error 78 API calls 47544->47546 47547 246bee 47545->47547 47548 246c1a 47546->47548 47547->47486 47550 193672 std::_Facet_Register 42 API calls 47549->47550 47551 17b2b8 47550->47551 47552 17b3b4 47551->47552 47553 17b2e2 47551->47553 47556 162cf0 std::_Throw_Cpp_error 42 API calls 47552->47556 47554 193672 std::_Facet_Register 42 API calls 47553->47554 47555 17b2f7 47554->47555 47579 18e7e0 47555->47579 47557 17b3c4 47556->47557 47558 17ace0 42 API calls 47557->47558 47560 17b3d9 47558->47560 47561 167cf0 42 API calls 47560->47561 47562 17b3ee 47561->47562 47563 1951fb Concurrency::cancel_current_task RaiseException 47562->47563 47565 17b3ff 47563->47565 47564 17b33b std::ios_base::_Ios_base_dtor 47564->47532 47566->47532 47660 17e710 47567->47660 47569 17ae54 47569->47532 47571 17abe1 47570->47571 47571->47571 47572 178f00 std::_Throw_Cpp_error 42 API calls 47571->47572 47573 17abf6 47572->47573 47573->47532 47575 163367 47574->47575 47665 1a0d33 47575->47665 47578->47535 47580 18e9ff 47579->47580 47586 18e82a 47579->47586 47580->47564 47582 1763b0 42 API calls std::_Throw_Cpp_error 47582->47586 47583 18ea1a 47621 167260 42 API calls 47583->47621 47584 193672 std::_Facet_Register 42 API calls 47584->47586 47586->47580 47586->47582 47586->47583 47586->47584 47588 173d50 47586->47588 47587 18ea1f 47587->47564 47589 173d8f 47588->47589 47620 173df7 std::locale::_Locimp::_Locimp 47588->47620 47590 173d96 47589->47590 47591 173f1e 47589->47591 47592 173f7d 47589->47592 47593 173e69 47589->47593 47589->47620 47596 193672 std::_Facet_Register 42 API calls 47590->47596 47651 177e80 47591->47651 47597 193672 std::_Facet_Register 42 API calls 47592->47597 47595 193672 std::_Facet_Register 42 API calls 47593->47595 47598 173e73 47595->47598 47599 173da0 47596->47599 47600 173f8a 47597->47600 47598->47620 47634 18bf30 47598->47634 47601 193672 std::_Facet_Register 42 API calls 47599->47601 47604 173fd3 47600->47604 47605 17408e 47600->47605 47600->47620 47603 173dd2 47601->47603 47622 18f460 47603->47622 47606 174004 47604->47606 47607 173fdb 47604->47607 47656 163330 42 API calls 47605->47656 47612 193672 std::_Facet_Register 42 API calls 47606->47612 47610 174093 47607->47610 47611 173fe6 47607->47611 47657 162b50 42 API calls 2 library calls 47610->47657 47614 193672 std::_Facet_Register 42 API calls 47611->47614 47612->47620 47617 173fec 47614->47617 47615 173eb1 47616 173d50 42 API calls 47615->47616 47615->47620 47616->47615 47618 198c70 std::_Throw_Cpp_error 40 API calls 47617->47618 47617->47620 47619 17409d 47618->47619 47620->47586 47621->47587 47623 18f498 47622->47623 47624 18f53f 47622->47624 47625 193672 std::_Facet_Register 42 API calls 47623->47625 47624->47620 47626 18f4ba 47625->47626 47627 1763b0 std::_Throw_Cpp_error 42 API calls 47626->47627 47628 18f4d0 47627->47628 47635 18bfab 47634->47635 47636 18bf42 47634->47636 47658 163330 42 API calls 47635->47658 47638 18bf7c 47636->47638 47639 18bf4d 47636->47639 47640 18bf99 47638->47640 47644 193672 std::_Facet_Register 42 API calls 47638->47644 47641 18bfb0 47639->47641 47642 18bf54 47639->47642 47640->47615 47659 162b50 42 API calls 2 library calls 47641->47659 47643 193672 std::_Facet_Register 42 API calls 47642->47643 47646 18bf5a 47643->47646 47647 18bf86 47644->47647 47648 18bf63 47646->47648 47649 198c70 std::_Throw_Cpp_error 40 API calls 47646->47649 47647->47615 47648->47615 47650 18bfba 47649->47650 47652 193672 std::_Facet_Register 42 API calls 47651->47652 47653 177ea6 47652->47653 47654 1763b0 std::_Throw_Cpp_error 42 API calls 47653->47654 47655 177ec5 47654->47655 47655->47620 47657->47617 47659->47646 47661 17e753 47660->47661 47662 1632d0 std::_Throw_Cpp_error 42 API calls 47661->47662 47663 17e758 std::locale::_Locimp::_Locimp 47661->47663 47664 17e843 std::locale::_Locimp::_Locimp 47662->47664 47663->47569 47664->47569 47666 1a0d47 __fread_nolock 47665->47666 47667 1a0d69 47666->47667 47669 1a0d90 47666->47669 47682 198be3 40 API calls 2 library calls 47667->47682 47674 19e396 47669->47674 47670 1a0d84 47672 19899c __fread_nolock 40 API calls 47670->47672 47673 163371 47672->47673 47673->47532 47675 19e3a2 __fread_nolock 47674->47675 47683 1a1250 RtlEnterCriticalSection 47675->47683 47677 19e3b0 47684 19f2cb 47677->47684 47682->47670 47683->47677 47685 1ac8aa 41 API calls 47684->47685 47830 1be0c0 47878 16b8e0 47830->47878 47832 1be121 47833 17ab20 42 API calls 47832->47833 47834 1be198 CreateDirectoryA 47833->47834 47836 1be85e 47834->47836 47857 1be1cc 47834->47857 47835 1be825 47837 1763b0 std::_Throw_Cpp_error 42 API calls 47835->47837 47838 17ab20 42 API calls 47836->47838 47840 1bf0db 47836->47840 47839 1be839 47837->47839 47841 1be8e2 CreateDirectoryA 47838->47841 48354 23efb0 47839->48354 47841->47840 47856 1be910 47841->47856 47843 1be849 47843->47836 47845 2466f0 95 API calls 47843->47845 47844 1bf09f 47846 1763b0 std::_Throw_Cpp_error 42 API calls 47844->47846 47845->47836 47847 1bf0b6 47846->47847 48436 237580 47847->48436 47850 17ab20 42 API calls 47850->47857 47851 1763b0 42 API calls std::_Throw_Cpp_error 47851->47856 47853 246c20 88 API calls 47853->47857 47854 17ab20 42 API calls 47854->47856 47855 1be33f CreateDirectoryA 47855->47857 47856->47844 47856->47851 47856->47854 47858 246c20 88 API calls 47856->47858 47859 1bea89 CreateDirectoryA 47856->47859 47862 1beb7c CreateDirectoryA 47856->47862 47864 17ad80 42 API calls 47856->47864 47868 162cf0 std::_Throw_Cpp_error 42 API calls 47856->47868 47869 1bed50 CreateDirectoryA 47856->47869 47870 1bec69 CreateDirectoryA 47856->47870 47872 17ae20 42 API calls 47856->47872 47873 23fe80 207 API calls 47856->47873 47875 1befd0 CreateDirectoryA 47856->47875 49336 176290 42 API calls 47856->49336 47857->47835 47857->47850 47857->47853 47857->47855 47860 1be432 CreateDirectoryA 47857->47860 47861 162cf0 std::_Throw_Cpp_error 42 API calls 47857->47861 47863 17ad80 42 API calls 47857->47863 47865 1be51f CreateDirectoryA 47857->47865 47866 17ae20 42 API calls 47857->47866 47874 1be774 CreateDirectoryA 47857->47874 47876 1763b0 42 API calls std::_Throw_Cpp_error 47857->47876 49145 176290 42 API calls 47857->49145 49146 23fe80 47857->49146 47858->47856 47859->47856 47860->47857 47861->47857 47862->47856 47863->47857 47864->47856 47865->47857 47866->47857 47868->47856 47869->47856 47870->47856 47872->47856 47873->47856 47874->47857 47875->47856 47876->47857 47879 16b916 47878->47879 47880 17ab20 42 API calls 47879->47880 47938 16bfd1 47879->47938 47882 16b9e7 CreateDirectoryA 47880->47882 47881 17ab20 42 API calls 47883 16c0ab CreateDirectoryA 47881->47883 47886 16ba12 47882->47886 47882->47938 47887 16c0d6 47883->47887 48204 16f315 47883->48204 47884 17ab20 42 API calls 47888 16f43a CreateDirectoryA 47884->47888 47885 172270 47885->47832 47890 17ab20 42 API calls 47886->47890 47891 17ab20 42 API calls 47887->47891 47892 16f465 47888->47892 48153 171d37 47888->48153 47889 17ab20 42 API calls 47893 171e4d CreateDirectoryA 47889->47893 47894 16bab4 CreateDirectoryA 47890->47894 47895 16c178 CreateDirectoryA 47891->47895 47896 17ab20 42 API calls 47892->47896 47893->47885 47897 171e78 47893->47897 47898 16bae2 __fread_nolock 47894->47898 47982 16bc28 47894->47982 47899 16c1a0 47895->47899 48024 16c4a7 47895->48024 47900 16f507 CreateDirectoryA 47896->47900 47902 17ab20 42 API calls 47897->47902 47904 16baf5 SHGetFolderPathA 47898->47904 47905 162cf0 std::_Throw_Cpp_error 42 API calls 47899->47905 47906 16f52f 47900->47906 48018 16f853 47900->48018 47901 17ab20 42 API calls 47907 16bcea CreateDirectoryA 47901->47907 47908 171fa0 CreateDirectoryA 47902->47908 47903 17ab20 42 API calls 47909 16c557 CreateDirectoryA 47903->47909 47910 162cf0 std::_Throw_Cpp_error 42 API calls 47904->47910 47912 16c2be 47905->47912 47923 163040 std::_Throw_Cpp_error 42 API calls 47906->47923 47913 16bd12 __fread_nolock 47907->47913 48048 16bfad 47907->48048 47914 171fc8 47908->47914 48054 17223a 47908->48054 47915 16c57f 47909->47915 48297 16d1ae 47909->48297 47916 16bba1 47910->47916 47911 17ab20 42 API calls 47917 16f915 CreateDirectoryA 47911->47917 47929 17ace0 42 API calls 47912->47929 47925 16bd25 SHGetFolderPathA 47913->47925 47934 163040 std::_Throw_Cpp_error 42 API calls 47914->47934 47919 162cf0 std::_Throw_Cpp_error 42 API calls 47915->47919 47920 17ace0 42 API calls 47916->47920 47921 16f93d 47917->47921 48060 16fb75 47917->48060 47918 2466f0 95 API calls 47918->47885 47926 16c727 47919->47926 47927 16bbb7 47920->47927 47928 162cf0 std::_Throw_Cpp_error 42 API calls 47921->47928 47922 2466f0 95 API calls 47922->47938 47930 16f704 47923->47930 47924 17ab20 42 API calls 47931 16d27c CreateDirectoryA 47924->47931 47932 162cf0 std::_Throw_Cpp_error 42 API calls 47925->47932 47947 17ace0 42 API calls 47926->47947 47948 246c20 88 API calls 47927->47948 47937 16fa5b 47928->47937 47939 16c367 47929->47939 47951 17ace0 42 API calls 47930->47951 47940 16d2a4 47931->47940 48129 16d62a 47931->48129 47941 16be57 47932->47941 47933 17ab20 42 API calls 47935 16fc37 CreateDirectoryA 47933->47935 47936 17211c 47934->47936 47942 16fc5f 47935->47942 48101 16fe11 47935->48101 47954 17ace0 42 API calls 47936->47954 47958 17ace0 42 API calls 47937->47958 47938->47881 47938->48204 47960 162cf0 std::_Throw_Cpp_error 42 API calls 47939->47960 47952 162cf0 std::_Throw_Cpp_error 42 API calls 47940->47952 47944 17ace0 42 API calls 47941->47944 47946 162cf0 std::_Throw_Cpp_error 42 API calls 47942->47946 47943 17ab20 42 API calls 47950 16d6da CreateDirectoryA 47943->47950 47945 16be6d 47944->47945 47975 162cf0 std::_Throw_Cpp_error 42 API calls 47945->47975 47953 16fcf7 47946->47953 47955 16c7d0 47947->47955 47956 16bbe2 47948->47956 47949 17ab20 42 API calls 47957 16fed3 CreateDirectoryA 47949->47957 47959 16d702 47950->47959 48141 16da09 47950->48141 47961 16f7b1 47951->47961 47963 16d3bb 47952->47963 47984 17ace0 42 API calls 47953->47984 47964 1721c9 47954->47964 47988 162cf0 std::_Throw_Cpp_error 42 API calls 47955->47988 47966 16bc21 47956->47966 47978 1763b0 std::_Throw_Cpp_error 42 API calls 47956->47978 47967 16fefb 47957->47967 48130 170e44 47957->48130 47968 16fb04 47958->47968 47969 162cf0 std::_Throw_Cpp_error 42 API calls 47959->47969 47970 16c39b 47960->47970 47962 16f7d6 47961->47962 47974 162fe0 std::_Throw_Cpp_error 40 API calls 47961->47974 47976 246c20 88 API calls 47962->47976 47992 17ace0 42 API calls 47963->47992 47995 246c20 88 API calls 47964->47995 47965 17ab20 42 API calls 47977 16dab9 CreateDirectoryA 47965->47977 47972 2466f0 95 API calls 47966->47972 47966->47982 47979 162cf0 std::_Throw_Cpp_error 42 API calls 47967->47979 47996 246c20 88 API calls 47968->47996 47980 16d820 47969->47980 47971 246cf0 78 API calls 47970->47971 47981 16c3a8 47971->47981 47972->47982 47973 17ab20 42 API calls 47983 170ef4 CreateDirectoryA 47973->47983 47974->47962 47985 16bea1 47975->47985 47986 16f80d 47976->47986 47987 16dae1 47977->47987 48164 16de6e 47977->48164 47989 16bbfa 47978->47989 47990 16ff97 47979->47990 48003 17ace0 42 API calls 47980->48003 47991 16c49b 47981->47991 48004 17ab20 42 API calls 47981->48004 47982->47901 47993 170f1c 47983->47993 48203 171833 47983->48203 47994 16fda0 47984->47994 49337 246cf0 47985->49337 47999 16f84c 47986->47999 48012 1763b0 std::_Throw_Cpp_error 42 API calls 47986->48012 48000 162cf0 std::_Throw_Cpp_error 42 API calls 47987->48000 48001 16c804 47988->48001 48002 1763b0 std::_Throw_Cpp_error 42 API calls 47989->48002 48019 17ace0 42 API calls 47990->48019 48008 2466f0 95 API calls 47991->48008 48005 16d464 47992->48005 48006 162cf0 std::_Throw_Cpp_error 42 API calls 47993->48006 48036 246c20 88 API calls 47994->48036 48007 1721f4 47995->48007 48009 16fb2f 47996->48009 47998 17ab20 42 API calls 48011 16df1e CreateDirectoryA 47998->48011 48017 2466f0 95 API calls 47999->48017 47999->48018 48014 16dc85 48000->48014 48015 246cf0 78 API calls 48001->48015 48016 16bc12 48002->48016 48020 16d8c9 48003->48020 48021 16c451 48004->48021 48051 162cf0 std::_Throw_Cpp_error 42 API calls 48005->48051 48022 170fb9 48006->48022 48023 172233 48007->48023 48037 1763b0 std::_Throw_Cpp_error 42 API calls 48007->48037 48008->48024 48025 16fb6e 48009->48025 48039 1763b0 std::_Throw_Cpp_error 42 API calls 48009->48039 48010 16beae 48026 16bfa1 48010->48026 48040 17ab20 42 API calls 48010->48040 48027 16df46 48011->48027 48218 16e629 48011->48218 48028 16f825 48012->48028 48013 17ab20 42 API calls 48029 1718e6 CreateDirectoryA 48013->48029 48061 17ace0 42 API calls 48014->48061 48030 16c811 48015->48030 48031 23fe80 207 API calls 48016->48031 48017->48018 48018->47911 48033 170040 48019->48033 48065 162cf0 std::_Throw_Cpp_error 42 API calls 48020->48065 48034 16c462 CopyFileA 48021->48034 48035 16c460 48021->48035 48068 17ace0 42 API calls 48022->48068 48038 2466f0 95 API calls 48023->48038 48023->48054 48024->47903 48044 2466f0 95 API calls 48025->48044 48025->48060 48032 2466f0 95 API calls 48026->48032 48041 162cf0 std::_Throw_Cpp_error 42 API calls 48027->48041 48043 1763b0 std::_Throw_Cpp_error 42 API calls 48028->48043 48045 17190e 48029->48045 48197 171d13 48029->48197 48046 16c98c 48030->48046 48047 17ab20 42 API calls 48030->48047 48031->47966 48032->48048 48079 246c20 88 API calls 48033->48079 48049 16c491 48034->48049 48035->48034 48052 16fdcb 48036->48052 48053 17220c 48037->48053 48038->48054 48055 16fb47 48039->48055 48056 16bf57 48040->48056 48057 16dfe3 48041->48057 48042 17ab20 42 API calls 48058 16e6dc CreateDirectoryA 48042->48058 48059 16f83d 48043->48059 48044->48060 48076 163040 std::_Throw_Cpp_error 42 API calls 48045->48076 48050 162cf0 std::_Throw_Cpp_error 42 API calls 48046->48050 48063 16c940 48047->48063 48048->47922 48048->47938 48049->47991 48081 16c495 48049->48081 48066 16cb30 48050->48066 48067 16d498 48051->48067 48069 16fe0a 48052->48069 48084 1763b0 std::_Throw_Cpp_error 42 API calls 48052->48084 48070 1763b0 std::_Throw_Cpp_error 42 API calls 48053->48070 48054->47885 48054->47918 48071 1763b0 std::_Throw_Cpp_error 42 API calls 48055->48071 48072 16bf66 48056->48072 48073 16bf68 CopyFileA 48056->48073 48095 17ace0 42 API calls 48057->48095 48074 16e704 48058->48074 48168 16f2eb 48058->48168 48075 23fe80 207 API calls 48059->48075 48060->47933 48062 16dd2e 48061->48062 48102 162cf0 std::_Throw_Cpp_error 42 API calls 48062->48102 48077 16c951 CopyFileA 48063->48077 48078 16c94f 48063->48078 48064 2466f0 95 API calls 48064->48153 48080 16d8fd 48065->48080 48105 17ace0 42 API calls 48066->48105 48082 246cf0 78 API calls 48067->48082 48083 171062 48068->48083 48086 2466f0 95 API calls 48069->48086 48069->48101 48085 172224 48070->48085 48087 16fb5f 48071->48087 48072->48073 48088 16bf97 48073->48088 48075->47999 48097 1719dc 48076->48097 48090 16c980 48077->48090 48078->48077 48091 17006b 48079->48091 48098 246cf0 78 API calls 48080->48098 48081->48024 48092 16d4a5 48082->48092 48115 1763b0 std::_Throw_Cpp_error 42 API calls 48083->48115 48099 16fde3 48084->48099 48100 23fe80 207 API calls 48085->48100 48086->48101 48094 23fe80 207 API calls 48087->48094 48088->48026 48090->48046 48103 170de7 48091->48103 48112 17ab20 42 API calls 48091->48112 48106 16d61e 48092->48106 48114 17ab20 42 API calls 48092->48114 48094->48025 48104 16d90a 48098->48104 48107 1763b0 std::_Throw_Cpp_error 42 API calls 48099->48107 48100->48023 48101->47949 48111 16dd62 48102->48111 48120 2466f0 95 API calls 48103->48120 48103->48130 48118 16d9fd 48104->48118 48124 17ab20 42 API calls 48104->48124 48113 16cbd9 48105->48113 48116 2466f0 95 API calls 48106->48116 48119 16fdfb 48107->48119 48123 170111 48112->48123 48149 162cf0 std::_Throw_Cpp_error 42 API calls 48113->48149 48125 16d5d4 48114->48125 48116->48129 48127 23fe80 207 API calls 48119->48127 48120->48130 48133 16d5e5 CopyFileA 48125->48133 48134 16d5e3 48125->48134 48127->48069 48129->47943 48130->47973 48150 16d614 48133->48150 48134->48133 48141->47965 48154 16cc0d 48149->48154 48150->48106 48153->47885 48153->47889 48164->47998 48168->48204 48197->48064 48197->48153 48203->48013 48204->47884 48204->48153 48218->48042 48297->47924 49453 1959b0 48354->49453 48357 23f0d0 48357->48357 48358 163040 std::_Throw_Cpp_error 42 API calls 48357->48358 48359 23f0ec 48358->48359 48360 17fbf0 42 API calls 48359->48360 48361 23f11d 48360->48361 48362 23f190 std::ios_base::_Ios_base_dtor 48361->48362 48365 23fe59 48361->48365 48363 246c20 88 API calls 48362->48363 48364 23f1c5 48363->48364 48367 17ab20 42 API calls 48364->48367 48372 23fd80 48364->48372 48366 198c70 std::_Throw_Cpp_error 40 API calls 48365->48366 48366->48372 48369 23f268 48367->48369 48368 23fe1b std::ios_base::_Ios_base_dtor 48368->47843 48370 246c20 88 API calls 48369->48370 48372->48368 48373 198c70 std::_Throw_Cpp_error 40 API calls 48372->48373 48375 23fe72 48373->48375 48437 2375b6 __fread_nolock 48436->48437 48438 2375d4 SHGetFolderPathA 48437->48438 48439 1959b0 __fread_nolock 48438->48439 48440 237601 SHGetFolderPathA 48439->48440 48441 237748 48440->48441 48441->48441 48442 163040 std::_Throw_Cpp_error 42 API calls 48441->48442 48443 237764 48442->48443 48444 17ace0 42 API calls 48443->48444 48447 237780 std::ios_base::_Ios_base_dtor 48444->48447 48445 246c20 88 API calls 48447->48445 49142 23e312 48447->49142 49145->47857 49147 17ab20 42 API calls 49146->49147 49148 23ffdf 49147->49148 49150 24063c 49148->49150 49151 24001f std::ios_base::_Ios_base_dtor 49148->49151 49149 240072 FindFirstFileA 49156 24050f std::ios_base::_Ios_base_dtor 49149->49156 49199 24009f std::locale::_Locimp::_Locimp 49149->49199 49152 198c70 std::_Throw_Cpp_error 40 API calls 49150->49152 49151->49149 49153 240641 49152->49153 49158 198c70 std::_Throw_Cpp_error 40 API calls 49153->49158 49154 2404e4 FindNextFileA 49155 2404fb FindClose GetLastError 49154->49155 49154->49199 49155->49156 49156->49153 49160 2405f0 std::ios_base::_Ios_base_dtor 49156->49160 49157 17e8a0 42 API calls 49157->49199 49159 24064b 49158->49159 49161 17ab20 42 API calls 49159->49161 49160->47857 49162 2407ba 49161->49162 49163 199820 42 API calls 49162->49163 49164 240868 49163->49164 49165 24449e std::ios_base::_Ios_base_dtor 49164->49165 49524 247160 GetCurrentProcess IsWow64Process 49164->49524 49166 1763b0 std::_Throw_Cpp_error 42 API calls 49165->49166 49168 244528 49166->49168 49596 2475c0 49168->49596 49171 163350 78 API calls 49172 240944 49171->49172 49174 163350 78 API calls 49172->49174 49177 178f00 42 API calls std::_Throw_Cpp_error 49177->49199 49188 2404bf CopyFileA 49191 240520 GetLastError 49188->49191 49188->49199 49191->49156 49192 246c20 88 API calls 49192->49199 49193 24034d CreateDirectoryA 49193->49191 49193->49199 49199->49153 49199->49154 49199->49156 49199->49157 49199->49177 49199->49188 49199->49192 49199->49193 49206 23fe80 157 API calls 49199->49206 49207 1632d0 42 API calls std::_Throw_Cpp_error 49199->49207 49206->49199 49207->49199 49336->47856 49338 199820 42 API calls 49337->49338 49339 246daf 49338->49339 49340 19d0a8 78 API calls 49339->49340 49341 246dbc 49339->49341 49340->49341 49341->48010 49454 1959c7 SHGetFolderPathA 49453->49454 49454->48357 49525 240880 49524->49525 49525->49171 49597 199820 42 API calls 49596->49597 49872 1bf6c0 49873 1bf714 49872->49873 49874 1c026a 49872->49874 49875 17ab20 42 API calls 49873->49875 49876 17ab20 42 API calls 49874->49876 49877 1bf7f6 49875->49877 49878 1c035e 49876->49878 49879 246c20 88 API calls 49877->49879 49880 246c20 88 API calls 49878->49880 49881 1bf81c 49879->49881 49882 1c0384 49880->49882 49884 246b90 87 API calls 49881->49884 49885 1bf83f 49881->49885 49883 246b90 87 API calls 49882->49883 49886 1c03a7 49882->49886 49883->49886 49884->49885 49885->49874 49887 17b260 42 API calls 49885->49887 49892 1c0240 49885->49892 49888 17b260 42 API calls 49886->49888 49891 1c1a9b 49886->49891 49893 1c1a71 49886->49893 49925 1bf86f 49887->49925 49931 1c03d7 std::ios_base::_Ios_base_dtor 49888->49931 49889 2466f0 95 API calls 49889->49874 49890 2466f0 95 API calls 49890->49891 49892->49874 49892->49889 49893->49890 49893->49891 49894 1730f0 42 API calls 49894->49931 49895 1730f0 42 API calls 49895->49925 49896 17b260 42 API calls 49896->49925 49897 17b260 42 API calls 49897->49931 49898 1763b0 42 API calls std::_Throw_Cpp_error 49898->49925 49899 1763b0 42 API calls std::_Throw_Cpp_error 49899->49931 49900 17ac50 42 API calls 49900->49925 49903 246c20 88 API calls 49903->49925 49904 246c20 88 API calls 49904->49931 49905 199820 42 API calls 49905->49925 49906 199820 42 API calls 49906->49931 49907 17ac50 42 API calls 49907->49931 49908 246b90 87 API calls 49908->49925 49909 246b90 87 API calls 49909->49931 49910 17ae20 42 API calls 49910->49925 49911 17ae20 42 API calls 49911->49931 49912 17abb0 42 API calls 49912->49925 49913 17abb0 42 API calls 49913->49931 49914 176240 42 API calls 49914->49925 49915 176240 42 API calls 49915->49931 49916 173200 42 API calls 49916->49931 49917 19d0a8 78 API calls 49917->49931 49918 173200 42 API calls 49918->49925 49919 19d0a8 78 API calls 49919->49925 49920 162cf0 42 API calls std::_Throw_Cpp_error 49920->49925 49921 162cf0 42 API calls std::_Throw_Cpp_error 49921->49931 49922 17af80 42 API calls 49922->49925 49924 163350 78 API calls 49924->49925 49925->49892 49925->49895 49925->49896 49925->49898 49925->49900 49925->49903 49925->49905 49925->49908 49925->49910 49925->49912 49925->49914 49925->49918 49925->49919 49925->49920 49925->49922 49925->49924 50005 176210 42 API calls std::_Throw_Cpp_error 49925->50005 50006 17b400 42 API calls 49925->50006 50007 17bae0 42 API calls 2 library calls 49925->50007 49928 163040 std::_Throw_Cpp_error 42 API calls 49928->49931 49929 17ace0 42 API calls 49929->49931 49930 1c1d84 49932 198c70 std::_Throw_Cpp_error 40 API calls 49930->49932 49931->49893 49931->49894 49931->49897 49931->49899 49931->49904 49931->49906 49931->49907 49931->49909 49931->49911 49931->49913 49931->49915 49931->49916 49931->49917 49931->49921 49931->49928 49931->49929 49931->49930 49937 17b400 42 API calls 49931->49937 49940 17af80 42 API calls 49931->49940 49941 176260 42 API calls 49931->49941 49942 163350 78 API calls 49931->49942 49994 1819a0 49931->49994 50008 176210 42 API calls std::_Throw_Cpp_error 49931->50008 49933 1c1d89 49932->49933 49934 17ab20 42 API calls 49933->49934 49935 1c1eb4 49934->49935 49936 246c20 88 API calls 49935->49936 49938 1c1eda 49936->49938 49937->49931 49939 246b90 87 API calls 49938->49939 49943 1c1efd 49938->49943 49939->49943 49940->49931 49941->49931 49942->49931 49944 17b260 42 API calls 49943->49944 49946 1c293e 49943->49946 49948 1c2910 49943->49948 49989 1c1f2d 49944->49989 49945 2466f0 95 API calls 49945->49946 49947 17ab20 42 API calls 49946->49947 49949 1c2a23 49947->49949 49948->49945 49948->49946 49950 246c20 88 API calls 49949->49950 49951 1c2a49 49950->49951 49952 246b90 87 API calls 49951->49952 49953 1c2a6c 49951->49953 49952->49953 49954 17b260 42 API calls 49953->49954 49956 1c34a9 49953->49956 49957 1c347f 49953->49957 49993 1c2a9c 49954->49993 49955 2466f0 95 API calls 49955->49956 49957->49955 49957->49956 49958 173200 42 API calls 49958->49989 49959 17b260 42 API calls 49959->49989 49960 173200 42 API calls 49960->49993 49961 17b260 42 API calls 49961->49993 49962 1763b0 42 API calls std::_Throw_Cpp_error 49962->49989 49963 17ac50 42 API calls 49963->49989 49965 176240 42 API calls 49965->49989 49966 246b90 87 API calls 49966->49989 49967 1763b0 42 API calls std::_Throw_Cpp_error 49967->49993 49968 246c20 88 API calls 49968->49989 49969 199820 42 API calls 49969->49989 49970 17ae20 42 API calls 49970->49989 49971 17abb0 42 API calls 49971->49989 49972 246c20 88 API calls 49972->49993 49974 176240 42 API calls 49974->49993 49975 1730f0 42 API calls 49975->49989 49976 246b90 87 API calls 49976->49993 49977 17ac50 42 API calls 49977->49993 49978 19d0a8 78 API calls 49978->49989 49979 199820 42 API calls 49979->49993 49980 17ae20 42 API calls 49980->49993 49981 162cf0 42 API calls std::_Throw_Cpp_error 49981->49989 49982 17abb0 42 API calls 49982->49993 49983 1730f0 42 API calls 49983->49993 49984 19d0a8 78 API calls 49984->49993 49985 17af80 42 API calls 49985->49989 49986 162cf0 42 API calls std::_Throw_Cpp_error 49986->49993 49987 17b400 42 API calls 49987->49989 49988 163350 78 API calls 49988->49989 49989->49948 49989->49958 49989->49959 49989->49962 49989->49963 49989->49965 49989->49966 49989->49968 49989->49969 49989->49970 49989->49971 49989->49975 49989->49978 49989->49981 49989->49985 49989->49987 49989->49988 50009 176210 42 API calls std::_Throw_Cpp_error 49989->50009 49990 17b400 42 API calls 49990->49993 49991 17af80 42 API calls 49991->49993 49992 163350 78 API calls 49992->49993 49993->49957 49993->49960 49993->49961 49993->49967 49993->49972 49993->49974 49993->49976 49993->49977 49993->49979 49993->49980 49993->49982 49993->49983 49993->49984 49993->49986 49993->49990 49993->49991 49993->49992 50010 176210 42 API calls std::_Throw_Cpp_error 49993->50010 49995 1819d0 49994->49995 49996 1819f5 49994->49996 49995->49931 49997 162cf0 std::_Throw_Cpp_error 42 API calls 49996->49997 49998 181a03 49997->49998 49999 17ace0 42 API calls 49998->49999 50000 181a18 49999->50000 50001 167cf0 42 API calls 50000->50001 50002 181a2d 50001->50002 50003 1951fb Concurrency::cancel_current_task RaiseException 50002->50003 50004 181a3e 50003->50004 50005->49925 50006->49925 50007->49925 50008->49931 50009->49989 50010->49993 50139 1caa00 50368 1caa3a 50139->50368 50140 1d8aa7 50141 1caa61 50142 1763b0 std::_Throw_Cpp_error 42 API calls 50141->50142 50143 1763b0 std::_Throw_Cpp_error 42 API calls 50141->50143 50142->50141 50144 1caabc 50143->50144 50145 1cab44 50144->50145 50147 1cab5e 50145->50147 50146 163040 std::_Throw_Cpp_error 42 API calls 50146->50147 50147->50146 50148 163040 std::_Throw_Cpp_error 42 API calls 50147->50148 50149 1cacd9 50148->50149 50151 1d719c 50149->50151 50152 1cad04 50149->50152 51487 20a180 50149->51487 50153 1d71aa 50151->50153 50155 1cad16 50152->50155 50154 1d71cc 50153->50154 50158 1763b0 std::_Throw_Cpp_error 42 API calls 50154->50158 50156 1cad38 50155->50156 50157 1763b0 std::_Throw_Cpp_error 42 API calls 50156->50157 50159 1cad40 50157->50159 50160 1d71db 50158->50160 50161 1cad5a 50159->50161 50168 1d71f8 50160->50168 50162 1cad61 50161->50162 50164 1763b0 std::_Throw_Cpp_error 42 API calls 50162->50164 50163 1763b0 std::_Throw_Cpp_error 42 API calls 50163->50168 50165 1cad69 50164->50165 50167 162cf0 std::_Throw_Cpp_error 42 API calls 50165->50167 50166 162cf0 std::_Throw_Cpp_error 42 API calls 50166->50168 50169 1cade3 50167->50169 50168->50163 50168->50166 50176 1d73fb 50168->50176 50170 162cf0 std::_Throw_Cpp_error 42 API calls 50169->50170 50172 1caf0d 50170->50172 50171 162cf0 std::_Throw_Cpp_error 42 API calls 50171->50176 50173 20a180 224 API calls 50172->50173 50175 1caf28 50173->50175 50174 20a180 224 API calls 50174->50176 50179 1caf3d 50175->50179 50176->50171 50176->50174 50177 1d742f 50176->50177 50178 1d7451 50177->50178 50181 1763b0 std::_Throw_Cpp_error 42 API calls 50178->50181 50180 1caf5f 50179->50180 50182 1763b0 std::_Throw_Cpp_error 42 API calls 50180->50182 50183 1d7460 50181->50183 50184 1caf67 50182->50184 50192 1d747d 50183->50192 50188 1763b0 std::_Throw_Cpp_error 42 API calls 50188->50192 50190 162cf0 std::_Throw_Cpp_error 42 API calls 50190->50192 50192->50188 50192->50190 50199 1d7680 50192->50199 50194 162cf0 std::_Throw_Cpp_error 42 API calls 50194->50199 50197 20a180 224 API calls 50197->50199 50199->50194 50199->50197 50201 1d76b4 50199->50201 50203 1d76d6 50201->50203 50205 1763b0 std::_Throw_Cpp_error 42 API calls 50203->50205 50207 1d76e5 50205->50207 50217 1d7702 50207->50217 50211 1763b0 std::_Throw_Cpp_error 42 API calls 50211->50217 50215 162cf0 std::_Throw_Cpp_error 42 API calls 50215->50217 50217->50211 50217->50215 50223 1d7905 50217->50223 50363 162cf0 std::_Throw_Cpp_error 42 API calls 50363->50368 50366 20a180 224 API calls 50366->50368 50368->50140 50368->50141 50368->50363 50368->50366 51488 1959b0 __fread_nolock 51487->51488 51489 20a1db SHGetFolderPathA 51488->51489 52332 17ac50 51489->52332 51492 20b345 51495 1752b0 42 API calls 51492->51495 51493 20a22d 51494 1763b0 std::_Throw_Cpp_error 42 API calls 51493->51494 51496 20a23e 51494->51496 51500 20b343 51495->51500 51497 225f80 46 API calls 51496->51497 51498 20a251 51497->51498 51499 20a26b 51498->51499 51704 20a2d5 std::locale::_Locimp::_Locimp 51498->51704 51502 1785d0 78 API calls 51499->51502 51504 1842a0 42 API calls 51500->51504 51692 20b3eb std::ios_base::_Ios_base_dtor std::locale::_Locimp::_Locimp 51500->51692 51501 20b334 51505 1785d0 78 API calls 51501->51505 51503 20a277 51502->51503 51506 1785d0 78 API calls 51503->51506 51504->51692 51505->51500 51512 20a283 51506->51512 51507 20da8c 51508 177ef0 42 API calls 51507->51508 51509 20dafa 51508->51509 51510 1740c0 42 API calls 51509->51510 51511 20db24 51510->51511 52337 17af80 51511->52337 51512->50149 51520 20da87 51523 198c70 std::_Throw_Cpp_error 40 API calls 51520->51523 51523->51507 51527 17e8a0 42 API calls 51527->51692 51542 17ad80 42 API calls 51542->51692 51568 17e710 42 API calls 51568->51692 51573 178f00 std::_Throw_Cpp_error 42 API calls 51573->51692 51577 17abb0 42 API calls 51577->51692 51613 17e8a0 42 API calls 51613->51704 51621 1632d0 42 API calls std::_Throw_Cpp_error 51621->51692 51625 17ab20 42 API calls 51625->51692 51627 163040 42 API calls std::_Throw_Cpp_error 51627->51692 51629 246cf0 78 API calls 51629->51692 51634 178f00 42 API calls std::_Throw_Cpp_error 51634->51704 51650 1763b0 42 API calls std::_Throw_Cpp_error 51650->51692 51653 17abb0 42 API calls 51653->51704 51684 1632d0 std::_Throw_Cpp_error 42 API calls 51684->51704 51692->51503 51692->51507 51692->51520 51692->51527 51692->51542 51692->51568 51692->51573 51692->51577 51692->51621 51692->51625 51692->51627 51692->51629 51692->51650 51698 1835f0 42 API calls 51692->51698 51714 162fe0 40 API calls std::_Throw_Cpp_error 51692->51714 51698->51692 51701 1763b0 42 API calls std::_Throw_Cpp_error 51701->51704 51704->51501 51704->51507 51704->51613 51704->51634 51704->51653 51704->51684 51704->51701 51706 246cf0 78 API calls 51704->51706 52510 184400 45 API calls 4 library calls 51704->52510 51706->51704 51714->51692 52334 17ac81 52332->52334 52333 17acd3 52334->52333 52335 17e8a0 42 API calls 52334->52335 52336 17acb2 52335->52336 52336->51492 52336->51493 52338 17afc5 52337->52338 52339 17afb8 52337->52339 52341 17b08c 52338->52341 52342 17afda 52338->52342 52340 177ef0 42 API calls 52339->52340 52340->52338 52510->51704 53718 1ca0c0 53729 1ca0fb 53718->53729 53719 1ca9e0 53720 1763b0 42 API calls std::_Throw_Cpp_error 53720->53729 53723 173d50 42 API calls 53723->53729 53724 1738b0 42 API calls 53724->53729 53726 17af80 42 API calls 53726->53729 53729->53719 53729->53720 53729->53723 53729->53724 53729->53726 53730 1ff050 53729->53730 53814 1fd320 53729->53814 53890 1faee0 53729->53890 53967 1f8630 53729->53967 54040 1f6330 53729->54040 53731 1ff086 53730->53731 53732 177ef0 42 API calls 53731->53732 53733 1ff0af 53732->53733 53734 1740c0 42 API calls 53733->53734 53735 1ff0d9 53734->53735 53736 17af80 42 API calls 53735->53736 53737 1ff174 __fread_nolock 53736->53737 53738 1ff192 SHGetFolderPathA 53737->53738 53739 17ac50 42 API calls 53738->53739 53740 1ff1bf 53739->53740 53741 17ab20 42 API calls 53740->53741 53742 1ff264 __fread_nolock 53741->53742 53743 1ff27e GetPrivateProfileSectionNamesA 53742->53743 53801 1ff2b1 std::ios_base::_Ios_base_dtor __fread_nolock std::locale::_Locimp::_Locimp 53743->53801 53745 20340d lstrlen 53750 203423 53745->53750 53745->53801 53746 1ff3a2 GetPrivateProfileStringA 53746->53801 53747 20347b 53749 162cf0 std::_Throw_Cpp_error 42 API calls 53747->53749 53748 17abb0 42 API calls 53748->53801 53751 203494 53749->53751 53750->53729 53752 17ace0 42 API calls 53751->53752 53753 2034a9 53752->53753 53754 167cf0 42 API calls 53753->53754 53756 2034c1 53754->53756 53755 199820 42 API calls 53755->53801 53757 1951fb Concurrency::cancel_current_task RaiseException 53756->53757 53758 2034d5 53757->53758 53759 198c70 std::_Throw_Cpp_error 40 API calls 53758->53759 53760 2034da 53759->53760 53764 162cf0 std::_Throw_Cpp_error 42 API calls 53760->53764 53761 17e8a0 42 API calls 53761->53801 53762 236710 150 API calls 53762->53801 53763 2475c0 89 API calls 53763->53801 53766 2034ed 53764->53766 53765 1632d0 std::_Throw_Cpp_error 42 API calls 53765->53801 53767 17ace0 42 API calls 53766->53767 53769 203502 53767->53769 53768 17b430 55 API calls 53768->53801 53771 167cf0 42 API calls 53769->53771 53770 270e60 15 API calls 53770->53801 53772 20351a 53771->53772 53773 1951fb Concurrency::cancel_current_task RaiseException 53772->53773 53775 20352e 53773->53775 53774 236570 89 API calls 53774->53801 53777 162cf0 std::_Throw_Cpp_error 42 API calls 53775->53777 53778 203542 53777->53778 53780 17ace0 42 API calls 53778->53780 53779 2aad50 15 API calls 53779->53801 53781 203557 53780->53781 53782 167cf0 42 API calls 53781->53782 53783 20356f 53782->53783 53785 1951fb Concurrency::cancel_current_task RaiseException 53783->53785 53784 17af80 42 API calls 53784->53801 53787 203583 53785->53787 53786 2ab540 15 API calls 53786->53801 53788 1730f0 42 API calls 53788->53801 53789 173200 42 API calls 53789->53801 53790 246c20 88 API calls 53790->53801 53791 201bdf CreateDirectoryA 53791->53801 53792 177ef0 42 API calls 53792->53801 53794 193672 42 API calls std::_Facet_Register 53794->53801 53795 17ad80 42 API calls 53795->53801 53796 173d50 42 API calls 53796->53801 53797 163040 42 API calls std::_Throw_Cpp_error 53797->53801 53798 162fe0 40 API calls std::_Throw_Cpp_error 53798->53801 53799 17b0e0 42 API calls 53799->53801 53800 201ec6 CreateDirectoryA 53800->53801 53801->53745 53801->53746 53801->53747 53801->53748 53801->53755 53801->53758 53801->53760 53801->53761 53801->53762 53801->53763 53801->53765 53801->53768 53801->53770 53801->53774 53801->53775 53801->53779 53801->53784 53801->53786 53801->53788 53801->53789 53801->53790 53801->53791 53801->53792 53801->53794 53801->53795 53801->53796 53801->53797 53801->53798 53801->53799 53801->53800 53802 162cf0 std::_Throw_Cpp_error 42 API calls 53801->53802 53804 17ace0 42 API calls 53801->53804 53805 17b7b0 42 API calls 53801->53805 53806 246cf0 78 API calls 53801->53806 53807 173980 42 API calls 53801->53807 53808 1a1628 75 API calls 53801->53808 53810 17ab20 42 API calls 53801->53810 53811 203590 156 API calls 53801->53811 53813 19d0a8 78 API calls 53801->53813 54115 1a0fae 53801->54115 54129 18c080 42 API calls 2 library calls 53801->54129 54130 184900 42 API calls 53801->54130 54131 2aae80 15 API calls 53801->54131 54132 17b9d0 42 API calls 2 library calls 53801->54132 54133 1736c0 42 API calls 2 library calls 53801->54133 53802->53801 53804->53801 53805->53801 53806->53801 53807->53801 53808->53801 53810->53801 53811->53801 53813->53801 53815 1fd356 53814->53815 53816 177ef0 42 API calls 53815->53816 53817 1fd37f 53816->53817 53818 1740c0 42 API calls 53817->53818 53819 1fd3a9 53818->53819 53820 17af80 42 API calls 53819->53820 53821 1fd444 __fread_nolock 53820->53821 53822 1fd462 SHGetFolderPathA 53821->53822 53823 17ac50 42 API calls 53822->53823 53824 1fd48f 53823->53824 53825 17ab20 42 API calls 53824->53825 53826 1fd534 __fread_nolock 53825->53826 53827 1fd54e GetPrivateProfileSectionNamesA 53826->53827 53871 1fd581 std::ios_base::_Ios_base_dtor __fread_nolock std::locale::_Locimp::_Locimp 53827->53871 53828 1a0fae 50 API calls 53828->53871 53829 1feeb1 lstrlen 53833 1feec7 53829->53833 53829->53871 53830 1fd672 GetPrivateProfileStringA 53830->53871 53831 1fefe8 53835 198c70 std::_Throw_Cpp_error 40 API calls 53831->53835 53832 17e8a0 42 API calls 53832->53871 53833->53729 53834 17abb0 42 API calls 53834->53871 53836 1feff2 53835->53836 53837 162cf0 std::_Throw_Cpp_error 42 API calls 53836->53837 53838 1ff009 53837->53838 53839 17ace0 42 API calls 53838->53839 53840 1ff01e 53839->53840 53841 167cf0 42 API calls 53840->53841 53842 1ff036 53841->53842 53843 1951fb Concurrency::cancel_current_task RaiseException 53842->53843 53845 1ff04a 53843->53845 53844 17ab20 42 API calls 53844->53871 53846 199820 42 API calls 53846->53871 53847 19d0a8 78 API calls 53847->53871 53848 1740c0 42 API calls 53848->53871 53849 246450 45 API calls 53849->53871 53851 1fef40 53855 162cf0 std::_Throw_Cpp_error 42 API calls 53851->53855 53852 1632d0 42 API calls std::_Throw_Cpp_error 53852->53871 53853 1785d0 78 API calls 53853->53871 53854 1780a0 42 API calls 53854->53871 53857 1fef57 53855->53857 53856 176130 42 API calls 53856->53871 53858 17ace0 42 API calls 53857->53858 53860 1fef6c 53858->53860 53859 236710 150 API calls 53859->53871 53861 167cf0 42 API calls 53860->53861 53875 1fef84 53861->53875 53862 270e60 15 API calls 53862->53871 53863 1951fb Concurrency::cancel_current_task RaiseException 53863->53831 53864 1fef06 53867 162cf0 std::_Throw_Cpp_error 42 API calls 53864->53867 53865 236570 89 API calls 53865->53871 53866 2ab540 15 API calls 53866->53871 53869 1fef19 53867->53869 53870 17ace0 42 API calls 53869->53870 53872 1fee07 53870->53872 53871->53828 53871->53829 53871->53830 53871->53831 53871->53832 53871->53834 53871->53836 53871->53844 53871->53846 53871->53847 53871->53848 53871->53849 53871->53851 53871->53852 53871->53853 53871->53854 53871->53856 53871->53859 53871->53862 53871->53864 53871->53865 53871->53866 53873 2aad50 15 API calls 53871->53873 53876 1fedde 53871->53876 53877 193672 42 API calls std::_Facet_Register 53871->53877 53881 177ef0 42 API calls 53871->53881 53883 163040 42 API calls std::_Throw_Cpp_error 53871->53883 53884 1fef94 53871->53884 53885 173d50 42 API calls 53871->53885 53886 184900 42 API calls 53871->53886 54139 17c3a0 42 API calls std::_Facet_Register 53871->54139 54140 183f40 104 API calls 4 library calls 53871->54140 54141 2aae80 15 API calls 53871->54141 53874 167cf0 42 API calls 53872->53874 53873->53871 53874->53875 53875->53863 53878 162cf0 std::_Throw_Cpp_error 42 API calls 53876->53878 53877->53871 53879 1fedf2 53878->53879 53880 17ace0 42 API calls 53879->53880 53880->53872 53881->53871 53883->53871 53887 162cf0 std::_Throw_Cpp_error 42 API calls 53884->53887 53885->53871 53886->53871 53888 1fefa7 53887->53888 53889 17ace0 42 API calls 53888->53889 53889->53872 53891 1faf16 53890->53891 53892 177ef0 42 API calls 53891->53892 53893 1faf3f 53892->53893 53894 1740c0 42 API calls 53893->53894 53895 1faf69 53894->53895 53896 17af80 42 API calls 53895->53896 53897 1fb0a8 __fread_nolock 53896->53897 53898 1fb0c6 SHGetFolderPathA 53897->53898 53899 17ac50 42 API calls 53898->53899 53900 1fb0f3 53899->53900 53901 17ab20 42 API calls 53900->53901 53902 1fb1a7 __fread_nolock 53901->53902 53903 1fb1c1 GetPrivateProfileSectionNamesA 53902->53903 53933 1fb1f4 std::ios_base::_Ios_base_dtor __fread_nolock std::locale::_Locimp::_Locimp 53903->53933 53904 1a0fae 50 API calls 53904->53933 53905 1fd1ac lstrlen 53909 1fd1c2 53905->53909 53905->53933 53906 1fb2e5 GetPrivateProfileStringA 53906->53933 53907 1fd2a9 53911 198c70 std::_Throw_Cpp_error 40 API calls 53907->53911 53908 17e8a0 42 API calls 53908->53933 53909->53729 53910 17abb0 42 API calls 53910->53933 53912 1fd2b3 53911->53912 54144 179e60 42 API calls 53912->54144 53914 1fd2b8 53915 162cf0 std::_Throw_Cpp_error 42 API calls 53914->53915 53916 1fd2cf 53915->53916 53917 17ace0 42 API calls 53916->53917 53918 1fd2e4 53917->53918 53920 167cf0 42 API calls 53918->53920 53919 17ab20 42 API calls 53919->53933 53921 1fd2fc 53920->53921 53923 1951fb Concurrency::cancel_current_task RaiseException 53921->53923 53922 199820 42 API calls 53922->53933 53924 1fd310 53923->53924 53925 19d0a8 78 API calls 53925->53933 53926 1740c0 42 API calls 53926->53933 53927 246450 45 API calls 53927->53933 53929 1fd201 53934 162cf0 std::_Throw_Cpp_error 42 API calls 53929->53934 53930 1632d0 42 API calls std::_Throw_Cpp_error 53930->53933 53931 1785d0 78 API calls 53931->53933 53932 1780a0 42 API calls 53932->53933 53933->53904 53933->53905 53933->53906 53933->53907 53933->53908 53933->53910 53933->53912 53933->53914 53933->53919 53933->53922 53933->53925 53933->53926 53933->53927 53933->53929 53933->53930 53933->53931 53933->53932 53935 176130 42 API calls 53933->53935 53938 236710 150 API calls 53933->53938 53941 17af80 42 API calls 53933->53941 53942 270e60 15 API calls 53933->53942 53944 236570 89 API calls 53933->53944 53945 1fd053 53933->53945 53946 173d50 42 API calls 53933->53946 53947 184900 42 API calls 53933->53947 53952 2aad50 15 API calls 53933->53952 53956 17fbf0 42 API calls 53933->53956 53957 178f00 std::_Throw_Cpp_error 42 API calls 53933->53957 53958 2ab540 15 API calls 53933->53958 53959 193672 42 API calls std::_Facet_Register 53933->53959 53960 163040 42 API calls std::_Throw_Cpp_error 53933->53960 53961 1763b0 std::_Throw_Cpp_error 42 API calls 53933->53961 53962 1fd255 53933->53962 53963 177ef0 42 API calls 53933->53963 54142 17c3a0 42 API calls std::_Facet_Register 53933->54142 54143 2aae80 15 API calls 53933->54143 53936 1fd218 53934->53936 53935->53933 53937 17ace0 42 API calls 53936->53937 53939 1fd22d 53937->53939 53938->53933 53940 167cf0 42 API calls 53939->53940 53955 1fd245 53940->53955 53941->53933 53942->53933 53943 1951fb Concurrency::cancel_current_task RaiseException 53943->53907 53944->53933 53949 162cf0 std::_Throw_Cpp_error 42 API calls 53945->53949 53946->53933 53947->53933 53950 1fd066 53949->53950 53951 17ace0 42 API calls 53950->53951 53953 1fd07b 53951->53953 53952->53933 53954 167cf0 42 API calls 53953->53954 53954->53955 53955->53943 53956->53933 53957->53933 53958->53933 53959->53933 53960->53933 53961->53933 53964 162cf0 std::_Throw_Cpp_error 42 API calls 53962->53964 53963->53933 53965 1fd268 53964->53965 53966 17ace0 42 API calls 53965->53966 53966->53953 53968 1f8666 53967->53968 53969 177ef0 42 API calls 53968->53969 53970 1f868f 53969->53970 53971 1740c0 42 API calls 53970->53971 53972 1f86b9 53971->53972 53973 17af80 42 API calls 53972->53973 53974 1f8754 __fread_nolock 53973->53974 53975 1f8772 SHGetFolderPathA 53974->53975 53976 17ac50 42 API calls 53975->53976 53977 1f879f 53976->53977 53978 17ab20 42 API calls 53977->53978 53979 1f8844 __fread_nolock 53978->53979 53980 1f885e GetPrivateProfileSectionNamesA 53979->53980 53991 1f8894 std::ios_base::_Ios_base_dtor __fread_nolock std::locale::_Locimp::_Locimp 53980->53991 53981 1a0fae 50 API calls 53981->53991 53982 1fad90 lstrlen 53986 1fada9 53982->53986 53982->53991 53983 1f8985 GetPrivateProfileStringA 53983->53991 53984 1fae77 53988 198c70 std::_Throw_Cpp_error 40 API calls 53984->53988 53985 17e8a0 42 API calls 53985->53991 53986->53729 53987 17abb0 42 API calls 53987->53991 53989 1fae81 53988->53989 53990 162cf0 std::_Throw_Cpp_error 42 API calls 53989->53990 53992 1fae95 53990->53992 53991->53981 53991->53982 53991->53983 53991->53984 53991->53985 53991->53987 53991->53989 53998 17ab20 42 API calls 53991->53998 54000 199820 42 API calls 53991->54000 54001 19d0a8 78 API calls 53991->54001 54002 162fe0 40 API calls std::_Throw_Cpp_error 53991->54002 54003 1740c0 42 API calls 53991->54003 54004 246450 45 API calls 53991->54004 54005 1632d0 42 API calls std::_Throw_Cpp_error 53991->54005 54007 1fade8 53991->54007 54008 1785d0 78 API calls 53991->54008 54010 176130 42 API calls 53991->54010 54013 236710 150 API calls 53991->54013 54016 270e60 15 API calls 53991->54016 54017 17af80 42 API calls 53991->54017 54019 236570 89 API calls 53991->54019 54020 1fac9a 53991->54020 54021 173d50 42 API calls 53991->54021 54022 184900 42 API calls 53991->54022 54028 193672 42 API calls std::_Facet_Register 53991->54028 54029 177ef0 42 API calls 53991->54029 54030 2aad50 15 API calls 53991->54030 54031 1a12f6 50 API calls 53991->54031 54032 163040 42 API calls std::_Throw_Cpp_error 53991->54032 54034 1780a0 42 API calls 53991->54034 54035 1fae23 53991->54035 54039 2ab540 15 API calls 53991->54039 54145 17c3a0 42 API calls std::_Facet_Register 53991->54145 54146 18c080 42 API calls 2 library calls 53991->54146 54147 2aae80 15 API calls 53991->54147 53993 17ace0 42 API calls 53992->53993 53994 1faeaa 53993->53994 53995 167cf0 42 API calls 53994->53995 53996 1faec2 53995->53996 53997 1951fb Concurrency::cancel_current_task RaiseException 53996->53997 53999 1faed6 53997->53999 53998->53991 54000->53991 54001->53991 54002->53991 54003->53991 54004->53991 54005->53991 54009 162cf0 std::_Throw_Cpp_error 42 API calls 54007->54009 54008->53991 54011 1fadff 54009->54011 54010->53991 54012 17ace0 42 API calls 54011->54012 54027 1facc2 54012->54027 54013->53991 54014 167cf0 42 API calls 54015 1fae63 54014->54015 54018 1951fb Concurrency::cancel_current_task RaiseException 54015->54018 54016->53991 54017->53991 54018->53984 54019->53991 54024 162cf0 std::_Throw_Cpp_error 42 API calls 54020->54024 54021->53991 54022->53991 54025 1facad 54024->54025 54026 17ace0 42 API calls 54025->54026 54026->54027 54027->54014 54028->53991 54029->53991 54030->53991 54031->53991 54032->53991 54034->53991 54036 162cf0 std::_Throw_Cpp_error 42 API calls 54035->54036 54037 1fae36 54036->54037 54038 17ace0 42 API calls 54037->54038 54038->54027 54039->53991 54041 1f6366 54040->54041 54042 177ef0 42 API calls 54041->54042 54043 1f638f 54042->54043 54044 1740c0 42 API calls 54043->54044 54045 1f63b9 54044->54045 54046 17af80 42 API calls 54045->54046 54047 1f6454 __fread_nolock 54046->54047 54048 1f6472 SHGetFolderPathA 54047->54048 54049 17ac50 42 API calls 54048->54049 54050 1f649f 54049->54050 54051 17ab20 42 API calls 54050->54051 54052 1f6544 __fread_nolock 54051->54052 54053 1f655e GetPrivateProfileSectionNamesA 54052->54053 54081 1f6591 std::ios_base::_Ios_base_dtor __fread_nolock __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z std::locale::_Locimp::_Locimp 54053->54081 54054 1a0fae 50 API calls 54054->54081 54055 1f84ce lstrlen 54059 1f84e4 54055->54059 54055->54081 54056 1f6682 GetPrivateProfileStringA 54056->54081 54057 1f85cb 54060 198c70 std::_Throw_Cpp_error 40 API calls 54057->54060 54058 17e8a0 42 API calls 54058->54081 54059->53729 54062 1f85d5 54060->54062 54061 17abb0 42 API calls 54061->54081 54063 162cf0 std::_Throw_Cpp_error 42 API calls 54062->54063 54064 1f85ec 54063->54064 54065 17ace0 42 API calls 54064->54065 54067 1f8601 54065->54067 54066 163040 42 API calls std::_Throw_Cpp_error 54066->54081 54068 167cf0 42 API calls 54067->54068 54069 1f8619 54068->54069 54071 1951fb Concurrency::cancel_current_task RaiseException 54069->54071 54070 17ab20 42 API calls 54070->54081 54072 1f862d 54071->54072 54073 199820 42 API calls 54073->54081 54074 19d0a8 78 API calls 54074->54081 54075 1740c0 42 API calls 54075->54081 54076 1632d0 42 API calls std::_Throw_Cpp_error 54076->54081 54077 246450 45 API calls 54077->54081 54078 1f8523 54082 162cf0 std::_Throw_Cpp_error 42 API calls 54078->54082 54080 1785d0 78 API calls 54080->54081 54081->54054 54081->54055 54081->54056 54081->54057 54081->54058 54081->54061 54081->54062 54081->54066 54081->54070 54081->54073 54081->54074 54081->54075 54081->54076 54081->54077 54081->54078 54081->54080 54083 176130 42 API calls 54081->54083 54086 236710 150 API calls 54081->54086 54090 17af80 42 API calls 54081->54090 54091 270e60 15 API calls 54081->54091 54093 236570 89 API calls 54081->54093 54094 1f8375 54081->54094 54097 2aad50 15 API calls 54081->54097 54102 17fbf0 42 API calls 54081->54102 54103 178f00 std::_Throw_Cpp_error 42 API calls 54081->54103 54104 193672 std::_Facet_Register 42 API calls 54081->54104 54105 1a12f6 50 API calls 54081->54105 54106 1780a0 42 API calls 54081->54106 54107 1f8577 54081->54107 54108 177ef0 42 API calls 54081->54108 54109 173d50 42 API calls 54081->54109 54110 184900 42 API calls 54081->54110 54114 2ab540 15 API calls 54081->54114 54148 17c3a0 42 API calls std::_Facet_Register 54081->54148 54149 2aae80 15 API calls 54081->54149 54084 1f853a 54082->54084 54083->54081 54085 17ace0 42 API calls 54084->54085 54087 1f854f 54085->54087 54086->54081 54088 167cf0 42 API calls 54087->54088 54089 1f8567 54088->54089 54092 1951fb Concurrency::cancel_current_task RaiseException 54089->54092 54090->54081 54091->54081 54092->54057 54093->54081 54095 162cf0 std::_Throw_Cpp_error 42 API calls 54094->54095 54098 1f8388 54095->54098 54097->54081 54099 17ace0 42 API calls 54098->54099 54100 1f839d 54099->54100 54101 167cf0 42 API calls 54100->54101 54101->54089 54102->54081 54103->54081 54104->54081 54105->54081 54106->54081 54111 162cf0 std::_Throw_Cpp_error 42 API calls 54107->54111 54108->54081 54109->54081 54110->54081 54112 1f858a 54111->54112 54113 17ace0 42 API calls 54112->54113 54113->54100 54114->54081 54116 1a0fbd 54115->54116 54117 1a1005 54115->54117 54119 1a0fc3 54116->54119 54121 1a0fe0 54116->54121 54138 1a101b 50 API calls 3 library calls 54117->54138 54134 1a16ff 14 API calls __dosmaperr 54119->54134 54128 1a0ffe 54121->54128 54136 1a16ff 14 API calls __dosmaperr 54121->54136 54122 1a0fd3 54122->53801 54123 1a0fc8 54135 198c60 40 API calls __fread_nolock 54123->54135 54126 1a0fef 54137 198c60 40 API calls __fread_nolock 54126->54137 54128->53801 54129->53801 54130->53801 54131->53801 54132->53801 54133->53801 54134->54123 54135->54122 54136->54126 54137->54122 54138->54122 54139->53871 54140->53871 54141->53871 54142->53933 54143->53933 54145->53991 54146->53991 54147->53991 54148->54081 54149->54081 46063 227a80 46064 227e4c 46063->46064 46082 227abe std::ios_base::_Ios_base_dtor __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 46063->46082 46065 227b07 setsockopt recv WSAGetLastError 46065->46064 46065->46082 46067 227e37 Sleep 46067->46064 46067->46082 46069 227d95 recv 46070 227e2f Sleep 46069->46070 46070->46067 46072 227bad recv 46073 227bce recv 46072->46073 46072->46082 46073->46082 46075 227e61 46182 198c70 46075->46182 46078 227c56 setsockopt recv 46078->46082 46079 178dc0 42 API calls 46079->46078 46082->46065 46082->46067 46082->46069 46082->46070 46082->46075 46082->46078 46082->46079 46083 228510 WSAStartup 46082->46083 46096 178dc0 46082->46096 46105 1763b0 46082->46105 46110 227e70 46082->46110 46169 193069 46082->46169 46172 169280 46082->46172 46084 228616 46083->46084 46085 228548 46083->46085 46084->46082 46085->46084 46086 22857e getaddrinfo 46085->46086 46087 228610 WSACleanup 46086->46087 46089 2285c6 46086->46089 46087->46084 46088 228624 FreeAddrInfoW 46088->46087 46091 228630 46088->46091 46089->46088 46090 2285d4 socket 46089->46090 46090->46087 46092 2285ea connect 46090->46092 46091->46082 46093 228620 46092->46093 46094 2285fc closesocket 46092->46094 46093->46088 46094->46090 46095 228606 FreeAddrInfoW 46094->46095 46095->46087 46097 178e11 46096->46097 46099 178de2 __fread_nolock 46096->46099 46098 178ef8 46097->46098 46187 1632d0 46097->46187 46099->46072 46101 178e66 __fread_nolock std::locale::_Locimp::_Locimp 46102 178ecb __fread_nolock std::locale::_Locimp::_Locimp 46101->46102 46201 162fe0 46101->46201 46102->46072 46104 178eb8 46104->46072 46106 1763d8 46105->46106 46107 1763e7 46106->46107 46108 1632d0 std::_Throw_Cpp_error 42 API calls 46106->46108 46107->46082 46109 17642a std::locale::_Locimp::_Locimp 46108->46109 46109->46082 46111 227ebe 46110->46111 46112 227eec 46110->46112 46250 162cf0 46111->46250 46114 227ef4 46112->46114 46115 227f0e 46112->46115 46261 176290 42 API calls 46114->46261 46118 227f30 46115->46118 46119 227f16 46115->46119 46122 227f55 46118->46122 46124 227f38 46118->46124 46262 176290 42 API calls 46119->46262 46120 169280 45 API calls 46150 227ee4 46120->46150 46123 227f5d 46122->46123 46126 227f7b 46122->46126 46264 1a12b7 50 API calls __fread_nolock 46123->46264 46124->46150 46263 176290 42 API calls 46124->46263 46128 228240 46126->46128 46129 227f9b 46126->46129 46126->46150 46131 22829b 46128->46131 46132 228248 46128->46132 46265 165400 87 API calls std::_Throw_Cpp_error 46129->46265 46133 2282a3 46131->46133 46134 2282f6 46131->46134 46254 17b430 46132->46254 46136 17b430 55 API calls 46133->46136 46137 228351 46134->46137 46138 2282fe 46134->46138 46136->46150 46139 228359 46137->46139 46140 2283ac 46137->46140 46141 17b430 55 API calls 46138->46141 46142 17b430 55 API calls 46139->46142 46143 228404 46140->46143 46144 2283b4 46140->46144 46141->46150 46142->46150 46143->46150 46290 1b8b00 46143->46290 46147 17b430 55 API calls 46144->46147 46146 162cf0 std::_Throw_Cpp_error 42 API calls 46151 227fc0 46146->46151 46147->46150 46150->46082 46151->46146 46152 22808b 46151->46152 46164 2281f9 46151->46164 46266 17ace0 46151->46266 46269 162d30 42 API calls std::_Throw_Cpp_error 46152->46269 46154 2280af 46270 236240 44 API calls 5 library calls 46154->46270 46156 2280c0 46157 228132 GetCurrentProcess 46156->46157 46161 228165 46156->46161 46158 1763b0 std::_Throw_Cpp_error 42 API calls 46157->46158 46159 22814e 46158->46159 46271 22f200 63 API calls 3 library calls 46159->46271 46272 199820 46161->46272 46162 22815d 46162->46164 46287 192baa 46164->46287 46850 19361d 46169->46850 46173 1763b0 std::_Throw_Cpp_error 42 API calls 46172->46173 46174 1692d4 46173->46174 46175 178dc0 42 API calls 46174->46175 46177 169523 std::locale::_Locimp::_Locimp 46174->46177 46175->46177 46176 1695f0 GetModuleHandleA GetProcAddress WSASend 46176->46177 46178 1696e2 std::ios_base::_Ios_base_dtor 46176->46178 46177->46176 46177->46178 46179 198c70 std::_Throw_Cpp_error 40 API calls 46178->46179 46180 16975d std::ios_base::_Ios_base_dtor 46178->46180 46181 16979c 46179->46181 46180->46082 46181->46082 46855 198bac 40 API calls __fread_nolock 46182->46855 46184 198c7f 46856 198c8d 11 API calls std::locale::_Setgloballocale 46184->46856 46186 198c8c 46188 163306 46187->46188 46189 1632e2 46187->46189 46192 163318 46188->46192 46194 193672 std::_Facet_Register 42 API calls 46188->46194 46190 16331f 46189->46190 46191 1632e9 46189->46191 46217 162b50 42 API calls 2 library calls 46190->46217 46206 193672 46191->46206 46192->46101 46197 163310 46194->46197 46196 1632ef 46198 1632f8 46196->46198 46199 198c70 std::_Throw_Cpp_error 40 API calls 46196->46199 46197->46101 46198->46101 46200 163329 46199->46200 46202 163007 46201->46202 46203 163017 std::ios_base::_Ios_base_dtor 46201->46203 46202->46203 46204 198c70 std::_Throw_Cpp_error 40 API calls 46202->46204 46203->46104 46205 163036 46204->46205 46209 193677 46206->46209 46208 193691 46208->46196 46209->46208 46212 162b50 Concurrency::cancel_current_task 46209->46212 46218 1a23ec 46209->46218 46236 1a5a89 RtlEnterCriticalSection RtlLeaveCriticalSection std::_Facet_Register 46209->46236 46211 19369d 46211->46211 46212->46211 46225 1951fb 46212->46225 46214 162b6c 46228 194b15 46214->46228 46217->46196 46223 1ab094 __Getctype 46218->46223 46219 1ab0d2 46238 1a16ff 14 API calls __dosmaperr 46219->46238 46220 1ab0bd RtlAllocateHeap 46222 1ab0d0 46220->46222 46220->46223 46222->46209 46223->46219 46223->46220 46237 1a5a89 RtlEnterCriticalSection RtlLeaveCriticalSection std::_Facet_Register 46223->46237 46226 195242 RaiseException 46225->46226 46227 195215 46225->46227 46226->46214 46227->46226 46229 194b22 46228->46229 46235 162bac 46228->46235 46230 1a23ec ___std_exception_copy 15 API calls 46229->46230 46229->46235 46231 194b3f 46230->46231 46232 194b4f 46231->46232 46239 1a99a5 40 API calls 2 library calls 46231->46239 46240 1a1c96 46232->46240 46235->46196 46236->46209 46237->46223 46238->46222 46239->46232 46243 1ab01a 46240->46243 46244 1a1cae 46243->46244 46245 1ab025 RtlFreeHeap 46243->46245 46244->46235 46245->46244 46246 1ab03a GetLastError 46245->46246 46247 1ab047 __dosmaperr 46246->46247 46249 1a16ff 14 API calls __dosmaperr 46247->46249 46249->46244 46251 162d13 46250->46251 46251->46251 46295 163040 46251->46295 46253 162d25 46253->46120 46301 177ef0 46254->46301 46256 17b48d 46320 182100 46256->46320 46261->46150 46262->46150 46263->46150 46264->46150 46265->46151 46267 17ad10 46266->46267 46267->46267 46544 17fbf0 46267->46544 46269->46154 46270->46156 46271->46162 46553 19975e 46272->46553 46275 1a1628 46276 1a163b __fread_nolock 46275->46276 46605 1a140a 46276->46605 46288 192bc4 46287->46288 46289 192bb6 RtlReleaseSRWLockExclusive 46287->46289 46288->46150 46289->46288 46840 1b8bb0 46290->46840 46292 1b8b31 std::locale::_Locimp::_Locimp 46293 163040 std::_Throw_Cpp_error 42 API calls 46292->46293 46294 1b8b7c 46293->46294 46294->46150 46297 163052 46295->46297 46298 1630c8 46295->46298 46296 163057 std::locale::_Locimp::_Locimp 46296->46253 46297->46296 46299 1632d0 std::_Throw_Cpp_error 42 API calls 46297->46299 46300 1630a3 std::locale::_Locimp::_Locimp 46299->46300 46300->46253 46302 178034 46301->46302 46303 177f1d 46301->46303 46310 162cf0 std::_Throw_Cpp_error 42 API calls 46302->46310 46315 177f29 46302->46315 46304 177f24 46303->46304 46305 177f83 46303->46305 46306 177fcb 46303->46306 46307 177f7c 46303->46307 46308 177f2b 46303->46308 46382 17c3a0 42 API calls std::_Facet_Register 46304->46382 46312 193672 std::_Facet_Register 42 API calls 46305->46312 46306->46256 46383 17cf80 42 API calls 2 library calls 46307->46383 46309 193672 std::_Facet_Register 42 API calls 46308->46309 46309->46315 46314 17804f 46310->46314 46312->46315 46384 167f90 42 API calls 2 library calls 46314->46384 46315->46256 46317 178062 46318 1951fb Concurrency::cancel_current_task RaiseException 46317->46318 46319 178073 46318->46319 46321 18215f 46320->46321 46385 1a133b 46321->46385 46325 17b4f0 46382->46315 46383->46315 46384->46317 46404 1a9e42 GetLastError 46385->46404 46390 17fd70 46392 17fd84 46390->46392 46396 17fde4 46390->46396 46397 17fdc2 46392->46397 46523 189e20 42 API calls 4 library calls 46392->46523 46399 17fe74 46396->46399 46526 1801e0 42 API calls 46396->46526 46397->46396 46401 17fe58 46397->46401 46524 189e20 42 API calls 4 library calls 46397->46524 46399->46325 46400 17fecc 46401->46399 46405 1a9e58 46404->46405 46406 1a9e5e 46404->46406 46435 1ab65c 6 API calls std::locale::_Setgloballocale 46405->46435 46410 1a9e62 SetLastError 46406->46410 46436 1ab69b 6 API calls std::locale::_Setgloballocale 46406->46436 46409 1a9e7a 46409->46410 46437 1aa65a 14 API calls 3 library calls 46409->46437 46414 1a1346 46410->46414 46415 1a9ef7 46410->46415 46413 1a9e8f 46416 1a9ea8 46413->46416 46417 1a9e97 46413->46417 46431 1aa12d 46414->46431 46442 1a41c6 46415->46442 46439 1ab69b 6 API calls std::locale::_Setgloballocale 46416->46439 46438 1ab69b 6 API calls std::locale::_Setgloballocale 46417->46438 46422 1a9ea5 46428 1ab01a ___std_exception_copy 14 API calls 46422->46428 46423 1a9eb4 46424 1a9eb8 46423->46424 46425 1a9ecf 46423->46425 46428->46410 46432 1aa140 46431->46432 46433 18225f 46431->46433 46432->46433 46522 1b2392 40 API calls 3 library calls 46432->46522 46433->46390 46435->46406 46436->46409 46437->46413 46438->46422 46439->46423 46457 1af620 46442->46457 46471 1af54e 46457->46471 46472 1af55a __fread_nolock 46471->46472 46477 1a424b RtlEnterCriticalSection 46472->46477 46474 1af568 46477->46474 46522->46433 46523->46397 46524->46401 46526->46400 46546 17fc8d 46544->46546 46547 17fc12 std::locale::_Locimp::_Locimp 46544->46547 46545 17fd5e 46546->46545 46548 1632d0 std::_Throw_Cpp_error 42 API calls 46546->46548 46549 17fce1 std::locale::_Locimp::_Locimp 46548->46549 46550 17fd3a std::locale::_Locimp::_Locimp 46549->46550 46551 162fe0 std::_Throw_Cpp_error 40 API calls 46549->46551 46552 17fd27 46551->46552 46555 19976a __fread_nolock 46553->46555 46554 199771 46578 1a16ff 14 API calls __dosmaperr 46554->46578 46555->46554 46557 199791 46555->46557 46559 1997a3 46557->46559 46560 199796 46557->46560 46558 199776 46579 198c60 40 API calls __fread_nolock 46558->46579 46570 1aa8ef 46559->46570 46580 1a16ff 14 API calls __dosmaperr 46560->46580 46569 199781 46569->46164 46569->46275 46571 1aa8fb __fread_nolock 46570->46571 46583 1a424b RtlEnterCriticalSection 46571->46583 46573 1aa909 46584 1aa993 46573->46584 46578->46558 46579->46569 46580->46569 46583->46573 46587 1aa9b6 46584->46587 46606 1a1418 46605->46606 46607 1a1440 46605->46607 46606->46607 46841 1b8e17 46840->46841 46845 1b8c08 46840->46845 46841->46292 46842 1b8d38 __fread_nolock 46842->46841 46849 163130 42 API calls 5 library calls 46842->46849 46845->46842 46847 1987b0 50 API calls __Getctype 46845->46847 46848 163130 42 API calls 5 library calls 46845->46848 46847->46845 46848->46845 46849->46842 46851 193659 GetSystemTimeAsFileTime 46850->46851 46852 19364d GetSystemTimePreciseAsFileTime 46850->46852 46853 193077 46851->46853 46852->46853 46853->46082 46855->46184 46856->46186 46857 162e70 46858 162e88 46857->46858 46859 162ea9 46857->46859 46860 162f60 46859->46860 46861 1632d0 std::_Throw_Cpp_error 42 API calls 46859->46861 46863 162eee std::locale::_Locimp::_Locimp 46861->46863 46862 162f3c std::locale::_Locimp::_Locimp 46863->46862 46864 162fe0 std::_Throw_Cpp_error 40 API calls 46863->46864 46865 162f2b 46864->46865 46866 1a673c 46869 1a6488 46866->46869 46870 1a6494 __fread_nolock 46869->46870 46877 1a424b RtlEnterCriticalSection 46870->46877 46872 1a64a2 46878 1a64e3 46872->46878 46874 1a64af 46888 1a64d7 RtlLeaveCriticalSection std::_Lockit::~_Lockit 46874->46888 46876 1a64c0 46877->46872 46879 1a64fe 46878->46879 46887 1a6571 std::locale::_Setgloballocale 46878->46887 46880 1a6551 46879->46880 46879->46887 46889 1b11cb 46879->46889 46882 1b11cb 43 API calls 46880->46882 46880->46887 46884 1a6567 46882->46884 46883 1a6547 46885 1ab01a ___std_exception_copy 14 API calls 46883->46885 46886 1ab01a ___std_exception_copy 14 API calls 46884->46886 46885->46880 46886->46887 46887->46874 46888->46876 46890 1b11d8 46889->46890 46891 1b11f3 46889->46891 46890->46891 46892 1b11e4 46890->46892 46893 1b1202 46891->46893 46911 1b6998 41 API calls 2 library calls 46891->46911 46910 1a16ff 14 API calls __dosmaperr 46892->46910 46898 1ab9f8 46893->46898 46897 1b11e9 __fread_nolock 46897->46883 46899 1aba10 46898->46899 46900 1aba05 46898->46900 46902 1aba18 46899->46902 46908 1aba21 __Getctype 46899->46908 46912 1ab094 15 API calls 3 library calls 46900->46912 46903 1ab01a ___std_exception_copy 14 API calls 46902->46903 46906 1aba0d 46903->46906 46904 1aba4b RtlReAllocateHeap 46904->46906 46904->46908 46905 1aba26 46913 1a16ff 14 API calls __dosmaperr 46905->46913 46906->46897 46908->46904 46908->46905 46914 1a5a89 RtlEnterCriticalSection RtlLeaveCriticalSection std::_Facet_Register 46908->46914 46910->46897 46911->46893 46912->46906 46913->46906 46914->46908 47764 1c37b0 47825 1c37f9 47764->47825 47765 1c3811 47767 17ab20 42 API calls 47765->47767 47766 17ab20 42 API calls 47766->47825 47768 1c5be9 47767->47768 47769 246c20 88 API calls 47768->47769 47770 1c5c0f 47769->47770 47771 1c5c13 CreateDirectoryA 47770->47771 47773 1c5c3e 47770->47773 47771->47773 47774 1c6757 47771->47774 47772 1c69a9 47776 1785d0 78 API calls 47772->47776 47775 17b260 42 API calls 47773->47775 47779 1c672d 47773->47779 47774->47772 47781 17ab20 42 API calls 47774->47781 47819 1c5c66 47775->47819 47778 1c69c7 47776->47778 47777 2466f0 95 API calls 47777->47774 47779->47774 47779->47777 47780 17b260 42 API calls 47780->47825 47782 1c68a2 47781->47782 47784 199820 42 API calls 47782->47784 47783 2466f0 95 API calls 47783->47825 47786 1c68ca 47784->47786 47785 1c69a3 47787 19d0a8 78 API calls 47785->47787 47786->47772 47786->47785 47789 163350 78 API calls 47786->47789 47787->47772 47788 1730f0 42 API calls 47788->47825 47789->47786 47790 17b260 42 API calls 47790->47819 47791 1763b0 42 API calls std::_Throw_Cpp_error 47791->47819 47792 1763b0 42 API calls std::_Throw_Cpp_error 47792->47825 47793 246c20 88 API calls 47793->47819 47795 176240 42 API calls 47795->47819 47796 246c20 88 API calls 47796->47825 47797 162cf0 42 API calls std::_Throw_Cpp_error 47797->47819 47798 1c5e29 CreateDirectoryA 47798->47819 47799 17ac50 42 API calls 47799->47825 47800 176210 42 API calls 47800->47825 47801 199820 42 API calls 47801->47819 47802 1c5f38 CreateDirectoryA 47802->47819 47803 17ac50 42 API calls 47803->47819 47804 246b90 87 API calls 47804->47825 47805 17ae20 42 API calls 47805->47819 47806 199820 42 API calls 47806->47825 47807 17abb0 42 API calls 47807->47819 47808 17ae20 42 API calls 47808->47825 47809 1730f0 42 API calls 47809->47819 47810 17abb0 42 API calls 47810->47825 47811 19d0a8 78 API calls 47811->47819 47812 176240 42 API calls 47812->47825 47813 173200 42 API calls 47813->47819 47814 19d0a8 78 API calls 47814->47825 47815 173200 42 API calls 47815->47825 47816 162cf0 42 API calls std::_Throw_Cpp_error 47816->47825 47817 17af80 42 API calls 47817->47819 47818 17b400 42 API calls 47818->47819 47819->47779 47819->47790 47819->47791 47819->47793 47819->47795 47819->47797 47819->47798 47819->47801 47819->47802 47819->47803 47819->47805 47819->47807 47819->47809 47819->47811 47819->47813 47819->47817 47819->47818 47820 163350 78 API calls 47819->47820 47828 176210 42 API calls std::_Throw_Cpp_error 47819->47828 47829 175310 45 API calls std::_Throw_Cpp_error 47819->47829 47820->47819 47822 17af80 42 API calls 47822->47825 47823 17bae0 42 API calls 47823->47825 47824 17b400 42 API calls 47824->47825 47825->47765 47825->47766 47825->47780 47825->47783 47825->47788 47825->47792 47825->47796 47825->47799 47825->47800 47825->47804 47825->47806 47825->47808 47825->47810 47825->47812 47825->47814 47825->47815 47825->47816 47825->47822 47825->47823 47825->47824 47826 17b1e0 42 API calls 47825->47826 47827 163350 78 API calls 47825->47827 47826->47825 47827->47825 47828->47819 47829->47819 50011 1bf3e0 50012 1bf42d 50011->50012 50013 1bf44c 50011->50013 50014 1763b0 std::_Throw_Cpp_error 42 API calls 50012->50014 50015 1bf43f 50014->50015 50017 1f3ec0 50015->50017 50018 1959b0 __fread_nolock 50017->50018 50019 1f3f15 SHGetFolderPathA 50018->50019 50020 1f4080 50019->50020 50020->50020 50021 163040 std::_Throw_Cpp_error 42 API calls 50020->50021 50022 1f409c 50021->50022 50023 17fbf0 42 API calls 50022->50023 50026 1f40cd std::ios_base::_Ios_base_dtor 50023->50026 50024 246c20 88 API calls 50029 1f418d 50024->50029 50025 1f56f9 50027 198c70 std::_Throw_Cpp_error 40 API calls 50025->50027 50026->50024 50026->50025 50028 1f56fe 50027->50028 50031 177ef0 42 API calls 50028->50031 50029->50028 50030 1f56ad 50029->50030 50032 17e8a0 42 API calls 50029->50032 50030->50013 50033 1f575d 50031->50033 50034 1f4273 50032->50034 50128 1740c0 50033->50128 50036 246c20 88 API calls 50034->50036 50038 1f4294 50036->50038 50038->50030 50040 17ab20 42 API calls 50038->50040 50039 1f583c 50042 1f627d 50039->50042 50043 1f5857 50039->50043 50044 1f43c4 50040->50044 50041 177ef0 42 API calls 50041->50039 50046 162cf0 std::_Throw_Cpp_error 42 API calls 50042->50046 50045 163040 std::_Throw_Cpp_error 42 API calls 50043->50045 50047 199820 42 API calls 50044->50047 50057 1f589d std::ios_base::_Ios_base_dtor 50045->50057 50048 1f6290 50046->50048 50049 1f43e0 50047->50049 50050 17ace0 42 API calls 50048->50050 50053 1f43f8 50049->50053 50054 1f43fe 50049->50054 50051 1f62a5 50050->50051 50056 19d0a8 78 API calls 50053->50056 50058 17ab20 42 API calls 50054->50058 50056->50054 50059 1f62d1 50057->50059 50061 1f5963 CredEnumerateA 50057->50061 50062 1f44bc FindFirstFileA 50058->50062 50063 198c70 std::_Throw_Cpp_error 40 API calls 50059->50063 50064 1f6259 50061->50064 50120 1f598b std::ios_base::_Ios_base_dtor 50061->50120 50065 1f4902 50062->50065 50112 1f44f0 std::ios_base::_Ios_base_dtor 50062->50112 50064->50013 50071 1f566e 50065->50071 50072 17ab20 42 API calls 50065->50072 50068 1f48e4 FindNextFileA 50070 1f48fb FindClose 50068->50070 50068->50112 50070->50065 50078 1785d0 78 API calls 50071->50078 50074 1f49af CreateDirectoryA 50072->50074 50073 17ab20 42 API calls 50073->50112 50074->50071 50085 178f00 std::_Throw_Cpp_error 42 API calls 50085->50112 50092 17abb0 42 API calls 50092->50112 50102 199820 42 API calls 50102->50112 50108 19d0a8 78 API calls 50108->50112 50111 163040 std::_Throw_Cpp_error 42 API calls 50111->50112 50112->50025 50112->50068 50112->50073 50112->50085 50112->50092 50112->50102 50112->50108 50112->50111 50114 1842a0 42 API calls 50112->50114 50114->50112 50120->50059 50129 1740ff 50128->50129 50130 193672 std::_Facet_Register 42 API calls 50129->50130 50131 17412e 50130->50131 50132 1741ac 50131->50132 50133 18bf30 42 API calls 50131->50133 50132->50039 50132->50041 50134 174171 50133->50134 50134->50132 50138 179860 42 API calls 50134->50138 50138->50134 53536 1c6ca0 53537 1c6cea 53536->53537 53538 17ab20 42 API calls 53537->53538 53539 1c8680 53537->53539 53544 1c96cb 53537->53544 53541 1c6d81 53538->53541 53542 17ab20 42 API calls 53539->53542 53543 246c20 88 API calls 53541->53543 53545 1c876b 53542->53545 53547 1c6da7 53543->53547 53548 17ab20 42 API calls 53544->53548 53581 1c9ab4 53544->53581 53550 199820 42 API calls 53545->53550 53551 246b90 87 API calls 53547->53551 53553 1c6dca 53547->53553 53552 1c97b8 53548->53552 53549 1c9de2 53558 1c8793 53550->53558 53551->53553 53556 199820 42 API calls 53552->53556 53553->53539 53555 17b260 42 API calls 53553->53555 53560 1c7a7c 53553->53560 53554 1c9ac2 53557 17ab20 42 API calls 53554->53557 53586 1c9dd0 53554->53586 53627 1c6df9 53555->53627 53564 1c97e0 53556->53564 53559 1c9bb1 53557->53559 53558->53544 53565 163350 78 API calls 53558->53565 53563 199820 42 API calls 53559->53563 53561 1c8656 53560->53561 53562 17b260 42 API calls 53560->53562 53561->53539 53566 2466f0 95 API calls 53561->53566 53631 1c7aae 53562->53631 53568 1c9bd9 53563->53568 53567 163350 78 API calls 53564->53567 53564->53581 53569 1c883d 53565->53569 53566->53539 53585 1c9891 53567->53585 53573 163350 78 API calls 53568->53573 53568->53586 53571 17b260 42 API calls 53569->53571 53574 1c8f74 53569->53574 53608 1c8863 53571->53608 53572 1c9aae 53576 19d0a8 78 API calls 53572->53576 53588 1c9c8a 53573->53588 53575 1c96b4 53574->53575 53580 17b260 42 API calls 53574->53580 53579 19d0a8 78 API calls 53575->53579 53576->53581 53577 1730f0 42 API calls 53577->53631 53579->53544 53612 1c8fa6 53580->53612 53633 1f23c0 53581->53633 53582 1c9dca 53583 19d0a8 78 API calls 53582->53583 53583->53586 53584 173200 42 API calls 53584->53631 53585->53572 53587 163350 78 API calls 53585->53587 53685 172c30 40 API calls 2 library calls 53586->53685 53587->53585 53588->53582 53591 163350 78 API calls 53588->53591 53589 162cf0 42 API calls std::_Throw_Cpp_error 53589->53631 53590 1730f0 42 API calls 53590->53608 53591->53588 53592 173200 42 API calls 53592->53608 53593 1730f0 42 API calls 53593->53612 53594 173200 42 API calls 53594->53612 53595 162cf0 42 API calls std::_Throw_Cpp_error 53595->53608 53596 17af80 42 API calls 53596->53627 53597 17b400 42 API calls 53597->53627 53598 162cf0 42 API calls std::_Throw_Cpp_error 53598->53612 53599 17b400 42 API calls 53599->53608 53600 17af80 42 API calls 53600->53612 53601 17af80 42 API calls 53601->53631 53602 17b400 42 API calls 53602->53612 53603 17b400 42 API calls 53603->53631 53604 17af80 42 API calls 53604->53608 53605 17ac50 42 API calls 53605->53627 53606 17ac50 42 API calls 53606->53631 53607 176240 42 API calls 53607->53631 53608->53574 53608->53590 53608->53592 53608->53595 53608->53599 53608->53604 53611 163350 78 API calls 53608->53611 53609 246b90 87 API calls 53609->53627 53610 246c20 88 API calls 53610->53631 53611->53608 53612->53575 53612->53593 53612->53594 53612->53598 53612->53600 53612->53602 53616 163350 78 API calls 53612->53616 53613 246b90 87 API calls 53613->53631 53614 1763b0 42 API calls std::_Throw_Cpp_error 53614->53631 53615 1763b0 42 API calls std::_Throw_Cpp_error 53615->53627 53616->53612 53617 162cf0 42 API calls std::_Throw_Cpp_error 53617->53627 53620 246cf0 78 API calls 53620->53627 53622 246cf0 78 API calls 53622->53631 53623 199820 42 API calls 53623->53627 53624 199820 42 API calls 53624->53631 53625 176240 42 API calls 53625->53627 53626 163350 78 API calls 53626->53627 53627->53560 53627->53596 53627->53597 53627->53605 53627->53609 53627->53615 53627->53617 53627->53620 53627->53623 53627->53625 53627->53626 53628 19d0a8 78 API calls 53627->53628 53629 246c20 88 API calls 53627->53629 53658 1730f0 53627->53658 53667 173200 53627->53667 53682 2463f0 42 API calls 53627->53682 53683 176210 42 API calls std::_Throw_Cpp_error 53627->53683 53628->53627 53629->53627 53630 163350 78 API calls 53630->53631 53631->53561 53631->53577 53631->53584 53631->53589 53631->53601 53631->53603 53631->53606 53631->53607 53631->53610 53631->53613 53631->53614 53631->53622 53631->53624 53631->53630 53632 19d0a8 78 API calls 53631->53632 53684 176210 42 API calls std::_Throw_Cpp_error 53631->53684 53632->53631 53686 1f3ae0 53633->53686 53635 1f242d 53635->53554 53636 1f2427 53636->53635 53637 163040 std::_Throw_Cpp_error 42 API calls 53636->53637 53638 1f246e 53637->53638 53640 178f00 std::_Throw_Cpp_error 42 API calls 53638->53640 53641 1f2520 53640->53641 53710 1f3850 46 API calls 2 library calls 53641->53710 53643 1f29b3 53644 1785d0 78 API calls 53643->53644 53646 1f29c9 53644->53646 53645 1f29f4 53648 198c70 std::_Throw_Cpp_error 40 API calls 53645->53648 53646->53635 53647 17e8a0 42 API calls 53657 1f2547 std::ios_base::_Ios_base_dtor std::locale::_Locimp::_Locimp 53647->53657 53650 1f29fe 53648->53650 53649 17ad80 42 API calls 53649->53657 53651 17ab20 42 API calls 53651->53657 53654 1632d0 std::_Throw_Cpp_error 42 API calls 53654->53657 53655 1763b0 42 API calls std::_Throw_Cpp_error 53655->53657 53657->53643 53657->53645 53657->53647 53657->53649 53657->53651 53657->53654 53657->53655 53711 1f3000 47 API calls 4 library calls 53657->53711 53712 1f2a00 52 API calls 5 library calls 53657->53712 53713 182ac0 42 API calls 4 library calls 53657->53713 53659 173114 53658->53659 53660 17316c 53658->53660 53659->53627 53661 162cf0 std::_Throw_Cpp_error 42 API calls 53660->53661 53662 173179 53661->53662 53715 167b10 42 API calls 3 library calls 53662->53715 53664 173191 53665 1951fb Concurrency::cancel_current_task RaiseException 53664->53665 53666 1731a2 53665->53666 53668 17325c 53667->53668 53671 173225 53667->53671 53669 162cf0 std::_Throw_Cpp_error 42 API calls 53668->53669 53670 173269 53669->53670 53716 167b10 42 API calls 3 library calls 53670->53716 53672 173235 53671->53672 53675 162cf0 std::_Throw_Cpp_error 42 API calls 53671->53675 53672->53627 53674 173281 53676 1951fb Concurrency::cancel_current_task RaiseException 53674->53676 53677 17329f 53675->53677 53676->53671 53717 167b10 42 API calls 3 library calls 53677->53717 53679 1732b7 53680 1951fb Concurrency::cancel_current_task RaiseException 53679->53680 53681 1732c8 53680->53681 53682->53627 53683->53627 53684->53631 53685->53549 53687 1a23ec ___std_exception_copy 15 API calls 53686->53687 53688 1f3b25 __fread_nolock 53687->53688 53689 1a23ec ___std_exception_copy 15 API calls 53688->53689 53690 1f3b44 __fread_nolock 53689->53690 53691 1f3b57 RegOpenKeyExA 53690->53691 53692 1f3e9b 53691->53692 53693 1f3d17 RegQueryValueExA RegCloseKey 53691->53693 53692->53636 53693->53692 53694 1f3d45 53693->53694 53695 163040 std::_Throw_Cpp_error 42 API calls 53694->53695 53696 1f3d6a 53695->53696 53697 1f3d99 53696->53697 53698 1f3eb0 53696->53698 53699 163040 std::_Throw_Cpp_error 42 API calls 53697->53699 53714 179e60 42 API calls 53698->53714 53703 1f3db5 std::locale::_Locimp::_Locimp 53699->53703 53701 1f3eb5 53702 198c70 std::_Throw_Cpp_error 40 API calls 53701->53702 53708 1f3e39 53702->53708 53703->53701 53704 1f3e17 std::ios_base::_Ios_base_dtor 53703->53704 53706 1a1c96 ___std_exception_copy 14 API calls 53704->53706 53705 198c70 std::_Throw_Cpp_error 40 API calls 53707 1f3ebf 53705->53707 53706->53708 53708->53705 53709 1f3e69 std::ios_base::_Ios_base_dtor 53708->53709 53709->53636 53710->53657 53711->53657 53712->53657 53713->53657 53715->53664 53716->53674 53717->53679

                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                          Function 0016B8E0 Relevance: 79.4, APIs: 40, Strings: 2, Instructions: 5855fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016BA08
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016BAD2
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0016BF80
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0016C47A
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016C575
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0016C969
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0016CD72
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0016D17B
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016D29A
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016D6F8
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0016D9DC
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016DAD7
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0016DE41
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,?,00000000), ref: 0016E55A
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0016ECF6
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0016EEEA
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016F45B
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016F525
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 001701ED
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00170580
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0017088D
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 00170DC4
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,?,00000000), ref: 0017173C
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 00171904
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00171CD7
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 00171E6E
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 00171FBE
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00170B14
                                                                                                                                                                                                                                            • Part of subcall function 0023FE80: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,002C5B0C,00000001,0000002E,0000002F,?,002BB3BC,00172233,002BB3BC), ref: 0024035B
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 00170F12
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016FEF1
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: GetLastError.KERNEL32 ref: 00246AA0
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016FC55
                                                                                                                                                                                                                                            • Part of subcall function 0023FE80: FindFirstFileA.KERNEL32(00000000,?), ref: 0024008B
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016F933
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: SetFileAttributesA.KERNEL32(?,00000080,?,?,002E94F8,?,?), ref: 00246A0A
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: DeleteFileA.KERNEL32(?), ref: 00246A24
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: RemoveDirectoryA.KERNELBASE(?), ref: 00246A8B
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: std::_Throw_Cpp_error.LIBCPMT ref: 00246B67
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: std::_Throw_Cpp_error.LIBCPMT ref: 00246B78
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: std::_Throw_Cpp_error.LIBCPMT ref: 00246CCF
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: std::_Throw_Cpp_error.LIBCPMT ref: 00246CE0
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016E6FA
                                                                                                                                                                                                                                            • Part of subcall function 00225F80: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 002260BF
                                                                                                                                                                                                                                            • Part of subcall function 00189070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0018910D
                                                                                                                                                                                                                                            • Part of subcall function 00189070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00189155
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016DF3C
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: FindNextFileA.KERNELBASE(?,00000010), ref: 00246A38
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: FindClose.KERNEL32(?), ref: 00246A4A
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: GetLastError.KERNEL32 ref: 00246A50
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: SetFileAttributesA.KERNELBASE(?,00000080), ref: 00246A6D
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0016D5FD
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: FindFirstFileA.KERNELBASE(00000000,?,002E94F8,?,?,?,\*.*,00000004), ref: 00246865
                                                                                                                                                                                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0016BB07
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: GetFileAttributesA.KERNELBASE(?,?,?,001C0384), ref: 00246C7C
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: GetLastError.KERNEL32(?,?,001C0384), ref: 00246C87
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016BD08
                                                                                                                                                                                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0016BD37
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016C0CC
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016C196
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Directory$Create$File$Copy$Find$Cpp_errorThrow_std::_$AttributesErrorFirstLast$FolderPath___std_fs_convert_narrow_to_wide@20$CloseDeleteNextRemove
                                                                                                                                                                                                                                          • String ID: 1!u$U[b
                                                                                                                                                                                                                                          • API String ID: 1172780710-4099298338
                                                                                                                                                                                                                                          • Opcode ID: fc8d9b65c941be27eb057b90f8fa2576d6207eb3e723c4a1d4f9248f64603c33
                                                                                                                                                                                                                                          • Instruction ID: 6621d093f6e4a42f79dfbe12f0e8dd112e145c4c23b817838cc4878ddd42ab97
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fc8d9b65c941be27eb057b90f8fa2576d6207eb3e723c4a1d4f9248f64603c33
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 98F3EFB4D0425D8BDF25CFA8D981AEEBBB0BF58304F108199D849B7341DB352A85CFA5
                                                                                                                                                                                                                                          Function 0020A180 Relevance: 63.8, APIs: 10, Strings: 15, Instructions: 20001COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 0020A1F7
                                                                                                                                                                                                                                            • Part of subcall function 00225F80: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 002260BF
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFindFirstFolderPath
                                                                                                                                                                                                                                          • String ID: 1/h$@+'f$@+'f$@+'f$@+'f$@+'f$U#:$[2?$[2?$[2?$[2?$[2?$\$cannot use operator[] with a string argument with $cannot use push_back() with
                                                                                                                                                                                                                                          • API String ID: 2195519125-2428695108
                                                                                                                                                                                                                                          • Opcode ID: 045091c0ffc2a4e1ada57d8fa07d18719b6fee68e563f8e51077351ca40f28bb
                                                                                                                                                                                                                                          • Instruction ID: 3af148429b71d70950b402bb4b47217d8b8bc9a90402f1366e3ac2d99957a395
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 045091c0ffc2a4e1ada57d8fa07d18719b6fee68e563f8e51077351ca40f28bb
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8DB422B0D052698BDB25CF68C984BEEBBB5BF58304F1081D9D849A7242DB716F84CF91
                                                                                                                                                                                                                                          Function 00237580 Relevance: 52.8, APIs: 31, Instructions: 6337fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,002BB0B2,000000FF), ref: 002375EC
                                                                                                                                                                                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00237613
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 002378D9
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 00237C3B
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00238D77
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00239912
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023A29E
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0023A36F
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023A692
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023A9FD
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0023AACE
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023ADB9
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,?,?), ref: 0023B049
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023B1FC
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023B4D6
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023B8BC
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?), ref: 0023BC71
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023BE24
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023C0FE
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023C4E4
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 00239F33
                                                                                                                                                                                                                                            • Part of subcall function 0023FE80: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 002404D6
                                                                                                                                                                                                                                            • Part of subcall function 0023FE80: GetLastError.KERNEL32 ref: 00240520
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023C91C
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0023CA73
                                                                                                                                                                                                                                            • Part of subcall function 0023E3B0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0023E41D
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 00239BD3
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: SetFileAttributesA.KERNEL32(?,00000080,?,?,002E94F8,?,?), ref: 00246A0A
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: DeleteFileA.KERNEL32(?), ref: 00246A24
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: RemoveDirectoryA.KERNELBASE(?), ref: 00246A8B
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: std::_Throw_Cpp_error.LIBCPMT ref: 00246B67
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: std::_Throw_Cpp_error.LIBCPMT ref: 00246B78
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: GetLastError.KERNEL32 ref: 00246AA0
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 002395C8
                                                                                                                                                                                                                                            • Part of subcall function 0023FE80: FindNextFileA.KERNEL32(00000000,?), ref: 002404EC
                                                                                                                                                                                                                                            • Part of subcall function 0023FE80: FindClose.KERNEL32(00000000), ref: 002404FC
                                                                                                                                                                                                                                            • Part of subcall function 0023FE80: GetLastError.KERNEL32 ref: 00240502
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0023915D
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: FindNextFileA.KERNELBASE(?,00000010), ref: 00246A38
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: FindClose.KERNEL32(?), ref: 00246A4A
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: GetLastError.KERNEL32 ref: 00246A50
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: SetFileAttributesA.KERNELBASE(?,00000080), ref: 00246A6D
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 002388EA
                                                                                                                                                                                                                                            • Part of subcall function 0023FE80: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,002C5B0C,00000001,0000002E,0000002F,?,002BB3BC,00172233,002BB3BC), ref: 0024035B
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00238A9D
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?), ref: 002382E2
                                                                                                                                                                                                                                            • Part of subcall function 002466F0: FindFirstFileA.KERNELBASE(00000000,?,002E94F8,?,?,?,\*.*,00000004), ref: 00246865
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 002385A3
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 00237F9B
                                                                                                                                                                                                                                            • Part of subcall function 0023FE80: FindFirstFileA.KERNEL32(00000000,?), ref: 0024008B
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: GetFileAttributesA.KERNELBASE(?,?,?,001C0384), ref: 00246C7C
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: GetLastError.KERNEL32(?,?,001C0384), ref: 00246C87
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: std::_Throw_Cpp_error.LIBCPMT ref: 00246CCF
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: std::_Throw_Cpp_error.LIBCPMT ref: 00246CE0
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Directory$Create$File$Find$ErrorLast$CopyCpp_errorThrow_std::_$AttributesFolderPath$CloseFirstNext$DeleteRemove
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1140557632-0
                                                                                                                                                                                                                                          • Opcode ID: c788e61486ea98c9696da553aac47591b61be7c6dcca1317540bdaf7f113f8c0
                                                                                                                                                                                                                                          • Instruction ID: 78cbea4b4784b5b53bce4787c800bc90a0d773d536be68779d1fe54cae238298
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c788e61486ea98c9696da553aac47591b61be7c6dcca1317540bdaf7f113f8c0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 76F3F3B4D0525A8BCF15CFA8C991AEEBBB0BF58304F144199D949BB341DB315B84CFA2
                                                                                                                                                                                                                                          Function 001F03C0 Relevance: 28.0, APIs: 13, Strings: 2, Instructions: 1749registryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,?), ref: 001F07BB
                                                                                                                                                                                                                                          • RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 001F07EF
                                                                                                                                                                                                                                          • RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 001F0815
                                                                                                                                                                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 001F09AC
                                                                                                                                                                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 001F0C33
                                                                                                                                                                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 001F0D20
                                                                                                                                                                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 001F0E61
                                                                                                                                                                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 001F0F4B
                                                                                                                                                                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 001F1035
                                                                                                                                                                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 001F111F
                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 001F221B
                                                                                                                                                                                                                                          • RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 001F2251
                                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 001F2265
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          • cannot use push_back() with , xrefs: 001F22C5
                                                                                                                                                                                                                                          • cannot use operator[] with a string argument with , xrefs: 001F231E, 001F2373
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: QueryValue$CloseEnumOpen
                                                                                                                                                                                                                                          • String ID: cannot use operator[] with a string argument with $cannot use push_back() with
                                                                                                                                                                                                                                          • API String ID: 2041898428-3306948993
                                                                                                                                                                                                                                          • Opcode ID: c305bbda85dd0983c5a6fc15ab0a4e86c2753a045941e64b2b4657d54d0ceda9
                                                                                                                                                                                                                                          • Instruction ID: ab2a63251023c0285ac67ddbb163cf3c140afa12de6f40c870073e91c67b1e18
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c305bbda85dd0983c5a6fc15ab0a4e86c2753a045941e64b2b4657d54d0ceda9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AA1312B4C042689BDB25CF24CD84BEEBBB5BF59304F1482D9E549A7241EB716B84CF90
                                                                                                                                                                                                                                          Function 001FF050 Relevance: 22.4, APIs: 6, Strings: 5, Instructions: 3171stringCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 001FF1A4
                                                                                                                                                                                                                                          • GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 001FF2A2
                                                                                                                                                                                                                                          • GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 001FF495
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 00201BF6
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: GetFileAttributesA.KERNELBASE(?,?,?,001C0384), ref: 00246C7C
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: GetLastError.KERNEL32(?,?,001C0384), ref: 00246C87
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 00201EDD
                                                                                                                                                                                                                                          • lstrlen.KERNEL32(?), ref: 0020340E
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
                                                                                                                                                                                                                                          • String ID: Bbb$[2?$[2?$cannot use operator[] with a string argument with $cannot use push_back() with
                                                                                                                                                                                                                                          • API String ID: 2833034228-788601495
                                                                                                                                                                                                                                          • Opcode ID: 296b69c60f0f9934b144e825d3f3b0e2865881c8929c4e656ddebfdb3b8f7903
                                                                                                                                                                                                                                          • Instruction ID: a47cd3d1f79baa7d6cf626afe08ac593323a740305df9e957065efb10279f5ca
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 296b69c60f0f9934b144e825d3f3b0e2865881c8929c4e656ddebfdb3b8f7903
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2393DCB4D052A88ADB65CF28C991BEDBBB5BF59304F0481DAD84DA7241DB712BC4CF81
                                                                                                                                                                                                                                          Function 002466F0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 334fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 10772 2466f0-246743 call 192b99 10775 246b65-246b67 call 192534 10772->10775 10776 246749-246753 10772->10776 10778 246b6c-246b78 call 192534 10775->10778 10776->10778 10779 246759-2467a2 10776->10779 10781 246b7d call 162c60 10778->10781 10779->10781 10782 2467a8-2467ae 10779->10782 10786 246b82 call 198c70 10781->10786 10784 2467b0 10782->10784 10785 2467b2-2467d4 call 17e8a0 10782->10785 10784->10785 10791 2467d6-2467e2 10785->10791 10792 246802-246871 call 162df0 FindFirstFileA 10785->10792 10790 246b87-246b8f call 198c70 10786->10790 10795 2467e4-2467f2 10791->10795 10796 2467f8-2467ff call 1938f3 10791->10796 10800 246877 10792->10800 10801 246aaa 10792->10801 10795->10786 10795->10796 10796->10792 10804 246880-246889 10800->10804 10803 246aac-246ab6 10801->10803 10805 246ae4-246b00 10803->10805 10806 246ab8-246ac4 10803->10806 10807 246890-246895 10804->10807 10811 246b02-246b0e 10805->10811 10812 246b2a-246b64 call 192baa 10805->10812 10808 246ac6-246ad4 10806->10808 10809 246ada-246ae1 call 1938f3 10806->10809 10807->10807 10810 246897-2468a2 10807->10810 10808->10790 10808->10809 10809->10805 10814 2468a4-2468a7 10810->10814 10815 2468ad-2468b0 10810->10815 10816 246b20-246b27 call 1938f3 10811->10816 10817 246b10-246b1e 10811->10817 10814->10815 10820 246a2e-246a41 FindNextFileA 10814->10820 10821 2468b2-2468b5 10815->10821 10822 2468c3-2468e9 10815->10822 10816->10812 10817->10790 10817->10816 10820->10804 10825 246a47-246a5b FindClose GetLastError 10820->10825 10821->10822 10826 2468b7-2468bd 10821->10826 10822->10781 10827 2468ef-2468f5 10822->10827 10825->10803 10829 246a5d-246a63 10825->10829 10826->10820 10826->10822 10830 2468f7 10827->10830 10831 2468f9-246921 call 17e8a0 10827->10831 10832 246a65 10829->10832 10833 246a67-246a75 SetFileAttributesA 10829->10833 10830->10831 10838 246924-246929 10831->10838 10832->10833 10835 246a77-246a80 10833->10835 10836 246a82-246a86 10833->10836 10835->10803 10839 246a88 10836->10839 10840 246a8a-246a93 RemoveDirectoryA 10836->10840 10838->10838 10841 24692b-2469d9 call 178f00 call 162df0 * 3 10838->10841 10839->10840 10840->10801 10843 246a95-246a9e 10840->10843 10853 2469f9-246a12 SetFileAttributesA 10841->10853 10854 2469db-2469ee call 2466f0 10841->10854 10843->10803 10856 246aa0-246aa8 GetLastError 10853->10856 10857 246a18-246a2c DeleteFileA 10853->10857 10854->10803 10859 2469f4-2469f7 10854->10859 10856->10803 10857->10820 10857->10856 10859->10820
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • FindFirstFileA.KERNELBASE(00000000,?,002E94F8,?,?,?,\*.*,00000004), ref: 00246865
                                                                                                                                                                                                                                          • SetFileAttributesA.KERNEL32(?,00000080,?,?,002E94F8,?,?), ref: 00246A0A
                                                                                                                                                                                                                                          • DeleteFileA.KERNEL32(?), ref: 00246A24
                                                                                                                                                                                                                                          • FindNextFileA.KERNELBASE(?,00000010), ref: 00246A38
                                                                                                                                                                                                                                          • FindClose.KERNEL32(?), ref: 00246A4A
                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00246A50
                                                                                                                                                                                                                                          • SetFileAttributesA.KERNELBASE(?,00000080), ref: 00246A6D
                                                                                                                                                                                                                                          • RemoveDirectoryA.KERNELBASE(?), ref: 00246A8B
                                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00246AA0
                                                                                                                                                                                                                                          • std::_Throw_Cpp_error.LIBCPMT ref: 00246B67
                                                                                                                                                                                                                                          • std::_Throw_Cpp_error.LIBCPMT ref: 00246B78
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: File$Find$AttributesCpp_errorErrorLastThrow_std::_$CloseDeleteDirectoryFirstNextRemove
                                                                                                                                                                                                                                          • String ID: \*.*
                                                                                                                                                                                                                                          • API String ID: 460640838-1173974218
                                                                                                                                                                                                                                          • Opcode ID: 6eba1f1179260e5f343ee4c77dd2943cae625ad57f4427a6925656202572ceed
                                                                                                                                                                                                                                          • Instruction ID: 809e0c88809dd50f38d302b8d86eea1b0f8a285af2e23016fdd7e16c72bb9fac
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6eba1f1179260e5f343ee4c77dd2943cae625ad57f4427a6925656202572ceed
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 85D10270C10249CFDF18DFA8C8487EDBBB1EF56304F208259E455BB292E7719A89CB52
                                                                                                                                                                                                                                          Function 001F6330 Relevance: 19.3, APIs: 5, Strings: 5, Instructions: 1775stringCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 001F6484
                                                                                                                                                                                                                                          • GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 001F6582
                                                                                                                                                                                                                                          • GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 001F6775
                                                                                                                                                                                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001F7FF8
                                                                                                                                                                                                                                          • lstrlen.KERNEL32(?), ref: 001F84CF
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
                                                                                                                                                                                                                                          • String ID: @+'f$[2?$`gn+$cannot use operator[] with a string argument with $cannot use push_back() with
                                                                                                                                                                                                                                          • API String ID: 3203477177-818090161
                                                                                                                                                                                                                                          • Opcode ID: ff6028724f9de476f2ee2ff3e4a4d7869b58b10399f2c7397dfb71fd259569ce
                                                                                                                                                                                                                                          • Instruction ID: 9c0f294aeac43f9d53d64836175e7322bff8f119ff7f089a130fa37cf9f7aedc
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ff6028724f9de476f2ee2ff3e4a4d7869b58b10399f2c7397dfb71fd259569ce
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1C23F0B4D052688BDB25CF28CC94BEDBBB5AF59304F1082D9E94DA7241DB316B84CF91
                                                                                                                                                                                                                                          Function 001F8630 Relevance: 17.9, APIs: 4, Strings: 5, Instructions: 2129stringCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 001F8784
                                                                                                                                                                                                                                          • GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 001F8882
                                                                                                                                                                                                                                          • GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 001F8A78
                                                                                                                                                                                                                                          • lstrlen.KERNEL32(?), ref: 001FAD91
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
                                                                                                                                                                                                                                          • String ID: (2?$[2?$cannot use operator[] with a string argument with $cannot use push_back() with $ J6
                                                                                                                                                                                                                                          • API String ID: 1311570089-2412125412
                                                                                                                                                                                                                                          • Opcode ID: 83331efdcec97a47bc7fe2fef1d84181619deb8ebf91cd4673642def3f6edd2d
                                                                                                                                                                                                                                          • Instruction ID: 6122013fd568b038db4c3d6d13b4533772438852d333bc1b37c8d93b3c383066
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 83331efdcec97a47bc7fe2fef1d84181619deb8ebf91cd4673642def3f6edd2d
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3C4332B0D052688BDB25CF28C8847EEBBB5BF59304F1482D9E54DA7242DB756B84CF81
                                                                                                                                                                                                                                          Function 001FD320 Relevance: 12.1, APIs: 4, Strings: 2, Instructions: 1570stringCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 001FD474
                                                                                                                                                                                                                                          • GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 001FD572
                                                                                                                                                                                                                                          • GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 001FD765
                                                                                                                                                                                                                                          • lstrlen.KERNEL32(?), ref: 001FEEB2
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
                                                                                                                                                                                                                                          • String ID: cannot use operator[] with a string argument with $cannot use push_back() with
                                                                                                                                                                                                                                          • API String ID: 1311570089-3306948993
                                                                                                                                                                                                                                          • Opcode ID: 46947ddbd54443d5909863da2dde7bcd9c54e1ce880e46149be318b67623221e
                                                                                                                                                                                                                                          • Instruction ID: 85818587b7a2e4d4cd4b7d59ff7040d7ff366b661276ee6468866e2f16622a38
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 46947ddbd54443d5909863da2dde7bcd9c54e1ce880e46149be318b67623221e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 010335B0D052688BDB25CF28C884BEEBBB5BF59304F1481D9E549A7241EB716F84CF91
                                                                                                                                                                                                                                          Function 0023E3B0 Relevance: 8.2, APIs: 5, Instructions: 731fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 13215 23e3b0-23e4bb call 1959b0 SHGetFolderPathA 13218 23e4c0-23e4c5 13215->13218 13218->13218 13219 23e4c7-23e4e3 call 163040 13218->13219 13222 23e4e6-23e4eb 13219->13222 13222->13222 13223 23e4ed-23e5cd call 17fbf0 call 178f00 13222->13223 13228 23e5cf-23e5de 13223->13228 13229 23e5fe-23e626 13223->13229 13230 23e5e0-23e5ee 13228->13230 13231 23e5f4-23e5fb call 1938f3 13228->13231 13232 23e657-23e68a call 246c20 13229->13232 13233 23e628-23e637 13229->13233 13230->13231 13234 23ef96 call 198c70 13230->13234 13231->13229 13245 23e690-23e74a call 17ab20 call 246cf0 13232->13245 13246 23ef16-23ef26 13232->13246 13236 23e639-23e647 13233->13236 13237 23e64d-23e654 call 1938f3 13233->13237 13243 23ef9b call 162c60 13234->13243 13236->13234 13236->13237 13237->13232 13251 23efa0 call 162c60 13243->13251 13267 23e750-23e830 call 17ab20 call 17ad80 call 162df0 call 246c20 13245->13267 13268 23ea94-23eb24 13245->13268 13248 23ef53-23ef95 call 162df0 * 2 13246->13248 13249 23ef28-23ef37 13246->13249 13252 23ef49-23ef50 call 1938f3 13249->13252 13253 23ef39-23ef47 13249->13253 13262 23efa5 call 162c60 13251->13262 13252->13248 13253->13252 13258 23efaa-23efaf call 198c70 13253->13258 13262->13258 13287 23e832-23e851 CreateDirectoryA 13267->13287 13288 23e857-23e902 call 17ab20 13267->13288 13272 23eb27-23eb2c 13268->13272 13272->13272 13274 23eb2e-23eb39 13272->13274 13274->13251 13276 23eb3f-23eba7 call 17e8a0 call 246c20 call 162df0 13274->13276 13276->13246 13292 23ebad-23ec81 call 17ab20 call 17ad80 call 162df0 call 246c20 13276->13292 13287->13288 13290 23ea85-23ea8f call 162df0 13287->13290 13297 23e906-23e999 13288->13297 13298 23e904 13288->13298 13290->13268 13311 23ec83-23ec99 CreateDirectoryA 13292->13311 13312 23ec9f-23ed2f 13292->13312 13300 23e9a0-23e9a5 13297->13300 13298->13297 13300->13300 13302 23e9a7-23e9b2 13300->13302 13302->13243 13304 23e9b8-23ea31 call 17e8a0 CopyFileA call 162df0 * 2 13302->13304 13321 23ea33-23ea3c 13304->13321 13322 23ea3e-23ea7b call 162cf0 call 2466f0 call 162df0 13304->13322 13311->13312 13314 23ef07 13311->13314 13316 23ed32-23ed37 13312->13316 13317 23ef0a-23ef11 call 162df0 13314->13317 13316->13316 13319 23ed39-23ed42 13316->13319 13317->13246 13319->13262 13323 23ed48-23edd7 call 17e8a0 call 162df0 * 2 call 246c20 13319->13323 13324 23ea80 13321->13324 13322->13324 13338 23edf5-23eec1 call 1763b0 call 17ab20 call 23fe80 13323->13338 13339 23edd9-23edef CreateDirectoryA 13323->13339 13324->13290 13346 23eec3-23eecc 13338->13346 13347 23eece-23ef02 call 162cf0 call 2466f0 call 162df0 13338->13347 13339->13317 13339->13338 13346->13314 13347->13314
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0023E41D
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: GetFileAttributesA.KERNELBASE(?,?,?,001C0384), ref: 00246C7C
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: GetLastError.KERNEL32(?,?,001C0384), ref: 00246C87
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: std::_Throw_Cpp_error.LIBCPMT ref: 00246CCF
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: std::_Throw_Cpp_error.LIBCPMT ref: 00246CE0
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023E849
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,00000000,00000000), ref: 0023EA03
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023EC91
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 0023EDE7
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesCopyErrorFolderLastPath
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1001086254-0
                                                                                                                                                                                                                                          • Opcode ID: 9e3c868256a18461633979e3c8fa30f34a59af4d989748595b686ad032379ee9
                                                                                                                                                                                                                                          • Instruction ID: 419dfb085be3f416de515836fb5d9f209f52b412a352c5acadca4474af8c6ea7
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e3c868256a18461633979e3c8fa30f34a59af4d989748595b686ad032379ee9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E08205B4C042598BDF15CFA8C995BEEBBB0BF58304F144199D949BB241E7705B84CFA1
                                                                                                                                                                                                                                          Function 0029F480 Relevance: 3.5, APIs: 2, Instructions: 484COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0029F635
                                                                                                                                                                                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0029F937
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 885266447-0
                                                                                                                                                                                                                                          • Opcode ID: 2085bceb95568e77d325e9bd43b9077126b3fffa11b3b2e3168bac034532e670
                                                                                                                                                                                                                                          • Instruction ID: 0658f3372cda04d3eea54ec477dfb08c9eb09986be35dd2e463a0c43a07570e2
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2085bceb95568e77d325e9bd43b9077126b3fffa11b3b2e3168bac034532e670
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 43026970624603AFDB94CF28CA40BAAB7E4BF88314F14867DE859C7650D774E9A5CB81
                                                                                                                                                                                                                                          Function 001BE0C0 Relevance: 17.4, APIs: 11, Instructions: 889COMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 11656 1be0c0-1be1c6 call 16b8e0 call 1732d0 call 17ab20 CreateDirectoryA 11663 1be1cc-1be1d0 11656->11663 11664 1be861-1be868 11656->11664 11665 1be1d2-1be1ed 11663->11665 11666 1be86e-1be90a call 1732d0 call 17ab20 CreateDirectoryA 11664->11666 11667 1bf0ed-1bf3d2 call 162df0 11664->11667 11668 1be1f3-1be33d call 1763b0 * 4 call 1732d0 call 17ab20 call 17ad80 call 162df0 call 246c20 11665->11668 11669 1be825-1be850 call 1763b0 call 23efb0 11665->11669 11684 1bf0de-1bf0e8 call 162df0 11666->11684 11685 1be910-1be914 11666->11685 11727 1be33f-1be357 CreateDirectoryA 11668->11727 11728 1be35d-1be430 call 1732d0 call 17ab20 call 17ad80 call 1762c0 call 162df0 * 2 call 246c20 11668->11728 11669->11664 11690 1be852-1be859 call 2466f0 11669->11690 11684->11667 11689 1be916-1be931 11685->11689 11692 1bf09f-1bf0cd call 1763b0 call 237580 11689->11692 11693 1be937-1bea87 call 1763b0 * 4 call 1732d0 call 17ab20 call 17ad80 call 162df0 call 246c20 11689->11693 11698 1be85e 11690->11698 11692->11684 11708 1bf0cf-1bf0d6 call 2466f0 11692->11708 11746 1bea89-1beaa1 CreateDirectoryA 11693->11746 11747 1beaa7-1beb7a call 1732d0 call 17ab20 call 17ad80 call 1762c0 call 162df0 * 2 call 246c20 11693->11747 11698->11664 11714 1bf0db 11708->11714 11714->11684 11727->11728 11730 1be7d4-1be820 call 162df0 * 5 11727->11730 11779 1be432-1be44a CreateDirectoryA 11728->11779 11780 1be450-1be457 11728->11780 11730->11665 11746->11747 11750 1bf04e-1bf09a call 162df0 * 5 11746->11750 11806 1beb9a-1beba1 11747->11806 11807 1beb7c-1beb94 CreateDirectoryA 11747->11807 11750->11689 11779->11730 11779->11780 11783 1be45d-1be51d call 1732d0 call 17ab20 call 17ad80 call 162df0 call 246c20 11780->11783 11784 1be560-1be564 11780->11784 11841 1be51f-1be540 CreateDirectoryA 11783->11841 11842 1be542-1be54c call 176290 11783->11842 11788 1be5ce-1be5d2 11784->11788 11789 1be566-1be5c9 call 1732d0 11784->11789 11794 1be639-1be67f call 1732d0 11788->11794 11795 1be5d4-1be637 call 1732d0 11788->11795 11801 1be684-1be772 call 162cf0 call 1732d0 call 17ab20 call 17ae20 call 1762c0 call 162df0 * 3 call 246c20 11789->11801 11794->11801 11795->11801 11894 1be78e-1be7ce call 1763b0 * 2 call 23fe80 11801->11894 11895 1be774-1be78c CreateDirectoryA 11801->11895 11810 1becaa-1becae 11806->11810 11811 1beba7-1bec67 call 1732d0 call 17ab20 call 17ad80 call 162df0 call 246c20 11806->11811 11807->11750 11807->11806 11814 1bedc3-1bedc7 11810->11814 11815 1becb4-1bed4e call 1732d0 call 17ab20 call 246c20 11810->11815 11872 1bec69-1bec8a CreateDirectoryA 11811->11872 11873 1bec8c-1bec96 call 176290 11811->11873 11819 1bedc9-1bee2c call 1732d0 11814->11819 11820 1bee31-1bee35 11814->11820 11856 1bed73-1bedb1 call 1763b0 * 2 call 23fe80 11815->11856 11857 1bed50-1bed71 CreateDirectoryA 11815->11857 11838 1beeff-1befce call 162cf0 call 1732d0 call 17ab20 call 17ae20 call 162df0 * 2 call 246c20 11819->11838 11828 1bee9c-1beefa call 1732d0 11820->11828 11829 1bee37-1bee9a call 1732d0 11820->11829 11828->11838 11829->11838 11900 1beff3-1bf039 call 1763b0 * 2 call 23fe80 11838->11900 11901 1befd0-1beff1 CreateDirectoryA 11838->11901 11841->11842 11847 1be551-1be55b call 162df0 11841->11847 11842->11847 11847->11784 11861 1bedb4-1bedbe 11856->11861 11857->11856 11857->11861 11870 1bf049 call 162df0 11861->11870 11870->11750 11872->11873 11877 1bec9b-1beca5 call 162df0 11872->11877 11873->11877 11877->11810 11894->11730 11911 1be7d0 11894->11911 11895->11730 11895->11894 11903 1bf03f-1bf043 11900->11903 11914 1bf03b 11900->11914 11901->11900 11901->11903 11903->11870 11911->11730 11914->11903
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 0016B8E0: CreateDirectoryA.KERNELBASE(?,00000000), ref: 0016BA08
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 001BE1C2
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 001BE353
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 001BE446
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 001BE53C
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 001BE788
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 001BE906
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 001BEA9D
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 001BEB90
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: GetFileAttributesA.KERNELBASE(?,?,?,001C0384), ref: 00246C7C
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: GetLastError.KERNEL32(?,?,001C0384), ref: 00246C87
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 001BEC86
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: std::_Throw_Cpp_error.LIBCPMT ref: 00246CCF
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: std::_Throw_Cpp_error.LIBCPMT ref: 00246CE0
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 001BED6D
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 001BEFED
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 453214671-0
                                                                                                                                                                                                                                          • Opcode ID: 35376d3be5255a5063b81049d93d97a215998c4cbcc8a76ca284d878ff996d62
                                                                                                                                                                                                                                          • Instruction ID: 992d6aed258d3926c03fd79296227f360b4423809289bf913deafb101a9308d9
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 35376d3be5255a5063b81049d93d97a215998c4cbcc8a76ca284d878ff996d62
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EFA214B0D042688BDB25DB64CD95BDDBBB4AF14304F5081E9E44AA7282EB305F88DF52
                                                                                                                                                                                                                                          Function 002446A0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 291registryCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 12264 2446a0-2449f8 call 1959b0 RegGetValueA 12267 244a28-244a2c 12264->12267 12268 2449fa-244a09 12264->12268 12270 244a32-244a64 call 1959b0 GetComputerNameExA 12267->12270 12271 244b2d-244b40 12267->12271 12269 244a10-244a15 12268->12269 12269->12269 12272 244a17-244a23 call 176130 12269->12272 12276 244a66-244a6f 12270->12276 12277 244a88-244a8c 12270->12277 12272->12267 12278 244a70-244a75 12276->12278 12277->12271 12279 244a92-244abd call 1959b0 LsaOpenPolicy 12277->12279 12278->12278 12281 244a77-244a83 call 176130 12278->12281 12284 244b05-244b12 12279->12284 12285 244abf-244ad0 LsaQueryInformationPolicy 12279->12285 12281->12277 12288 244b15-244b1a 12284->12288 12286 244ad2-244ad9 12285->12286 12287 244afc-244aff LsaClose 12285->12287 12289 244ade-244af6 call 163440 LsaFreeMemory 12286->12289 12290 244adb 12286->12290 12287->12284 12288->12288 12291 244b1c-244b28 call 176130 12288->12291 12289->12287 12290->12289 12291->12271
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RegGetValueA.KERNELBASE(80000002,?,?,0001FFFF,?,?,00000104), ref: 002449F0
                                                                                                                                                                                                                                          • GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 00244A5C
                                                                                                                                                                                                                                          • LsaOpenPolicy.ADVAPI32(00000000,002E7684,00000001,?), ref: 00244AB5
                                                                                                                                                                                                                                          • LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 00244AC8
                                                                                                                                                                                                                                          • LsaFreeMemory.ADVAPI32(?), ref: 00244AF6
                                                                                                                                                                                                                                          • LsaClose.ADVAPI32(?), ref: 00244AFF
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
                                                                                                                                                                                                                                          • String ID: %wZ
                                                                                                                                                                                                                                          • API String ID: 762890658-705104578
                                                                                                                                                                                                                                          • Opcode ID: 48369032b86416c0f2e12b0a91907ebedeb8fd4c8bd836f85c642f2725f50b90
                                                                                                                                                                                                                                          • Instruction ID: aa05b309258f0053ef0b0fc675accf74c4d5a42f376bc1d27d611ff52dc987a8
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 48369032b86416c0f2e12b0a91907ebedeb8fd4c8bd836f85c642f2725f50b90
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1EE113B4D0025A8BDB14DF98D986BEEBBB5FF08304F204199E949B7341D7706A84CFA5
                                                                                                                                                                                                                                          Function 00228510 Relevance: 12.1, APIs: 8, Instructions: 92networkCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 12295 228510-228542 WSAStartup 12296 228616-22861f 12295->12296 12297 228548-228572 call 24a3a0 * 2 12295->12297 12302 228574-228578 12297->12302 12303 22857e-2285c4 getaddrinfo 12297->12303 12302->12296 12302->12303 12304 228610 WSACleanup 12303->12304 12305 2285c6-2285cc 12303->12305 12304->12296 12306 228624-22862e FreeAddrInfoW 12305->12306 12307 2285ce 12305->12307 12306->12304 12309 228630-228638 12306->12309 12308 2285d4-2285e8 socket 12307->12308 12308->12304 12310 2285ea-2285fa connect 12308->12310 12311 228620 12310->12311 12312 2285fc-228604 closesocket 12310->12312 12311->12306 12312->12308 12313 228606-22860a FreeAddrInfoW 12312->12313 12313->12304
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddrFreeInfo$CleanupStartupclosesocketconnectgetaddrinfosocket
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 448659506-0
                                                                                                                                                                                                                                          • Opcode ID: d01f6fb38024dd424db82b6f7061df590e9b04b2f283dd96b8d307b8b2fc8b59
                                                                                                                                                                                                                                          • Instruction ID: 6902065fc40e9a543f19e226f99192a719e625be9e7dce16d3de120869c7fcab
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d01f6fb38024dd424db82b6f7061df590e9b04b2f283dd96b8d307b8b2fc8b59
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B431C371905711AFD7209F64EC48A6ABBE9FB84734F104B59F8A4922E1E731E8148B93
                                                                                                                                                                                                                                          Function 00169280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382libraryloadernetworkCOMMON
                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                          control_flow_graph 13353 169280-1692dd call 1763b0 13356 169413-169521 call 162df0 call 24a3a0 13353->13356 13357 1692e3-1692e9 13353->13357 13371 169537-16953f call 178dc0 13356->13371 13372 169523-169535 13356->13372 13358 1692f0-169313 13357->13358 13360 169324-169331 13358->13360 13361 169315-16931f 13358->13361 13364 169342-16934f 13360->13364 13365 169333-16933d 13360->13365 13363 169403-169406 13361->13363 13367 169409-16940d 13363->13367 13368 169360-16936d 13364->13368 13369 169351-16935b 13364->13369 13365->13363 13367->13356 13367->13358 13373 16937e-16938b 13368->13373 13374 16936f-169379 13368->13374 13369->13363 13377 169544-169597 call 24a3a0 * 2 13371->13377 13372->13377 13375 16938d-169397 13373->13375 13376 169399-1693a6 13373->13376 13374->13363 13375->13363 13379 1693b4-1693c1 13376->13379 13380 1693a8-1693b2 13376->13380 13390 1695cb-1695e1 call 24a3a0 13377->13390 13391 169599-1695c8 call 24a3a0 call 195270 13377->13391 13382 1693c3-1693cd 13379->13382 13383 1693cf-1693dc 13379->13383 13380->13363 13382->13363 13385 1693de-1693e8 13383->13385 13386 1693ea-1693f4 13383->13386 13385->13363 13386->13367 13389 1693f6-1693ff 13386->13389 13389->13363 13396 1695e7-1695ed 13390->13396 13397 1696e2 13390->13397 13391->13390 13399 1695f0-1696ce GetModuleHandleA GetProcAddress WSASend 13396->13399 13400 1696e6-1696f0 13397->13400 13402 1696d4-1696dc 13399->13402 13403 16975f-169763 13399->13403 13404 1696f2-1696fe 13400->13404 13405 16971e-16973d 13400->13405 13402->13397 13402->13399 13403->13400 13406 169714-16971b call 1938f3 13404->13406 13407 169700-16970e 13404->13407 13408 16976f-169796 13405->13408 13409 16973f-16974b 13405->13409 13406->13405 13407->13406 13410 169797-1697fe call 198c70 call 162df0 * 2 13407->13410 13412 169765-16976c call 1938f3 13409->13412 13413 16974d-16975b 13409->13413 13412->13408 13413->13410 13417 16975d 13413->13417 13417->13412
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,002AD08C,00000000,761B23A0,-002E9880), ref: 001696A6
                                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 001696B4
                                                                                                                                                                                                                                          • WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,002AD08C,00000000,761B23A0,-002E9880), ref: 001696C9
                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AddressHandleModuleProcSend
                                                                                                                                                                                                                                          • String ID: Ws2_32.dll
                                                                                                                                                                                                                                          • API String ID: 2819740048-3093949381
                                                                                                                                                                                                                                          • Opcode ID: dd61df565ffc1de713406c9de5c023e21860e15820890774976c8e88590106d1
                                                                                                                                                                                                                                          • Instruction ID: 7192952803b6933b3566a93a6a67f262d5221e4e4fec59004c3b2b5a04c25188
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dd61df565ffc1de713406c9de5c023e21860e15820890774976c8e88590106d1
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AC02CC70D14298DFDF25CFA8CC90BADBBB4EF55314F244289E4866B682D7701986CF92
                                                                                                                                                                                                                                          Function 001C37B0 Relevance: 6.9, APIs: 3, Instructions: 2365COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: GetFileAttributesA.KERNELBASE(?,?,?,001C0384), ref: 00246C7C
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: GetLastError.KERNEL32(?,?,001C0384), ref: 00246C87
                                                                                                                                                                                                                                            • Part of subcall function 00246B90: CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 00246BD5
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000), ref: 001C5C30
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 001C5F55
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: std::_Throw_Cpp_error.LIBCPMT ref: 00246CCF
                                                                                                                                                                                                                                            • Part of subcall function 00246C20: std::_Throw_Cpp_error.LIBCPMT ref: 00246CE0
                                                                                                                                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 001C5E46
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 453214671-0
                                                                                                                                                                                                                                          • Opcode ID: 70a8afac1d7fbee7ee244885518d5b7842f07840fa7872a2f4dddf5e9c736301
                                                                                                                                                                                                                                          • Instruction ID: 08f2de43e1ea28dfd2ed8aa5d809bceca63962311b46d120b2cab6de63fc4a74
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 70a8afac1d7fbee7ee244885518d5b7842f07840fa7872a2f4dddf5e9c736301
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9553BBB0D152688BDB65DB54CD94BEDBBB4AF58300F4081EAE44EA7252DB306F84DF81
                                                                                                                                                                                                                                          Function 00236710 Relevance: 4.8, APIs: 3, Instructions: 278fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • CopyFileA.KERNEL32(?,?,00000000), ref: 002369A0
                                                                                                                                                                                                                                            • Part of subcall function 00236B20: GetLastError.KERNEL32(?,00000000), ref: 00236B53
                                                                                                                                                                                                                                            • Part of subcall function 00236B20: 6C9F7CF0.RSTRTMGR(?,00000000,?), ref: 00236BD0
                                                                                                                                                                                                                                          • std::_Throw_Cpp_error.LIBCPMT ref: 00236B04
                                                                                                                                                                                                                                          • std::_Throw_Cpp_error.LIBCPMT ref: 00236B15
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Cpp_errorThrow_std::_$CopyErrorFileLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1723067277-0
                                                                                                                                                                                                                                          • Opcode ID: 8dcdba3dd8bb82997e4b7405bb23f716808d4ce905790894b58b11d891bd3582
                                                                                                                                                                                                                                          • Instruction ID: 0bd27df61df7aa5cf908f4482929fcfb8b694e19013c34e2ef345af34a0e51f0
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8dcdba3dd8bb82997e4b7405bb23f716808d4ce905790894b58b11d891bd3582
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A4D17CB0C00249DBDB04DFA8D9457EEFBB5AF55304F148199D809B7382EB715A89CBA2
                                                                                                                                                                                                                                          Function 00245770 Relevance: 3.4, APIs: 2, Instructions: 350COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0024580F
                                                                                                                                                                                                                                          • GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00245B1B
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: DirectoryInformationVolumeWindows
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3487004747-0
                                                                                                                                                                                                                                          • Opcode ID: 2370c49d57658d6a6c029f14b1c71d032e558c237ef2167794c5e74d87d967b9
                                                                                                                                                                                                                                          • Instruction ID: abf6a60dba784e84324be9b000d9fbe8ebf523f82b3c25ac4b3b8836ca5c4261
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2370c49d57658d6a6c029f14b1c71d032e558c237ef2167794c5e74d87d967b9
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D7F147B0D00249DBDB14CFA8D985BEEFBB1BF48304F244259E545BB342E7716A84CBA1
                                                                                                                                                                                                                                          Function 001A9789 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                            • Part of subcall function 001A8E9F: GetConsoleOutputCP.KERNEL32(C73789BD,00000000,00000000,?), ref: 001A8F02
                                                                                                                                                                                                                                          • WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001A990E
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 001A9918
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ConsoleErrorFileLastOutputWrite
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2915228174-0
                                                                                                                                                                                                                                          • Opcode ID: 5ddaee32d57cf328694edbdc29f94b7b0c82f01036272adce64da41443aa0ead
                                                                                                                                                                                                                                          • Instruction ID: a4a67f1c35aaf3e032b7e32ec8aa8e36ac0682c32dc6c3889e1acb9623644517
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ddaee32d57cf328694edbdc29f94b7b0c82f01036272adce64da41443aa0ead
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A461B479C04119BFDF15CFA8C884AFE7BB9AF1B308F140149E904A7256D735D981CBA0
                                                                                                                                                                                                                                          Function 00236570 Relevance: 3.1, APIs: 2, Instructions: 131COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • std::_Throw_Cpp_error.LIBCPMT ref: 002366EA
                                                                                                                                                                                                                                          • std::_Throw_Cpp_error.LIBCPMT ref: 002366FB
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Cpp_errorThrow_std::_
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2134207285-0
                                                                                                                                                                                                                                          • Opcode ID: d6b32b1902493ff7e0abcc0e7d08053c0bb4afa4ccc4cbd3bcc42856d32b26d5
                                                                                                                                                                                                                                          • Instruction ID: 342c3dead597c4660cd86ce44800c28436288092ed8fd40f4d7e88f1def9d236
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d6b32b1902493ff7e0abcc0e7d08053c0bb4afa4ccc4cbd3bcc42856d32b26d5
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D84116B1E102419BCB20DF68ED4A76EB7A8AB91310F18432AE8155B3C1EB75D964CBD1
                                                                                                                                                                                                                                          Function 001A251C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • SetFilePointerEx.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?,?,001A2626,?,?,?,?,?), ref: 001A2558
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,001A2626,?,?,?,?,?,00000000,?,00000000), ref: 001A2565
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2976181284-0
                                                                                                                                                                                                                                          • Opcode ID: bd34e5848556829e7e09ebf0d31c70633a01bf48d2c119b83a2016393de73732
                                                                                                                                                                                                                                          • Instruction ID: 7e36597ee461f17490a4a4d04011441f640b1e6fc6e1a20d52cf2401ba619bfa
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bd34e5848556829e7e09ebf0d31c70633a01bf48d2c119b83a2016393de73732
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7201D636B10255AFCF098F69DC599DE7B6AEB96330F240208F8159B2A1E771ED418B90
                                                                                                                                                                                                                                          Function 001AB01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RtlFreeHeap.NTDLL(00000000,00000000,?,001B1B48,?,00000000,?,?,001B1DE9,?,00000007,?,?,001B22DD,?,?), ref: 001AB030
                                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,001B1B48,?,00000000,?,?,001B1DE9,?,00000007,?,?,001B22DD,?,?), ref: 001AB03B
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 485612231-0
                                                                                                                                                                                                                                          • Opcode ID: 30d5e939d1b387496fe88e0dd2d65c97cef3eaa464fa3fdc542d60f687d3611a
                                                                                                                                                                                                                                          • Instruction ID: 08cc996ecd8f100231db8ae1cb53e367a2a1f84025c02312b6b1c1d274c3d78d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 30d5e939d1b387496fe88e0dd2d65c97cef3eaa464fa3fdc542d60f687d3611a
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B1E08C36104244ABCB252FB8FC0DB8A3B69AF02751F448524F61CDA0A1DB748C90C784
                                                                                                                                                                                                                                          Function 00175350 Relevance: 1.7, APIs: 1, Instructions: 184COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • Concurrency::cancel_current_task.LIBCPMT ref: 0017546E
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 118556049-0
                                                                                                                                                                                                                                          • Opcode ID: 4ed2c2b1c079044e5b9d6f705801c70c4f95877cd04188fe2f2bfa364d74cf1c
                                                                                                                                                                                                                                          • Instruction ID: 34e8c6a53be14406f0a624b84f48a1358d8a3d6fb3470dcd4f8a93f45d4ec1ec
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4ed2c2b1c079044e5b9d6f705801c70c4f95877cd04188fe2f2bfa364d74cf1c
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 906198B1A01614DFCB10CF59C984B6ABBF5FF48710F24816EE45A9B391C7B5EA01CB90
                                                                                                                                                                                                                                          Function 00183800 Relevance: 1.7, APIs: 1, Instructions: 174COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • Concurrency::cancel_current_task.LIBCPMT ref: 001839F6
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 118556049-0
                                                                                                                                                                                                                                          • Opcode ID: c8fcb5903325fa4dfd8bf409b75b200f34f47a3130968d34d7ad6929f39fe98e
                                                                                                                                                                                                                                          • Instruction ID: 48f3946fb78c1eb7196286b5e2fafb79b981f0768afc13a71c56ef9235ec1f05
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c8fcb5903325fa4dfd8bf409b75b200f34f47a3130968d34d7ad6929f39fe98e
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CF51A471E002459FCB18EF68DE86AADBBB5EB58704F14422AE415EB3D1D770AB40CF91
                                                                                                                                                                                                                                          Function 002475C0 Relevance: 1.6, APIs: 1, Instructions: 125COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: __fread_nolock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2638373210-0
                                                                                                                                                                                                                                          • Opcode ID: 4b8147b651d6984f2a56de2e7f28ee965f3d9537b7757c7562171139b52af862
                                                                                                                                                                                                                                          • Instruction ID: 18ca7a95ea60ed21d3a33d630e9b0237bc0dcc1d946b8ffc632101716f8536e5
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4b8147b651d6984f2a56de2e7f28ee965f3d9537b7757c7562171139b52af862
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F7515AB0D002499BDB20DFA8D986BAEFBB4FF54714F14411DE8416B381D7756A44CBE2
                                                                                                                                                                                                                                          Function 00247440 Relevance: 1.6, APIs: 1, Instructions: 119COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: __fread_nolock
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 2638373210-0
                                                                                                                                                                                                                                          • Opcode ID: 0f01c031f2eaa65b55efecba6686b2db78a16afef98ed5fefeec352f3dfc4066
                                                                                                                                                                                                                                          • Instruction ID: d407dd5d87519a733a43894ee12f88ed197b85eb6279dc2fffab704db07e0898
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0f01c031f2eaa65b55efecba6686b2db78a16afef98ed5fefeec352f3dfc4066
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0F416BB4D00208AFDF04DF98D882BEEBBB4FF58714F144169E815AB381E7759A01CBA1
                                                                                                                                                                                                                                          Function 00166870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • ___std_fs_directory_iterator_open@12.LIBCPMT ref: 00166908
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: ___std_fs_directory_iterator_open@12
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 29801545-0
                                                                                                                                                                                                                                          • Opcode ID: 3fad4ae830fd8dea80b847944a6a1536916b48e1baac64b653edadd64b762e14
                                                                                                                                                                                                                                          • Instruction ID: 68bc777aee43f7db3bdc7d7f3dfa7fb05aad7cc60de711e41352e4d5e5a10121
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3fad4ae830fd8dea80b847944a6a1536916b48e1baac64b653edadd64b762e14
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8821D276E00619ABCB18DF48D841BAEF7B8FB84324F00066AEC2963780DB356D10CBD0
                                                                                                                                                                                                                                          Function 001632D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • Concurrency::cancel_current_task.LIBCPMT ref: 0016331F
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 118556049-0
                                                                                                                                                                                                                                          • Opcode ID: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
                                                                                                                                                                                                                                          • Instruction ID: 309af456b7d54462813adb2d3e8a69b347d54bff43e734ab01aed6db7d26e139
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3AF0B4721011049BDF146F64D8154E9B3F8EF24362750097AE8ADC7312EB26DA60C790
                                                                                                                                                                                                                                          Function 001AB094 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • RtlAllocateHeap.NTDLL(00000000,00000001,?), ref: 001AB0C6
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: AllocateHeap
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 1279760036-0
                                                                                                                                                                                                                                          • Opcode ID: 7009db08e769ace07ebcbe4f60942cdcd570ea7cd3340961017e4d3272e05349
                                                                                                                                                                                                                                          • Instruction ID: 48619980dae261c88607a929b496fc638ab210f686832c3d960f8e9f7fa1212a
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7009db08e769ace07ebcbe4f60942cdcd570ea7cd3340961017e4d3272e05349
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 46E02B3D2082A06FDB313A65EE84B5F77689F433A0F054311FC249A0C3DB30CC1082A1
                                                                                                                                                                                                                                          Function 00166840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          • ___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00166853
                                                                                                                                                                                                                                            • Part of subcall function 00191F7B: FindNextFileW.KERNELBASE(?,?,?,00166858,?,?,?,?,0016691A,?,?,?,00000000,?,?), ref: 00191F84
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: FileFindNext___std_fs_directory_iterator_advance@8
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 3878998205-0
                                                                                                                                                                                                                                          • Opcode ID: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
                                                                                                                                                                                                                                          • Instruction ID: fd5f24566b8c4b66b57aaf5068812bbd2efebd7ddd8a2d25534625aeacd1ce4d
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B4D0C921704A31211E656A3B7D059BF469F4DE6BB4B85006AB949D3242EF048C2780E6
                                                                                                                                                                                                                                          Function 001A66D5 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                          • Source File: 00000007.00000002.3091233266.0000000000161000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00160000, based on PE: true
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3085821036.0000000000160000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091599117.00000000002BD000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091677170.00000000002BE000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091726845.00000000002E3000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091764072.00000000002E5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091801655.00000000002EA000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091862457.0000000000301000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091902593.0000000000305000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3091985051.0000000000307000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000314000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000502000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.0000000000507000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092032113.000000000050F000.00000040.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          • Associated: 00000007.00000002.3092542200.0000000000666000.00000020.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                          • Snapshot File: hcaresult_7_2_160000_aea7caadbf.jbxd
                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                          • API ID: H_prolog3
                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                          • API String ID: 431132790-0
                                                                                                                                                                                                                                          • Opcode ID: 8ce18ad2d97cca52eb39b234271ee81932a48d0d1aea7b63d50cc47eda15ad24
                                                                                                                                                                                                                                          • Instruction ID: 7404b2ef942b2159da0932863c927a18eb25e5c583ceaa98eb312a1d06010235
                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8ce18ad2d97cca52eb39b234271ee81932a48d0d1aea7b63d50cc47eda15ad24
                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 66E09AB6C0020D9ADF01DFE4C452BEFBBB8AB18310F504066A215E6181EB749784CBE1